release: version packages (#7938)

silverhand-bot · web-flow · commit 73d3ae807fd4 · 2025-11-28T10:57:56.000+08:00
diff --git a/.changeset/afraid-stingrays-sparkle.md b/.changeset/afraid-stingrays-sparkle.md
diff --git a/.changeset/lovely-eels-end.md b/.changeset/lovely-eels-end.md
diff --git a/.changeset/perfect-needles-repair.md b/.changeset/perfect-needles-repair.md
diff --git a/.changeset/pretty-snails-deny.md b/.changeset/pretty-snails-deny.md
diff --git a/.changeset/wild-apes-protect.md b/.changeset/wild-apes-protect.md
diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @logto/api
 
+## 1.34.0
+
 ## 1.33.0
 
 ## 1.32.0
diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/api",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Logto API types and clients.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Change Log
 
+## 1.34.0
+
+### Patch Changes
+
+- Updated dependencies [900201a48c]
+- Updated dependencies [c3266a917a]
+  - @logto/schemas@1.34.0
+
 ## 1.33.0
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/cli",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Logto CLI.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Change Log
 
+## 1.31.0
+
+### Minor Changes
+
+- c3266a917a: add a new webhook event "Identifier.Lockout", which is triggered when a user is locked out due to repeated failed sign-in attempts
+
 ## 1.30.0
 
 ### Minor Changes
diff --git a/packages/console/package.json b/packages/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/console",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "> TODO: description",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,55 @@
 # Change Log
 
+## 1.34.0
+
+### Minor Changes
+
+- 08f887c448: support cross-app authentication callbacks within the same browser session
+
+  When multiple applications are initiating authentication requests within the same browser session,
+  authentication callbacks may interfere with each other due to the shared `_interaction` cookie.
+
+  To resolve this, we now change the cookie from a plain UID string to a structured mapping object
+  `{ [app_id]: interaction_uid }`, and maintain the `app_id` in either the URL search parameters or HTTP
+  headers for all authentication-related requests and redirects. This ensures that each application can
+  correctly identify its own authentication context without interference from others.
+
+  The fallback mechanism is also implemented to ensure backward compatibility.
+
+- c3266a917a: add a new webhook event "Identifier.Lockout", which is triggered when a user is locked out due to repeated failed sign-in attempts
+
+### Patch Changes
+
+- 900201a48c: align refresh token grant lifetime with 180-day TTL
+
+  Refresh tokens were expiring after 14 days because the provider grant TTL was still capped at the default two weeks, regardless of the configured refresh token TTL.
+
+  Now set the OIDC grant TTL to 180 days so refresh tokens can live for their configured duration, also expand the refresh token TTL up to 180 days.
+
+- dadbea6936: fix email/phone template selection during sign up
+
+  Previously, the send code API (Experience API) always switched to the `TemplateType.BindMfa` email template as soon as an interaction already had an identified user. During multi-step sign-up flows (for example, username + email), the interaction can already identify the user before the email step finishes, so legitimate sign-up verifications were mistakenly treated as MFA binding and used the wrong template.
+
+  The fix checks if the email/phone identifier is part of the sign-up identifiers. If it is, then we are still in the sign-up flow and should use the appropriate sign-up email/phone template. Only when the email/phone is not part of the sign-up identifiers (meaning the sign-up flow is complete) and the interaction has an identified user, do we switch to the `BindMfa` template.
+
+- c6554587ee: improve SSO connectors with case-insensitive domain matching
+
+  According to the latest standards, email domains should be treated as case-insensitive. To ensure robust and user-friendly authentication, we need to locate SSO connectors correctly regardless of the letter case in the provided email domain.
+
+  - Domain normalization on insert: The domains configured for SSO connectors are now normalized to lowercase before being inserted into the database. This ensures consistency and prevents issues arising from varied casing. As part of this change, identical domains with different casing will be treated as duplicates and rejected to maintain data integrity.
+  - Case-insensitive search for SSO connectors: The get SSO connectors by email endpoint has been updated to perform a case-insensitive search when matching email domains. This guarantees that the correct enabled SSO connector is identified, regardless of the casing used in the user's email address.
+
+- Updated dependencies [900201a48c]
+- Updated dependencies [08f887c448]
+- Updated dependencies [c3266a917a]
+  - @logto/schemas@1.34.0
+  - @logto/experience@1.17.0
+  - @logto/console@1.31.0
+  - @logto/phrases@1.23.0
+  - @logto/account-center@0.1.0
+  - @logto/cli@1.34.0
+  - @logto/demo-app@1.5.0
+
 ## 1.33.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/core",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "The open source identity solution.",
   "main": "build/index.js",
   "author": "Silverhand Inc. <contact@silverhand.io>",
diff --git a/packages/create/CHANGELOG.md b/packages/create/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Change Log
 
+## 1.34.0
+
+### Patch Changes
+
+- @logto/cli@1.34.0
+
 ## 1.33.0
 
 ### Patch Changes
diff --git a/packages/create/package.json b/packages/create/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/create",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -15,6 +15,6 @@
     "node": "^22.14.0"
   },
   "dependencies": {
-    "@logto/cli": "workspace:^1.33.0"
+    "@logto/cli": "workspace:^1.34.0"
   }
 }
diff --git a/packages/experience/CHANGELOG.md b/packages/experience/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Change Log
 
+## 1.17.0
+
+### Minor Changes
+
+- 08f887c448: support cross-app authentication callbacks within the same browser session
+
+  When multiple applications are initiating authentication requests within the same browser session,
+  authentication callbacks may interfere with each other due to the shared `_interaction` cookie.
+
+  To resolve this, we now change the cookie from a plain UID string to a structured mapping object
+  `{ [app_id]: interaction_uid }`, and maintain the `app_id` in either the URL search parameters or HTTP
+  headers for all authentication-related requests and redirects. This ensures that each application can
+  correctly identify its own authentication context without interference from others.
+
+  The fallback mechanism is also implemented to ensure backward compatibility.
+
 ## 1.16.1
 
 ### Patch Changes
diff --git a/packages/experience/package.json b/packages/experience/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/experience",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "license": "MPL-2.0",
   "type": "module",
   "private": true,
diff --git a/packages/integration-tests/CHANGELOG.md b/packages/integration-tests/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Change Log
 
+## 1.16.0
+
+### Minor Changes
+
+- 08f887c448: support cross-app authentication callbacks within the same browser session
+
+  When multiple applications are initiating authentication requests within the same browser session,
+  authentication callbacks may interfere with each other due to the shared `_interaction` cookie.
+
+  To resolve this, we now change the cookie from a plain UID string to a structured mapping object
+  `{ [app_id]: interaction_uid }`, and maintain the `app_id` in either the URL search parameters or HTTP
+  headers for all authentication-related requests and redirects. This ensures that each application can
+  correctly identify its own authentication context without interference from others.
+
+  The fallback mechanism is also implemented to ensure backward compatibility.
+
+- c3266a917a: add a new webhook event "Identifier.Lockout", which is triggered when a user is locked out due to repeated failed sign-in attempts
+
 ## 1.15.0
 
 ### Minor Changes
diff --git a/packages/integration-tests/package.json b/packages/integration-tests/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/integration-tests",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Integration tests for Logto.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
diff --git a/packages/phrases/CHANGELOG.md b/packages/phrases/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Change Log
 
+## 1.23.0
+
+### Minor Changes
+
+- c3266a917a: add a new webhook event "Identifier.Lockout", which is triggered when a user is locked out due to repeated failed sign-in attempts
+
 ## 1.22.0
 
 ### Minor Changes
diff --git a/packages/phrases/package.json b/packages/phrases/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/phrases",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Logto shared phrases (i18n).",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
diff --git a/packages/schemas/CHANGELOG.md b/packages/schemas/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Change Log
 
+## 1.34.0
+
+### Minor Changes
+
+- c3266a917a: add a new webhook event "Identifier.Lockout", which is triggered when a user is locked out due to repeated failed sign-in attempts
+
+### Patch Changes
+
+- 900201a48c: align refresh token grant lifetime with 180-day TTL
+
+  Refresh tokens were expiring after 14 days because the provider grant TTL was still capped at the default two weeks, regardless of the configured refresh token TTL.
+
+  Now set the OIDC grant TTL to 180 days so refresh tokens can live for their configured duration, also expand the refresh token TTL up to 180 days.
+
+- Updated dependencies [c3266a917a]
+  - @logto/phrases@1.23.0
+
 ## 1.33.0
 
 ### Patch Changes
diff --git a/packages/schemas/alterations/1.34.0-1762338508-add-organization-roles-type-index.ts b/packages/schemas/alterations/1.34.0-1762338508-add-organization-roles-type-index.ts
diff --git a/packages/schemas/alterations/1.34.0-1764164658-add-applications-roles-include-indexes.ts b/packages/schemas/alterations/1.34.0-1764164658-add-applications-roles-include-indexes.ts
diff --git a/packages/schemas/alterations/1.34.0-1764236036-remove-applications-roles-include-indexes.ts b/packages/schemas/alterations/1.34.0-1764236036-remove-applications-roles-include-indexes.ts
diff --git a/packages/schemas/package.json b/packages/schemas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
diff --git a/packages/translate/CHANGELOG.md b/packages/translate/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @logto/translate
 
+## 0.2.6
+
+### Patch Changes
+
+- Updated dependencies [c3266a917a]
+  - @logto/phrases@1.23.0
+
 ## 0.2.5
 
 ### Patch Changes
diff --git a/packages/translate/package.json b/packages/translate/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/translate",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "A CLI tool that helps translate phrases and experience-phrases to i18n resources.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@logto/api",`
`3`		`- "version": "1.33.0",`
	`3`	`+ "version": "1.34.0",`
`4`	`4`	`"description": "Logto API types and clients.",`
`5`	`5`	`"author": "Silverhand Inc. <[email protected]>",`
`6`	`6`	`"homepage": "https://github.com/logto-io/logto#readme",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@logto/cli",`
`3`		`- "version": "1.33.0",`
	`3`	`+ "version": "1.34.0",`
`4`	`4`	`"description": "Logto CLI.",`
`5`	`5`	`"author": "Silverhand Inc. <[email protected]>",`
`6`	`6`	`"homepage": "https://github.com/logto-io/logto#readme",`