Infisical Release Notes

What's Changed

• chore: add upgrade impact for v0.166.8 by @github-actions[bot] in #8681
• docs: note that Palo Alto Networks syncs need the certificate's private key by @carlosmonastyrski in #8669
• fix(ui): keep the org name visible in project and product scope by @andrewhuhh in #8676
• fix(ui): right-align sheet footers with Cancel before the primary action by @andrewhuhh in #8675
• docs(cert-agent): combined certificate chain output by @bernie-g in #8660
• feat(pam): store session recordings in S3-compatible storage by @lb-vn in #8485
• docs(cli): note that logout deletes the offline secrets backup by @lobocv in #8648
• chore: validate freeze flag before release by @Thiago-AS in #8699
• fix: remove PAM from project templates list by @mathnogueira in #8710
• feat(pki): add AWS KMS-backed signing keys for internal CAs by @carlosmonastyrski in #8637
• fix(identity-access-token): expire the uses-remaining counter with its token by @scott-ray-wilson in #8654
• fix(deps): upgrade backend mail, template, telemetry and native hashing packages by @andrewhuhh in #8679
• fix(cert-manager): validate certificate profile name inline and keep wizard on the failing step by @andrewhuhh in #8664
• chore(frontend): upgrade TypeScript to 5.9 and drop TS 7-removed options by @andrewhuhh in #8682
• improvement(ui): migrate CLI redirect page to V3 and align its layout by @andrewhuhh in #8671
• fix(billing): show self-hosted billing guidance by license state by @andrewhuhh in #8680
• fix(ui): use sub-org scope color for sub-org actions by @andrewhuhh in #8690
• fix(secrets-overview): keep row action bar visible while a focused row is hovered by @andrewhuhh in #8696
• improvement(frontend): group Add Machine Identity to Project options by product by @andrewhuhh in #8701
• improvement(insights): show a blurred preview when Insights is not on the plan by @andrewhuhh in #8703
• feat(agent-vault): move variables from access bundles to Agent Vault as a whole by @scott-ray-wilson in #8581
• feat(ui): suggested values for naming inputs, starting with secret sync names by @andrewhuhh in #8702
• fix(ui): clean up org Product Settings tab by @andrewhuhh in #8713
• docs(agent-vault): the session token and access bundle can come from the environment by @saifsmailbox98 in #8104
• improvement(ui): move org general and security settings cards to footer layout by @andrewhuhh in #8725
• docs(kms): overhaul section by @adkah in #8686
• feat(ui): shared EmailInput chip field and email validation by @andrewhuhh in #8663
• fix(litellm): accept proxy master keys when validating connections by @victorvhs017 in #8712
• improvement(secret-sharing): separator collapse and sticky sheet footer by @andrewhuhh in #8732
• improvement(ui): migrate remaining v2 confirm modals to DeleteConfirmDialog by @andrewhuhh in #8716
• feat(ui): offer folder access on Pro from the custom role upgrade gate by @andrewhuhh in #8720
• improvement(frontend): default Add Machine Identity sheet to Assign Existing by @andrewhuhh in #8722
• feat(ui): suggest app connection names from provider and auth method by @andrewhuhh in #8723
• feat(ui): suggest honey token names by type and environment by @andrewhuhh in #8727
• feat(ui): suggest certificate authority names from CA type, common name, and issuer by @andrewhuhh in #8728
• feat(ui): suggest approval policy names from type, environments, and path by @andrewhuhh in #8729
• feat(ui): suggest certificate policy names from the selected preset by @andrewhuhh in #8731
• docs: migration from legacy InfiscialSecret k8s CRD's by @varonix0 in #8736
• feat(signup): open the chosen plan's trial after signup from the pricing page by @andrewhuhh in #8705
• fix(secrets): secret name cell focus, scroll, and empty-state fixes by @andrewhuhh in #8735
• fix(ui): drop h-full from org page roots so bottom padding survives scroll by @andrewhuhh in #8739
• feat(signup): open the pricing trial prompt for signed-in users by @andrewhuhh in #8738
• improvement(secrets): make the overview Manage Access button easier to find by @andrewhuhh in #8718
• feat: findings revamp by @mathnogueira in #8577
• feat: data store list revamp by @mathnogueira in #8631
• feat: redesign data source flow by @mathnogueira in #8641
• improvement(ui): rename DeleteConfirmDialog to ConfirmationAlertDialog by @andrewhuhh in #8717
• feat(db): add audit_log_streams table to sanitized schema by @victorvhs017 in #8746
• fix(secret-scanning): reject data sources that reuse an app connection by @claude[bot] in #8758
• improvement(pki): pkcs12 password policy by @bernie-g in #8674
• fix(webhook): stop delete endpoint from returning encrypted columns by @Arunkoo in #8643
• fix: use write op instead of delete in metrics by @mathnogueira in #8764
• docs(cli): add troubleshooting guide for failed API requests by @victorvhs017 in #8697
• chore(frontend): migrate to React 19 by @andrewhuhh in #8721
• improvement(groups): auto-populate group slug from name by @andrewhuhh in #8766
• docs(yaml-migration): update docs to reflect the new behavior of the CLI by @adilsitos in #8762
• fix(secrets): explain disabled edit and block move for managed secrets by @andrewhuhh in #8704
• improvement(auth): name login button in SSO enforcement toast on select-org by @victorvhs017 in #8763
• improvement(frontend): consistent slug auto-fill from name across create forms by @andrewhuhh in #8768
• docs(ax): agentic quickstart by @adkah in #8324
• docs(cli): add sm projects commands by @adkah in #8737
• docs(cli): clarify av env variables by @adkah in #8761
• fix(approvals): show request folder path in change requests list by @andrewhuhh in #8678
• fix(agent-vault): drop discard confirmation from Create Session dialog by @scott-ray-wilson in #8770
• docs(agent-vault): mention env variables in the quickstart by @adkah in #8771
• docs: add new plans rate limiting values by @Thiago-AS in #8775
• feat: added API E2E for scim by @akhilmhdh in #8687
• docs(readme): add Agent Vault section by @adkah in #8782
• feat(onboarding): add explicit telemetry for onboarding resource links by @andrewhuhh in #8774
• feat(ui): show page breadcrumbs in the top navigation on every route by @andrewhuhh in #8747
• chore(data-migration): secret access by @adilsitos in #8783
• chore(data-migration): secret change by @adilsitos in #8784
• improvement(secrets): surface secret imports in Add New dropdown by @andrewhuhh in #8769
• fix(docs): improve agentic quickstart styling by @adkah in #8785
• docs(readme): audit README for accuracy and product coverage by @adkah in #8787
• feat(billing-v2): show offline license usage on unified billing page by @victorvhs017 in #8777

New Contributors

• @Arunkoo made their first contribution in #8643

Full Changelog: v0.166.8...v0.166.9

What's Changed

• feat: add semantic Secrets Overview telemetry by @andrewhuhh in #8636
• feat(billing): add optional cancellation comment to the Billing V2 cancel reason event by @andrewhuhh in #8634
• docs(secret-scanning): overhaul section by @adkah in #8650
• feat(alerts): add authentication and custom headers to webhook channels by @Thiago-AS in #8582
• feat(audit-log-stream): alert when a stream starts dropping logs by @lobocv in #8526
• feat: added test for saml in api e2e by @akhilmhdh in #8638
• improvement(cert-manager): migrate CaInstallCertModal to v3 Dialog by @andrewhuhh in #8592
• fix: remove mention of "project" from secret scanning by @mathnogueira in #8568
• improvement(secret-manager): migrate native integration creation pages to V3 (S11) by @andrewhuhh in #8614
• improvement(secret-manager): migrate native integration creation pages to V3 (S12) by @andrewhuhh in #8617
• improvement(integrations): port native provider creation pages to V3 (S13) by @andrewhuhh in #8616
• improvement(integrations): port native provider creation pages to V3 (S14) by @andrewhuhh in #8618
• fix(auth): allow retry after MFA organization selection fails by @andrewhuhh in #8620
• improvement(ui): support Sheet and in-place Combobox creation by @andrewhuhh in #8621
• fix(cert-manager): anchor signing configuration sheet footers by @andrewhuhh in #8623
• fix(ui): compose machine identity dialog body and footer by @andrewhuhh in #8624
• fix(pam): anchor detail sheet headers and action footers by @andrewhuhh in #8625
• fix(ui): use canonical Sheet footers in reusable wizard forms by @andrewhuhh in #8626
• fix(cert-manager): use canonical Sheet footers by @andrewhuhh in #8627
• chore(ui): delete orphan notice family and dead admin adapters by @andrewhuhh in #8630
• improvement(ui): compose KMS signing dialogs with V3 shells by @andrewhuhh in #8646
• improvement(cert-manager): migrate clear PKI overlays to v3 by @andrewhuhh in #8647
• improvement(secret-sharing): masked share value, name prefill, and constraint count by @andrewhuhh in #8633
• chore(ui): remove unused V2 SecretPathInput source by @andrewhuhh in #8656
• improvement(auth): use V3 alert for passkey failures by @andrewhuhh in #8655
• fix(ui): reserve toast close-button space and default bulk bar to icon clear by @andrewhuhh in #8661
• improvement(proxied-services): migrate surface picker to Combobox by @andrewhuhh in #8659
• fix(cron): dedup fires on a per-job key and skip a new job's first due fire by @lobocv in #8587
• fix(identity-ua): compare client secret usage counts as numbers by @lobocv in #8644
• fix: resovled test failing due to ci contraint by @akhilmhdh in #8667
• feat(query): return all tags for evaluation by @adilsitos in #8576
• fix(ui): match quick-add secret key input weight to secret rows by @andrewhuhh in #8670
• fix(ui): secret reference selector scrolling, search, and dismissal by @andrewhuhh in #8662
• feat(secret-sync-app-connection): support for portainer by @zenato in #7670

New Contributors

• @zenato made their first contribution in #7670

Full Changelog: v0.166.7...v0.166.8

What's Changed

• feat(secrets): edit secret sheet and comment preview in single-environment view by @andrewhuhh in #8607
• fix(billing): show credit invoices as Credit and format negative amounts as -$X.XX by @andrewhuhh in #8603
• improvement(secret-manager): move Access Control up in the project sidebar by @andrewhuhh in #8601
• feat(billing): require a cancellation reason in Billing V2 cancel dialogs by @andrewhuhh in #8606
• improvement(kms): migrate signing algorithm selects to v3 by @andrewhuhh in #8454
• fix(ui): match pending loaders to button variants by @andrewhuhh in #8619
• chore: add upgrade impact for v0.166.5 by @github-actions[bot] in #8574
• chore: add upgrade impact for v0.166.6 by @github-actions[bot] in #8628
• feat(dynamic-secrets): add Kafka support by @DimitrisStaratzis in #8538
• fix(project-membership): use the org default role when inviting to a project via v2 by @lobocv in #8593
• improvement(rate-limit): remove unused self-hosted rate limit config by @lobocv in #8546
• docs(cli): document secrets management under infisical sm by @victorvhs017 in #8629
• fix(secret-sync): reject reserved id key in Chef sync by @claude[bot] in #8579
• docs(pki): update cert management ia and content by @adkah in #8622
• fix(agent-vault): zero-pad day and hour in session timestamps by @claude[bot] in #8639
• improvement(agent-vault): remove Credential column from access bundle services table by @claude[bot] in #8640
• improvement(ui): make announcement modal navigation obvious by @andrewhuhh in #8635
• fix(ui): keep Select Escape from dismissing parent overlays by @andrewhuhh in #8632
• feat(pam): move to alerting module by @lb-vn in #8462

Full Changelog: v0.166.6...v0.166.7

What's Changed

• breaking(agent-vault): revoke members with DELETE and change roles in bulk by @scott-ray-wilson in #8547
• breaking(agent-vault): make every variable secret by @scott-ray-wilson in #8550
• improvement(ui): migrate org access pages and KMS settings off V2 primitives by @andrewhuhh in #8569
• fix: require the fine-grained identity action everywhere and gate auth template edits by @Thiago-AS in #8509
• feat(openrouter-rotation): workspace support by @varonix0 in #8573
• docs(secrets-mgmt): ia updates by @adkah in #8572
• feat(secret-sync): support encrypted data bags in Chef sync by @DimitrisStaratzis in #8556
• fix(insights): read project access volume and auth methods from ClickHouse when enabled by @DimitrisStaratzis in #8560
• chore: remove mention of PKI projects by @sheensantoscapadngan in #8539
• feat(billing): meter-tile product cards with inline usage details by @andrewhuhh in #8492
• docs(secret-scanning): reflect single-project structure in org guide by @mintlify[bot] in #8584
• feat(pam): mssql discovery by @lb-vn in #8511
• fix(agent-vault): confirm discard before returning to the template step by @devin-ai-integration[bot] in #8588
• fix(cert-manager): allow creating a connection inline when installing an intermediate CA via external CA by @claude[bot] in #8564
• feat(ui): split project templates by product type by @andrewhuhh in #8563
• improvement(table): add V3 skeleton rows and opt-in cell wrapping by @andrewhuhh in #8567
• improvement(ui): add V3 overlay layer contract and migrate first Modal and DeleteActionModal consumers by @andrewhuhh in #8570
• docs(folder-rbac): match folder access entry points to current UI by @andrewhuhh in #8589
• improvement(ui): add 1Password ignore default to V3 Input and text slot to PageLoader by @andrewhuhh in #8571
• feat(pki-syncs): add Palo Alto Networks app connection and certificate syncs by @carlosmonastyrski in #8534
• improvement(agent-vault): hide reveal toggle over stored secret values by @devin-ai-integration[bot] in #8594
• improvement(kms): migrate key operation dialogs to V3 overlays by @andrewhuhh in #8608
• improvement(secret-manager): migrate S08 Secret Manager core, integration management and rotation UI to V3 by @andrewhuhh in #8599
• improvement(cert-manager): migrate PKI tables, menus and form fields to V3 by @andrewhuhh in #8597
• chore: change severity logs in a couple of places by @Thiago-AS in #8602
• docs(migration): add a way to migrate the .infisical.json to .infisical.yaml by @adilsitos in #8580
• fix(ui): forward V3 SelectTrigger refs by @andrewhuhh in #8613
• improvement(ui): migrate rotation, integration management and PAM overlays to V3 by @andrewhuhh in #8610
• improvement(ui): migrate org access, settings, auth and project template overlays to V3 by @andrewhuhh in #8611
• improvement(ui): migrate shared components, auth entry pages and PAM loaders to V3 by @andrewhuhh in #8612
• improvement(cert-manager): migrate CA and certificate detail overlays to V3 by @andrewhuhh in #8615
• fix(audit-log): treat "No limit" retention as unlimited instead of dropping every log by @scott-ray-wilson in #8595
• improvement(frontend): route cmd+f to the page's / search input by @andrewhuhh in #8565

Full Changelog: v0.166.5...v0.166.6

What's Changed

• feat: move secret scanning to be a single project product by @mathnogueira in #8512
• docs: link new Infisical CLI video in local development guide and CLI quickstart by @devin-ai-integration[bot] in #8553
• chore: add upgrade impact for v0.166.4 by @github-actions[bot] in #8561
• feat(global-approval): secret change by @adilsitos in #8478
• fix(secrets): improve search all folders scoping and results by @andrewhuhh in #8166
• docs(cli): update cert-manager agent by @mintlify[bot] in #8559
• docs(agent-vault): add setup planner by @adkah in #8548
• feature: added banner for subscription payment by @akhilmhdh in #8458
• feat: added secrets testcases for api e2e test by @akhilmhdh in #8541
• fix(ui): sheet overscroll by @bernie-g in #8514
• fix(agent-vault): show contact us instead of billing in upgrade prompts by @andrewhuhh in #8554
• fix(frontend): stop secrets overview re-rendering every row while resizing by @andrewhuhh in #8543
• feat(secrets): import nested JSON objects as folders by @claude[bot] in #8414
• docs(style): square the corners of the Agent Vault preview badge by @adkah in #8562
• fix(telemetry): preserve secret quantities by pull channel by @andrewhuhh in #8544
• improvement(agent-vault): serve session logs from S3 instead of a chunks table by @saifsmailbox98 in #8497
• fix: normalize damaged PEM input on certificate import by @carlosmonastyrski in #8566

Full Changelog: v0.166.4...v0.166.5

What's Changed

• docs(agent-vault): clarify proxy enrollment steps by @adkah in #8528
• docs(agent-vault): fix dynamic link styling in quickstart by @adkah in #8529
• fix(frontend): close product plans popover on View Billing click by @andrewhuhh in #8531
• docs(agent-vault): add programmatic guides by @adkah in #8524
• fix(billing): use secrets_manager product key for Secrets Management by @andrewhuhh in #8535
• feat(agent-vault): use the org ID as the AWS External ID and show it by @saifsmailbox98 in #8375
• feat(reminders): deliver secret reminders through alert channels by @lobocv in #8356
• feat(secrets-sync): add Cloudflare Secrets Store integration by @DimitrisStaratzis in #8500
• chore: add upgrade impact for v0.166.3 by @github-actions[bot] in #8530
• fix: block DNS rebinding by @carlosmonastyrski in #8515
• feature(pki): audit log certificate issuance failures by @bernie-g in #8480
• fix(frontend): block secret uploads that exceed the 1 MB request limit by @andrewhuhh in #8533
• breaking(agent-vault): flatten member responses and drop the membership id by @scott-ray-wilson in #8373
• feat(pam): allow org admins to join any folder by @sheensantoscapadngan in #8510
• feat(secret-sync): keeper by @adilsitos in #8518
• chore: record resource name in alert audit events by @carlosmonastyrski in #8545
• feat(frontend): virtualize secret preview tables in bulk actions by @andrewhuhh in #8542
• fix(secrets-overview): keep expanded row chevron stable in multi-env view by @andrewhuhh in #8549
• improvement(ui): standardize Loader on the yellow brand mark by @andrewhuhh in #8555
• fix: resolved failing honey token for unlimited mode by @akhilmhdh in #8557
• feat: address greptile comments in honey token fix by @akhilmhdh in #8558

Full Changelog: v0.166.3...v0.166.4

What's Changed

• feat(pki): add UltraDNS as an ACME DNS-01 provider by @carlosmonastyrski in #7718
• improvement: add pki usage posthog metrics by @sheensantoscapadngan in #8465
• fix(secrets): restrict overview resize hit areas to column headers by @andrewhuhh in #8495
• improvement(approval-system): move access approval into global system by @adilsitos in #8394
• feature(kms): ed25519 sign/verify keys by @bernie-g in #8470
• chore: add upgrade impact for v0.166.2 by @github-actions[bot] in #8505
• docs(style): update style guide and skill by @adkah in #8504
• fix(membership): retain Certificate Manager and PAM project admins by @andrewhuhh in #8456
• feat(billing): replace legacy upgrade dialogs with shared gates by @andrewhuhh in #8182
• feat(pki): google cloud dns acme provider by @bernie-g in #8406
• fix(notifications): add clear all and refine remove control by @andrewhuhh in #8482
• feat(secret-sync): warn before moving or copying secrets into a synced path by @lobocv in #8372
• fix(secrets): resolve references to secret names that contain spaces by @DimitrisStaratzis in #8517
• feat(secret-rotation): add GCP service account key rotation by @DimitrisStaratzis in #8474
• feat: harness for api e2e testing by @akhilmhdh in #8443
• docs(machine-identities): rewrite doc by @adkah in #8503
• chore(telemetry): remove segfault-handler integration by @victorvhs017 in #8521
• fix(ui): lighten app connections banner text and center dismiss button by @andrewhuhh in #8523
• fix(folder-commit): run tree checkpoint lookup inside the commit transaction by @OmBhandwaldar in #8496
• feat: add HPE ilo redfish app connection by @mathnogueira in #8484
• feat: add support for multiple connections in secret rotation by @mathnogueira in #8501
• feat: redfish api implementation by @mathnogueira in #8506

New Contributors

• @OmBhandwaldar made their first contribution in #8496

Full Changelog: v0.166.2...v0.166.3

What's Changed

• improvement(ui): remove legacy page header after final consumers migrate by @andrewhuhh in #8429
• improvement(kms): migrate signing form controls to v3 by @andrewhuhh in #8436
• fix: patch ip usage by @sheensantoscapadngan in #8491
• docs(audit-logs): deslop event classes by @adkah in #8486
• fix: patch server name by @sheensantoscapadngan in #8493
• fix: hdb by passing servername as undefined by @Thiago-AS in #8494
• improvement(ui): migrate secret scanning connection selection to v3 by @andrewhuhh in #8430

Full Changelog: v0.166.1...v0.166.2

What's Changed

• chore(frontend): upgrade ESLint to v9 while preserving lint policy by @andrewhuhh in #8398
• chore(deps): refresh backend lockfile within existing ranges by @Vligai in #8472
• feature: implemented dynamic secret oauth 2.0 by @akhilmhdh in #8329
• fix: adjust realtime scan concurrency from 5 to 2 jobs by @mathnogueira in #8479
• docs(agent-vault): move and clarify session logs docs by @adkah in #8481
• improvement(ui): use V3 HoverCard for Coming Soon data source links by @andrewhuhh in #8469
• chore(ui): remove orphaned v2 breadcrumb source by @andrewhuhh in #8468
• chore: upgraded to node 26 by @akhilmhdh in #8408
• chore(integrations): migrate loading presentation to v3 by @andrewhuhh in #8467
• feat: add Certificate Manager-wide certificate alerts by @carlosmonastyrski in #8399

Full Changelog: v0.166.0...v0.166.1

What's Changed

• feat(gateways): display PAM connected resources by @lb-vn in #8415
• fix: enforce validation rules when moving secrets and folders by @DimitrisStaratzis in #8451
• fix: update sanitized-schema.yaml by @mathnogueira in #8461
• docs(agent-vault): add openclaw guides by @adkah in #8455
• improvement(kms): migrate export actions and rotation notice to v3 by @andrewhuhh in #8434
• improvement(kms): migrate encrypt and decrypt form controls to v3 by @andrewhuhh in #8426
• improvement(ui): migrate secret scanning details and review fields to v3 by @andrewhuhh in #8428
• fix(frontend): keep Copy Secrets source and destination panels within their columns by @adilsitos in #8460
• fix: return 401 when a user session is no longer valid by @Thiago-AS in #8466
• feat: add support for restricting to gateway pools by @sheensantoscapadngan in #8376
• fix(pki): validate Venafi and Azure AD CS signing connections like ADCS by @saifsmailbox98 in #8446
• fix: show assign to app for discovered certs by @sheensantoscapadngan in #8459
• fix: use 3.00 as the min protocol version in SMB by @mathnogueira in #8457
• fix: add e2e test to detect issues with db sanitization by @mathnogueira in #8463
• feature(pki): jks output format by @bernie-g in #8351
• feat: event classes with per-scope toggles and permission denial events by @Thiago-AS in #8380
• docs(agent-vault): update variables guide by @adkah in #8477
• docs(cli): adds init project id flag by @mintlify[bot] in #8445

New Contributors

• @DimitrisStaratzis made their first contribution in #8451
• @mintlify[bot] made their first contribution in #8445

Full Changelog: v0.165.17...v0.166.0

What's Changed

• chore: add upgrade impact for v0.165.16 by @github-actions[bot] in #8279
• fix(org): limit users to one self-created organization by @Vligai in #8239
• docs(style): update style guide and skill by @adkah in #8281
• fix(ui): restore secrets activation experiment variant routing by @andrewhuhh in #8284
• docs(cli): rename [profile new] to [profile create] by @scott-ray-wilson in #8285
• improvement(ui): make secret reference tree read-only (no rename) by @Vligai in #8286
• feat(agent-vault): add a members/available endpoint so the add dialogs offer only unassigned actors by @scott-ray-wilson in #8246
• docs(syncs): refresh snowflake sync and app connection by @adkah in #8282
• fix(frontend): use card surface for project tiles by @andrewhuhh in #8299
• feat(table): add opt-in sticky header by @andrewhuhh in #8288
• improvement(secret-sharing): overhaul sharing UX across surfaces by @andrewhuhh in #8165
• improvement(frontend): dim inactive secret rows by @andrewhuhh in #8230
• feat(ui): add inline and dialog creation to v3 combobox by @andrewhuhh in #8225
• fix(frontend): unify project manager layout padding by @andrewhuhh in #8302
• fix: refine create secret form layout and controls by @andrewhuhh in #8301
• improvement(ui): use shadow-xs as default Card shadow by @andrewhuhh in #8298
• fix(identity-auth): redact outgoing request headers and JWTs by @victorvhs017 in #8295
• docs(agent-vault): audit 2 by @adkah in #8290
• improvement(ui): soften shell navigation borders by @andrewhuhh in #8308
• feat: disabled posthog auto mode things by @akhilmhdh in #8272
• improvement(ui): centralize wide sheet sizes by @andrewhuhh in #8312
• improvement(cron): spread per-pod refresh timers with startLocalRefresh by @victorvhs017 in #8291
• fix(ui): keep secrets toolbar controls together at narrow widths by @andrewhuhh in #8309
• feat: token auth credential expiry and multiple alerts per machine identity by @Thiago-AS in #8270
• fix: addressed alerting on pki issuance by @sheensantoscapadngan in #8304
• docs(pam): remove enumerated account types from templates overview by @claude[bot] in #8319
• fix: accept native SPIFFE bundle format from spire-server by @Thiago-AS in #8287
• feat(ui): pin combobox creation to dropdown footer by @andrewhuhh in #8305
• improvement(ui): align embedded audit log cards with v3 by @andrewhuhh in #8222
• fix(ui): keep create secret value in keyboard tab flow by @andrewhuhh in #8310
• fix(frontend): keep long secret values from stretching the secrets table by @devin-ai-integration[bot] in #8320
• improvement: simplify resolved secret value popover by @andrewhuhh in #8314
• fix(pki): surface why a CA cannot be deleted by @claude[bot] in #8326
• fix(pki): name the certificate profiles blocking a CA delete by @claude[bot] in #8327
• feat: record external CA issued values and drop issuer-written extensions on renewal by @carlosmonastyrski in #8249
• chore: deprecation notice for subscribers and templates by @sheensantoscapadngan in #8253
• feat(gateway): terraform support by @bernie-g in #8257
• fix(frontend): complete cli login for signups by @adkah in #8322
• improvement(kms): migrate project KMIP clients to v3 by @andrewhuhh in #8306
• improvement(ui): align secret update confirmation with v3 dialog by @andrewhuhh in #8325
• fix(secret-sync): keep hyphens in imported Azure Key Vault secret names by @adilsitos in #8268
• docs: align v3 design guide with current contracts by @andrewhuhh in #8317
• docs(azure): oauth permissions by @adilsitos in #8335
• fix(secret-sync): digital ocean enhancements by @adilsitos in #8333
• feat: upgrade CLI version to 0.43.136 for scanning by @mathnogueira in #8293
• feat(secrets): redesign move destination picker by @andrewhuhh in #7554
• feat(agent-vault): offer only ungranted members in the access bundle grant picker by @scott-ray-wilson in #8292
• fix: hide all endpoints from secret scanning by @mathnogueira in #8330
• improvement(ui): let secrets name column rebalance by @andrewhuhh in #8316
• fix(ui): refresh secret list variants after mutations by @andrewhuhh in #8336
• feat: add OCSP responder for internal certificate authorities by @carlosmonastyrski in #8265
• feat: fix on secret paths (pit and dashboard routes) by @adilsitos in #8296
• feat(pam): terminate sessions on user removal from org by @lb-vn in #8155
• fix(gateway): impersonation by @lb-vn in #8315
• improvement(secrets): reduce CPU on recursive secret fetches by @victorvhs017 in #8331
• feat: remove secret scanning config by @mathnogueira in #8323
• fix: enforce conditional forbid rules on member privilege grants and assume privileges by @Thiago-AS in #8280
• fix: resolved org auth enforcement failing in auth0 selected saml by @akhilmhdh in #8342
• fix: revert "feat: remove secret scanning config" by @mathnogueira in #8343
• feat(api): agent friendly api by @varonix0 in #8271
• fix: batch findings in secret scanning by @mathnogueira in #8345
• chore: replace infisical.com/slack links with community.infisical.com by @devin-ai-integration[bot] in #8347
• feat(secret-rotation): add Stripe app connection and API key rotation by @lobocv in #8194
• fix: focus secret key with environments first by @andrewhuhh in #8321
• docs(cli): refresh section by @adkah in #8344
• fix(frontend): keep '#' inside unquoted pasted/imported secret values by @devin-ai-integration[bot] in #8359
• fix(ui): restore fixed secret key column width by @andrewhuhh in #8361
• fix(rbac): warn about unknown policy environment and tag slugs by @andrewhuhh in #8338
• fix(pki-sync): cleanup handling by @bernie-g in #8297
• fix: allow deleting a sub-org from its own settings page by @devin-ai-integration[bot] in #8360
• fix(pki): include imported/external certificates in certificate dashboard by @devin-ai-integration[bot] in #8358
• improvement(secret-input): add warning message for unicode by @adilsitos in #8355
• fix(membership): block individual project assignment for group-only identities by @victorvhs017 in #8362
• chore: stripe whitelisting by @varonix0 in #8365
• fix(scim): enforce privilege boundary on external group org role mappings by @victorvhs017 in #8350
• feat(agent-vault): session logs by @saifsmailbox98 in #8275
• docs(style): full style audit by @adkah in #8368
• chore(aws-auth): remove unused sts endpoint by @bernie-g in #8363
• improvement(pam): move to global approvals by @lb-vn in #8269
• feat(ui): resize secrets table columns by @andrewhuhh in #8349
• improvement(ui): remove configurable tooltip hoverable content by @andrewhuhh in #8374
• feat(agent-vault): add access bundle variables by @scott-ray-wilson in #8352
• fix(pki): allow revoking imported certs under a DigiCert profile by @saifsmailbox98 in #8381
• chore(db): add agent vault tables to sanitized schema by @saifsmailbox98 in #8383
• fix(auth): enforce org membership on refresh and sub-org tokens by @victorvhs017 in #8366
• docs(app-connections): add integration picker and revamp aws connection by @adkah in #8379
• chore: upgraded package in openssl by @akhilmhdh in #8390
• fix(ui): remove announcement card focus ring by @andrewhuhh in #8388
• improvement(secrets): add environment-scoped recency sorting by @andrewhuhh in #8022
• improvement(secrets): distinguish root breadcrumb with home icon by @andrewhuhh in #8395
• fix(auth): improve verification code focus and retry feedback by @andrewhuhh in #8386
• fix: open policy sheet from approval empty states by @andrewhuhh in #8334
• feat(ui): use IBM Plex Sans with Alliance headings and JetBrains Mono by @andrewhuhh in #8283
• docs(agent-vault): audit session logs by @adkah in #8387
• fix(projects): return kmsSecretManagerKeyId on project reads by @peter-manton in #8382
• feat: move application alerts to the shared alerting module and by @carlosmonastyrski in #8369
• feat(ui): add organization ID copy button by @andrewhuhh in #8385
• fix(ui): preserve routes and reset caches when switching organizations by @andrewhuhh in #8377
• improvement(ui): render page notices above global navigation by @andrewhuhh in #8396
• fix(ui): scope navigation plan badges to products by @andrewhuhh in #8389
• feature: support for 3ds card payment by @akhilmhdh in #8337
• docs: use circle-question-mark icon for self-hosting FAQ card by @adkah in #8409
• fix: add uuid validation in secret approval requests by @mathnogueira in #8412
• fix(ui): restrict sub-organization creation to root context by @andrewhuhh in #8413
• fix(ui): improve personal override foreground contrast by @andrewhuhh in #8410
• feat: let machine identities link root groups to sub-orgs by @Thiago-AS in #8384
• feat(ui): allow leaving projects from the project list by @andrewhuhh in #8418
• fix(ui): enable moving bulk-selected folders by @andrewhuhh in #8411
• chore(ui): remove unused v2 component families by @andrewhuhh in #8422
• chore(ui): remove secret sharing relocation banner by @andrewhuhh in #8444
• chore(ui): remove orphan legacy features and v2 menu by @andrewhuhh in #8425
• docs(sdk): fix typo in Go SDK docs by @AleksaMCode in #7924
• docs: correct "wether" to "whether" in SDK and Jenkins docs by @akshatgg in #8274
• feat(insights): org-wide secret value search and duplicate detection by @lobocv in #8278
• docs: use single quotes in ABAC template helper examples by @claude[bot] in #8447
• feat(clickhouse): native protocol support by @bernie-g in #8332
• fix(ui): preserve hover and selection parity in v3 tooltips by @andrewhuhh in #8427
• fix(ui): contain alert dialog confirmation overflow by @andrewhuhh in #8416
• feat: migrate certificate export modals to v3 with compact PEM blocks by @devin-ai-integration[bot] in #8404
• feat: remove vault migration code by @varonix0 in #8417
• docs(agent-vault): add hermes guide by @adkah in #8393
• improvement(ui): migrate secret scanning picker loading to v3 by @andrewhuhh in #8435
• improvement(ui): recover scanning status tooltip migration on main by @andrewhuhh in #8449
• fix(ui): support owned Select portal containers by @andrewhuhh in #8437
• fix(ui): forward v3 Toggle refs to the native switch by @andrewhuhh in #8432
• improvement(ui): observe effective combobox popup state by @andrewhuhh in #8440
• improvement(ui): replace startup v2 Lottie with v3 Loader by @andrewhuhh in #8423
• chore: revert stripe whitelisting by @varonix0 in #8448
• improvement(kms): migrate MAC operation form controls to v3 by @andrewhuhh in #8431
• feat: revamp secret scanning db tables by @mathnogueira in #8367
• fix: update openrouter logo by @claude[bot] in #8453
• improvement(ui): make page header spacing plug and play by @andrewhuhh in #8424

New Contributors

• @peter-manton made their first contribution in #8382
• @AleksaMCode made their first contribution in #7924
• @akshatgg made their first contribution in #8274

Full Changelog: v0.165.16...v0.165.17

What's Changed

• feat: block certificate deletion until expiry by @carlosmonastyrski in #8213
• fix: prevent renewal identity bypass via ambiguous DN comparison by @carlosmonastyrski in #8223
• feature(gateway): gcp enrollment by @bernie-g in #8143
• docs(audit-logs): audit audit logs by @adkah in #8240
• chore: add upgrade impact for v0.165.12 by @github-actions[bot] in #8176
• chore: add upgrade impact for v0.165.14 by @github-actions[bot] in #8232
• fix(ci): skip open upgrade-impact PRs and alert when review is blocked by @victorvhs017 in #8256
• improvement(secrets): simplify resource creation menu by @andrewhuhh in #8206
• chore: add upgrade impact for v0.165.15 by @github-actions[bot] in #8252
• improvement(ui): simplify secret name sort trigger by @andrewhuhh in #8260
• fix(secrets): use eye icon for generated credentials by @andrewhuhh in #8258
• improvement(ui): show root slash in folder breadcrumb by @andrewhuhh in #8259
• improvement(secret-sync): surface Include All Subfolders in the UI and docs by @lobocv in #8210
• feat: secret scanning batching by @mathnogueira in #8186
• feat(analytics): track add resource menu usage by @andrewhuhh in #8262
• fix(cron): spread pickup with derived jitter and concurrency cap by @victorvhs017 in #8254
• fix: resovled an bug in secret fetch by @akhilmhdh in #8264
• fix(ui): remove extra gap from create secret sheet by @andrewhuhh in #8266
• feat(auth): add signup flow experiment by @andrewhuhh in #7915
• fix: require the OCI signature to belong to the supplied user OCID by @Thiago-AS in #8215
• docs(cli): document named login profiles by @scott-ray-wilson in #8263
• improvement(dynamic-secret): add validations to ssh by @adilsitos in #8177
• feat(pam): clickhouse by @lb-vn in #8185
• chore: remove banner by @varonix0 in #7728
• docs(api): add get started section by @adkah in #8267
• feat: fixed ca bug in ssh dynamic secret by @akhilmhdh in #8276
• docs(syncs): audit daytona sync and app connection guide by @adkah in #8277

Full Changelog: v0.165.15...v0.165.16

What's Changed

• fix(agent-vault): expose agent vault routes in the openapi spec by @saifsmailbox98 in #8224
• docs: drop redundant "sync" from Secret Syncs sidebar labels by @claude[bot] in #8234
• feat: removed license deprecation banner from usage and billing by @akhilmhdh in #8236
• fix: return 204 from delete and resolve users by any alias by @Thiago-AS in #8154
• feat(ui): add card explaining that additional privileges were moved by @adilsitos in #8095
• fix(auth): enforce dark mode on auth pages by @andrewhuhh in #8238
• feat: built-in PAM masking by @sheensantoscapadngan in #8196
• feat(ui): add navbar theme toggle by @andrewhuhh in #8244
• feat: remove stuck timeout env var by @mathnogueira in #8241
• fix(ui): focus alert dialog inputs on open by @andrewhuhh in #8243
• fix(frontend): align expanded secret manager rows by @andrewhuhh in #8242
• fix(ui): match Anthropic and OpenAI logos across themes by @andrewhuhh in #8248
• fix(audit-logs): apply secret filters to folder read events by @jakehulberg in #8250
• improvement(sso): stop duplicating surnames when OIDC omits given_name by @victorvhs017 in #8214

Full Changelog: v0.165.14...v0.165.15

What's Changed

chore: add upgrade impact for v0.165.13 by @github-actions[bot] in #8217

feat(api): implement billing v2 usage breakdown and organization listing by @victorvhs017 in #8099

feat: add PowerDNS as a DNS-01 provider for ACME certificate authorities by @carlosmonastyrski in #8139

fix(ui): remove autofill seams around rounded inputs by @andrewhuhh in #8219

fix(ui): improve Agent Vault contrast in light mode by @andrewhuhh in #8220

feat(agent-vault): method and path rules, custom headers, and substitutions by @saifsmailbox98 in #8130

fix(ui): prevent detail cards from collapsing by @andrewhuhh in #8216

improvement(secrets): simplify bulk selection and add clipboard copying by @andrewhuhh in #8189

feat: add transactional event outbox and event-triggered alerts by @Thiago-AS in #8072

fix(storybook): support app themes and product accents by @andrewhuhh in #8227

Full Changelog: v0.165.13...v0.165.14

What's Changed

• feat(analytics): track paywall-to-billing funnel by @andrewhuhh in #8144
• docs(style): migrate icons to lucide by @adkah in #8175
• feat(pki-syncs): choose sync certificates by filter by @carlosmonastyrski in #8107
• fix: truncate long custom extensions by @carlosmonastyrski in #8173
• feat(project): limit secret scanning to one project per organization by @claude[bot] in #8174
• docs(agent-vault): fit into product model by @adkah in #8178
• fix(ldap-auth): enforce bind password when changing LDAP URL by @victorvhs017 in #8160
• improvement(agent-vault): collapse proxy settings under advanced options by @saifsmailbox98 in #8138
• feat(agent-vault): add product intro modal by @saifsmailbox98 in #8141
• fix(api): allow non-uuid project IDs in projectId validators by @claude[bot] in #8180
• fix(frontend): drop removed showSlugField prop from ProjectOverviewChangeSection call site by @claude[bot] in #8188
• fix(agent-vault): serve intro diagram from public so CSP allows it by @saifsmailbox98 in #8190
• docs: remove the Agent Vault preview callout by @claude[bot] in #8192
• fix(helm): default autoBootstrap secretDestination.namespace to release namespace by @devin-ai-integration[bot] in #8191
• chore(frontend): upgrade build tooling to Vite 8 by @andrewhuhh in #8161
• improvement(ui): refine secrets overview header by @andrewhuhh in #8201
• docs(agent-vault): dynamic agent vault quickstart by @adkah in #8193
• fix(secrets): keep folder description tooltip inline by @andrewhuhh in #8203
• fix(billing): prevent duplicate mutation error toasts by @andrewhuhh in #8198
• improvement(secrets): align remaining expanded resource rows by @andrewhuhh in #8195
• fix(secrets): clarify copy preview access errors by @andrewhuhh in #8184
• improvement(ui): migrate Certificate Manager pages to v3 headers by @andrewhuhh in #8159
• fix(frontend): discover all frontend tests by @andrewhuhh in #8164
• feat(ui): add light mode by @andrewhuhh in #7708
• docs: update supported Redis versions in Linux package installation by @AbhiPra24 in #8187
• feat(secret-sync): recursive secret syncs, stage one by @lobocv in #8087
• chore: deprecate gateway v1 by @sheensantoscapadngan in #8127
• docs(agent-vaut): improve agent vault quickstart style by @adkah in #8211
• chore(ci): scan released images with Trivy by @Vligai in #8162
• feat: add validation rule unique values across the whole project by @mathnogueira in #8094
• improvement(admin): align server console surfaces with v3 by @andrewhuhh in #8158
• improvement(ui): progressively render notifications by @andrewhuhh in #8205

New Contributors

• @AbhiPra24 made their first contribution in #8187

Full Changelog: v0.165.12...v0.165.13