Skip to content
Agents tracked: 442 Downloads (7d): 202M down 19.3% GitHub stars: 10.4M Releases (7d): 693 Agent status: 1 with issuesSince last limit reset: Claude 28d · Codex 1d Updated Oct 21, 2026
AgentGid
✦ Ask

Casdoor changelog: what's new each month

Every stable Casdoor release summarised by month: the highlights, new features, improvements, fixes and anything you need to act on. 4 months covered; the current month updates daily.

October 2026 · so far

9 releases: 4.14.0 → 4.22.0

October brought significant new capabilities to Casdoor, including a marketplace for integrations, improved OIDC compliance, and better deployment and customization options. The month featured six releases with a focus on security, user experience, and enterprise features.

Highlights

  • New Marketplace feature to install app, provider, and theme integrations with live previews.
  • Forward auth endpoint for Traefik, Caddy, and Nginx integration.
  • Organization admins can now customize sign-in pages with fonts, images, and HTML.
  • Support for sub-path deployment with basePath configuration.
  • Verification code grant for native app sign-in and external OIDC issuer trust.

New

  • Account menu opens on hover for better UX.
  • Well-known metadata file and improved OIDC conformance for hybrid flow, prompt, and maxage.
  • DCR switch and support for formpost and hybrid flow in consent page.
  • Helm chart published to GHCR and Artifact Hub with added README and service annotations.
  • Frontend build published to npm and loaded from CDN with robots.txt support.
  • Invitation expiration times and option to disable self-signup while keeping provider signup.
  • Welcome page for initial admin password setup and Marketplace theme preview on sign-in pages.
  • Container health checks, init data file with merge and watch modes, and role/permission columns parameter.

Improved

  • Terms of use now checked by default on login and signup pages.
  • Access-token sessions end when token is revoked by SSO logout.
  • DCR token lifetimes inherit from default application.
  • Startup loading spinner animation smoothed.
  • Redirect to requested page after login.
  • Demo site shows rotating Marketplace themes with sidebar switcher and theme parameter support.
  • Toast notifications restyled as plain cards with colored icons.
  • OIDC user ID mapping defaults to sub claim with automatic fallback.

Fixed

  • Handle missing organization and user in remove-user-from-group API.
  • JWT-Custom refresh tokens now marked with correct tokenType.
  • Camera properly released on unmount and video attached after face dialog mounts.
  • Access-token sessions properly ended when token is revoked by SSO logout.
  • Passwords accepted in organizations without password type configured.
  • LDAP filters, search bases, and attribute names now matched case-insensitively with improved memberOf handling.

September 2026

14 releases: 4.0.0 → 4.13.0

September brought a complete console redesign with shadcn/ui, numerous authentication improvements, and significant security hardening across the platform. The month focused on modernizing the user interface while expanding identity provider support and strengthening access controls.

Highlights

  • Replaced Ant Design console with new shadcn/ui frontend built with Vite for improved performance and user experience.
  • Added magic link sign-in and SAML Single Logout protocol support for enhanced authentication options.
  • Introduced command palette, bulk row selection, and inline form validation in the console.
  • Redesigned sign-in, sign-up, and password reset pages with improved mobile responsiveness and dark mode support.
  • Added comprehensive security hardening across OAuth, MFA, token exchange, and multi-organization scenarios.

New

  • Magic link sign-in capability for passwordless authentication.
  • OIDC provider type and OIDC prompt=none support on authorize page.
  • SAML Single Logout protocol implementation.
  • RADIUS Message-Authenticator support with per-provider configuration.
  • Command palette and bulk row selection in console.
  • Organization-level exclusive signin and max session count control.
  • Audit provider to forward audit logs to Syslog.
  • Device, IP, and last active time visibility for each session.

Improved

  • Console forms now lay out in two columns with configurable column hiding in list tables.
  • Authentication pages now show which groups granted each user role and which roles/groups granted permissions.
  • WeCom syncer now supports department sync and falls back to user/listid.
  • LDAP server can opt in to password reset functionality.
  • Password history check is now configurable.
  • Application-level dark logo and token group format options added.
  • LDAP auto-sync improved to run on only one node and survive connection panics.
  • React upgraded to 19.3.0 in web frontend.

Fixed

  • Sign-in directly when OAuth redirect URI points back at Casdoor without extra redirect steps.
  • Fixed dark mode on redesigned authentication pages and restored missing web-old behaviors.
  • Keep sign-in query string on forget and organization redirects.
  • Made authentication pages usable on mobile phones.
  • Fixed Apple Sign-in to use real name as display name and carry email verification status.
  • Improved error reporting for user uploads and WeCom department syncing issues.

August 2026

53 releases: 3.129.0 → 3.164.0

August brought significant security hardening, enhanced OAuth and LDAP capabilities, and continued migration of the frontend to a new UI framework. The month focused on permission management, token handling, and fixing edge cases across multiple authentication flows.

Highlights

  • Prevented privilege escalation via forged access keys and enforced server-side validation for sign-in method rules.
  • Added configurable token and record retention days per organization, with automatic permission expiration.
  • Improved OAuth resource parameter preservation across consent and refresh token flows.
  • Enhanced DingTalk integration with better error handling and user profile synchronization.
  • Began frontend migration from Ant Design to shadcn/ui with MFA and captcha support.

New

  • Avatar claim added to custom JWT tokens.
  • Socks5 proxy now supports authentication.
  • Backchannel logout URL field for applications.
  • Batch UpdatePermissions API to reduce performance overhead.
  • Token format configuration at the organization level.
  • LDAP search by uidNumber and gidNumber.
  • SAML IdP-initiated SSO support.
  • Properties field added to products.

Improved

  • Organization default avatar applied when user avatar is empty.
  • User language preference now saved during signup.
  • Language preference forwarded to Custom HTTP Email provider.
  • RFC 8707 resource parameter preserved in OAuth consent and fast auto-signin flows.
  • Browser mistranslation prevented by setting index.html lang attribute.
  • Password requirement popover remains open until all requirements are met.
  • DingTalk group IDs now prefixed with organization for isolation.
  • Dark mode computation now respects application theme setting.

Fixed

  • Prevented org admins from being locked out by CheckLoginPermission exemption.
  • Fixed privilege escalation vulnerability in AddKey/UpdateKey operations.
  • DingTalk token error code parsing corrected from int to string.
  • Sessions and tokens now revoked when a user is forbidden.
  • Phone numbers normalized and validated before saving.
  • Active Directory userAccountControl no longer overwritten on password reset.

July 2026

6 releases: 3.123.0 → 3.128.0

July brought refinements to authentication flows and session management, with fixes addressing password recovery, social login, and logout handling across different configurations.

Highlights

  • Device user codes now persist correctly through social login flows
  • Logout now properly cleans up database session records
  • Forgot password requests are rejected for LDAP users before sending codes
  • Uploaded files are served with security headers to prevent browser interpretation

New

  • Sandbox, nosniff, and attachment headers added to uploaded file responses

Improved

  • Forget password placeholder adapts to configured authentication providers
  • Session cleanup now handles all applications instead of only app-built-in sessions
  • Logout audit records are preserved even when logPostOnly mode is enabled

Fixed

  • Device userCode now preserved through social login round-trip
  • Beego session IDs captured before regeneration to ensure proper database cleanup on logout
  • Forgot password flow now rejects LDAP user requests before sending codes

Summaries are written automatically from the official release notes (full changelog ↗); check the original notes before relying on a detail. Casdoor: pricing, features and alternatives · All changelogs