Skip to content

Kaeso 0.3.9. Released 23 October 2026, with 3 changes.

Released
Changes
3 changes
In this release
Added, Changed and Fixed
The release on GitHub (opens in a new tab)

Kaeso 0.3.9 changes the sign-in-again dialog so that single sign-on is offered only when no password or sign-in link can confirm a recent sign-in, and providers that cannot confirm one are no longer offered. Integrations that read the sign-in-again, security or SSO fields, or handle the sso_error codes, must be updated because sends_auth_time is renamed and two codes are replaced. Operators gain the kaeso instance admin-sso command for choosing the organization whose single sign-on may administer an instance.

  • Breaking: The sends_auth_time field of the security and SSO endpoints is renamed to confirms_sign_in, and the stale_sign_in and no_auth_time codes are replaced by cannot_confirm. Integrations should read the new field, handle the new code, and expect sso to be empty whenever a password, sign-in link or set-password option is available. (#361 (opens in a new tab))

Contributors: @dvnold

Full changes: v0.3.8...v0.3.9 (opens in a new tab)

Added

  • The kaeso instance admin-sso command sets the organization whose single sign-on may administer the instance, or clears it with none, from the server's shell. Installs without passwords or sign-in links could not set this before without editing the database. Each change is written to the audit log and applies at once. (#360 (opens in a new tab))

Changed

Documentation

  • The GitHub release page keeps its tagline, highlights and breaking changes, then lists every changelog entry under its section heading instead of linking to the full changelog. (#359 (opens in a new tab))

Fixed

  • Sign-in again offers single sign-on only when no password or sign-in link can confirm the account, so people are no longer sent back to a dialog that single sign-on cannot satisfy. A confirmation whose ID token has no auth_time, or a stale one, is refused with the cannot_confirm code, and the provider is no longer offered for recent sign-in. (#361 (opens in a new tab))

More releases