Logto v1.40.0 brings a time-range picker for audit logs, richer organization membership webhook payloads, big performance wins for large organizations, and several self-hosting quality-of-life improvements.
Logto v1.40.0 is a platform-hardening release. It makes audit logs practical at scale, tells you exactly what changed in organization membership webhooks, speeds up organization queries on large tenants, and removes a couple of long-standing friction points for self-hosted deployments. Three new connectors land too. Here's what's new.
Audit logs are most useful when something just happened — but until now the Console fetched an unbounded window, which got slow on tenants with very large log volumes.
This release adds a time-range picker to the audit logs page, defaulting to the last 7 days. You get preset windows (Last 1 hour, Last 24 hours, Last 7 days, Last 30 days) and a custom date range, and older logs stay reachable by simply widening the window (#8810).
Under the hood, the Management API gains start_time and end_time query parameters on GET /api/logs and GET /api/hooks/{id}/recent-logs (exclusive bounds in unix milliseconds), so you can scope log queries programmatically too (#8806). For the very largest tenants, a new enableCap=true parameter short-circuits the count query at ~10,000 rows and returns a Total-Number-Is-Capped: true header, trading an exact total for a response that won't hit statement_timeout; the Console falls back to a Prev/Next layout when the cap is reached (#8796, #8802). Default behavior without the parameter is unchanged.
The Organization.Membership.Updated webhook used to tell you that membership changed, but not what changed. It now carries explicit delta fields — addedUserIds / removedUserIds and addedApplicationIds / removedApplicationIds — across the membership endpoints, plus addedUserIds on invitation accept and just-in-time provisioning (email-domain and enterprise SSO JIT) (#8840).
This is fully additive and non-breaking: empty deltas are omitted, and each array is capped at 5000 entries for bulk operations (reconcile via GET /organizations/:id/users or .../applications when you exceed that). See the webhook reference for the full contract. This work supersedes an earlier community proposal — credit to @chiche84 (#8752).
While we were in the sessions code, GET /api/my-account/sessions also gained an isCurrent flag on every entry, so session-management UIs can mark the "This device" row and avoid revoking the caller's own session (#8731).
Several changes target tenants with very large organizations:
GET /organizations/:id/users now aggregates roles through a LATERAL subquery, so LIMIT prunes the user set before role lookups run — instead of materializing the entire members × roles join on every paginated request (#8826).organization_user_relations (tenant_id, user_id), hit on every sign-in and by the membership middleware (#8818), and one on organization_role_user_relations (tenant_id, organization_id, user_id), hit by getUserScopes and per-user role joins (#8819).PUT /organizations/:id/users switches to a new delta-based query that writes only the rows that actually changed, instead of rewriting every membership row on each call — and it preserves role assignments for members who survive the update (#8820).prompt=none instead of bouncing to the login screen, thanks to @taka-guevara (#8785).connectorId correctly (#8758), and the 2-step verification toggle label is clearer (#8792).This release adds three connectors and improves several more — several of them from the community:
auth may now omit user and pass, so relays that authorize by source (e.g. IP/VLAN) work without forging credentials (#8888).A couple of changes specifically smooth out OSS deployments:
Air-gapped admin setup. The
installanddb seedcommands now accept a--dapcflag (alias--disable-admin-pwned-password-check). The admin tenant's seeded password policy enables the Have I Been Pwned breach check by default, which callsapi.pwnedpasswords.comon every admin password submission — and hangs the first admin sign-up when that endpoint is unreachable. Passing--dapcseeds the policy with the breach check disabled, so admin sign-up no longer depends on outbound network access. (Credit @darcyYe, #8859)
Admin signing keys from the database. OSS deployments now read the admin tenant signing keys directly from the database, removing the extra host/DNS mappings that previously let the Logto container fetch its own admin tenant OIDC configuration through the externally configured endpoint (#8869).
Migration required. v1.40.0 ships database schema alterations (the new organization-relation indexes and additional internal columns). After pulling the new version, run the database alteration step before starting the server. See the upgrade guide.
Ready to upgrade? Check out our upgrade guide for step-by-step instructions.
For the complete list of changes, see the GitHub release page.
Have questions or feedback? Join us on Discord or open an issue on GitHub.