What Infisical/infisical shipped
Written by FoxPlug from the repository's own releases; not affiliated with Infisical. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/Infisical/infisical; Infisical did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Secret sync now supports Keeper Password Manager, including an app connection for it. Pull request #8518
- Secret sync now supports Cloudflare Secrets Store, the account-level store that Workers, AI Gateway and Containers read from. Pull request #8500
- GCP Service Account Key rotation can create a new JSON key on a schedule, store it in a secret and delete the previous key after an overlap period. Pull request #8474
- Secret reminders can now be delivered through alert channels such as email, Slack, webhook or PagerDuty instead of email only. Pull request #8356
- Secret references to names that contain spaces, such as ${My Secret} and ${prod.db.My Secret}, now resolve correctly on reads with expandSecretReferences=true. Pull request #8517
- Failed certificate issuance now writes a certificate-issuance-failed audit log event with the reason, so admins can see why a certificate was never created. Pull request #8480
- A DNS rebinding fix applies to integrations including Trigger.dev, Zabbix, 1Password, Auth0, NetScaler, Azure Key Vault, Venafi, Azure ADCS, ACME and audit log streams by re-validating resolved addresses before connecting. Pull request #8515
- ACME certificate authorities can complete DNS-01 challenges through Google Cloud DNS using an existing GCP app connection. Pull request #8406
- UltraDNS is now a DNS provider option for ACME certificate authorities, so teams hosting domains there can automate issuance and renewal. Pull request #7718
- KMS supports ED25519 sign and verify keys, which can be generated or imported, with the public key exported in the same SPKI format as other asymmetric key types. Pull request #8470
Why it matters
This week added several new ways to get secrets and certificates where they need to go: Keeper and Cloudflare Secrets Store syncs, GCP service account key rotation, and more DNS providers for ACME certificate issuance. Reminder delivery now goes through the shared alerting module, so reminders are not limited to email. Fixes also landed for secret references containing spaces, DNS rebinding in integrations, and concurrent secret creation hangs in root folders.
Changelog entry
- Add Keeper Password Manager secret sync and an app connection for it. Pull request #8518
- Add Cloudflare Secrets Store secret sync. Pull request #8500
- Add GCP Service Account Key secret rotation. Pull request #8474
- Deliver secret reminders through alert channels including email, Slack, webhook and PagerDuty. Pull request #8356
- Resolve secret references to names that contain spaces. Pull request #8517
- Log certificate-issuance-failed audit events with the failure reason. Pull request #8480
- Block DNS rebinding in integrations by re-validating resolved addresses before connecting. Pull request #8515
- Add Google Cloud DNS as an ACME DNS-01 provider using an existing GCP app connection. Pull request #8406
- Add UltraDNS as an ACME DNS-01 provider. Pull request #7718
- Support ED25519 sign and verify keys in KMS. Pull request #8470
- Fix concurrent secret creation in a project's root folder hanging and returning 500 errors. Pull request #8496
- Warn before moving or copying secrets into a synced path. Pull request #8372
This week: Keeper and Cloudflare Secrets Store syncs, GCP service account key rotation, reminders over alert channels, UltraDNS and Google Cloud DNS for ACME certs, and fixes for secret references with spaces and DNS rebinding in integrations.
New this week in Infisical: Keeper Password Manager sync and Cloudflare Secrets Store sync, GCP Service Account Key rotation that creates and rotates keys on a schedule, and secret reminders delivered through email, Slack, webhook or PagerDuty instead of email only. Certificate issuance now supports UltraDNS and Google Cloud DNS as ACME DNS-01 providers. We also fixed secret references to names with spaces, blocked DNS rebinding across many integrations, recorded the watched resource name in alert audit events, and fixed concurrent secret creation in root folders that could hang and return 500 errors.
Week of September 28, 2026
What shipped
- Machine identities can now link root groups to sub-organizations, enabling Terraform-based group management at scale. Pull request #8384
- Agent Vault access bundles support variables, letting services reference shared tokens like {{GITHUB_TOKEN}} instead of pasting them individually. Pull request #8352
- Agent Vault session logs record and encrypt each proxy request to S3, making audit trails available to session owners and admins. Pull request #8275
- Application alerts migrated to the shared alerting module, gaining email, Slack, webhook, PagerDuty, test sends, dedup and history. Pull request #8369
- Secrets table columns are now resizable, with Name and data columns adjusting width while maintaining toolbar usability. Pull request #8349
- Projects list now exposes a Joined dropdown, letting users leave projects directly from the All Projects table. Pull request #8418
- Bulk-selected folders can now be moved using the shared move dialog. Pull request #8411
- Typography system updated to IBM Plex Sans for body text, Alliance for headings, and JetBrains Mono for code. Pull request #8283
- Sub-org tokens now enforce root organization membership, preventing deprovisioned users from maintaining API access. Pull request #8366
- PAM moved to use Global Approvals. Pull request #8269
Why it matters
This week delivered infrastructure improvements for enterprise use cases—machine identities managing sub-org groups, Agent Vault session logging and variables for multi-service deployments—alongside fixes that prevent security gaps when users are deprovisioned. UI refinements to column resizing, project management, and alert consistency make the platform more usable at scale.
Changelog entry
- Machine identities can link root groups to sub-organizations Pull request #8384
- Agent Vault access bundle variables for shared token references Pull request #8352
- Agent Vault session logs with S3 encryption Pull request #8275
- Application alerts use shared alerting module with email, Slack, webhook, PagerDuty Pull request #8369
- Secrets table columns are resizable Pull request #8349
- Leave project action in All Projects table Pull request #8418
- Sub-org tokens enforce root organization membership Pull request #8366
- Move folders in bulk selection Pull request #8411
- Typography system: IBM Plex Sans, Alliance headings, JetBrains Mono Pull request #8283
- Organization ID copy button in settings Pull request #8385
- Secrets breadcrumb root uses home icon Pull request #8395
- Unicode character warning in secret input Pull request #8355
Machine identities now link root groups to sub-orgs. Agent Vault adds session logs and bundle variables. Alerts moved to shared alerting. Secrets table columns resize. Sub-org tokens enforce membership.
This week's updates focus on enterprise infrastructure and security. Machine identities can link root groups to sub-organizations via Terraform. Agent Vault adds session logging to S3 and bundle variables for shared token management. Application alerts now use the shared alerting module for email, Slack, webhook and PagerDuty delivery. Sub-org token enforcement prevents deprovisioned users from maintaining API access. Secrets table columns are resizable. Projects list gains a leave action.
Week of September 21, 2026
What shipped
- Gateway resource now supports Terraform with new DELETE endpoint and rename through PATCH, plus GATEWAY_UPDATE and GATEWAY_DELETE audit events. Pull request #8257
- Move destination picker redesigned with v3 Combobox, fixed positioning, and inline creation to compare locations without leaving the workflow. Pull request #7554
- Machine identity alerts now support multiple event types per identity with a dedicated alerts list for enabling, disabling, editing, and adding alerts. Pull request #8270
- CLI upgraded to version 0.43.136 with new scanning engine that reduces false positives from 364 findings to 221 by filtering low-confidence detections. Pull request #8293
- External CA certificates now store real subject, SANs, algorithms and extensions decoded from the authority response instead of the request. Pull request #8249
- Digital Ocean secret sync fixed to avoid syncing during deployment, handle secret names with hyphens, and prevent deletion of unmanaged secrets. Pull request #8333
- Azure Key Vault secret names now preserve hyphens on import and validate for conflicts before sync to prevent data loss. Pull request #8268
- SPIFFE authentication now accepts the native SPIFFE bundle format from spire-server with x509-svid and jwt-svid keys. Pull request #8287
- CLI login for new signups now completes by preserving the
callback_portparameter through signup pages to return tokens to the CLI. Pull request #8322 - Agent Vault access bundle grant picker now shows only ungranted members to clarify who already holds the bundle. Pull request #8292
Why it matters
This week brings infrastructure improvements for Terraform users, refined secret management workflows, and fixes for external integrations. The scanning engine upgrade reduces false positives, certificate handling becomes more accurate, and cloud sync operations are more reliable and safer.
Changelog entry
- Gateway: Add Terraform support with DELETE endpoint, PATCH rename, and audit events Pull request #8257
- UI: Redesign move destination picker with v3 Combobox and inline creation Pull request #7554
- Machine identity: Support multiple alerts per identity with dedicated list management Pull request #8270
- CLI: Upgrade to 0.43.136 with new scanning engine reducing false positives Pull request #8293
- PKI: External CA now stores decoded certificate attributes instead of request data Pull request #8249
- Secret sync: Fix Digital Ocean to handle hyphens, prevent sync during deployment, protect unmanaged secrets Pull request #8333
- Secret sync: Azure Key Vault preserves hyphens and validates for conflicts before import Pull request #8268
- SPIFFE auth: Accept native SPIFFE bundle format from spire-server Pull request #8287
- CLI: Fix login for new signups by preserving
callback_portthrough signup pages Pull request #8322 - Agent Vault: Show only ungranted members in access bundle grant picker Pull request #8292
- UI: Fix secret list refresh after mutations to use correct query keys Pull request #8336
- UI: Rebalance secrets Name column for better layout on narrow widths Pull request #8316
- Alerts: Fix missing alert notifications for external CA issuance Pull request #8304
- UI: Align embedded audit log cards with v3 design Pull request #8305
- UI: Migrate project KMIP clients page to v3 components Pull request #8306
- UI: Improve keyboard navigation in Create Secret sheet Pull request #8222
- UI: Centralize wide sheet sizes with form, wide, and workspace options Pull request #8312
- UI: Keep secrets toolbar controls together at narrow widths Pull request #8291
- Security: Redact headers and JWTs in identity auth logs Pull request #8295
- Infrastructure: Spread per-pod refresh timers to reduce load spikes Pull request #8291
This week: Terraform gateway support, redesigned move picker, multi-alert machine identities, upgraded scanning with fewer false positives, external CA certificates store real attributes, Digital Ocean and Azure syncs are safer and more correct.
Infisical shipped major improvements this week: Terraform can now manage gateways with DELETE and rename support. The move destination picker was redesigned for better UX. Machine identity alerts now support multiple event types. The secret scanning engine upgraded to reduce false positives from 364 to 221. External CA certificates now store real subject data. Digital Ocean and Azure Key Vault syncs are safer with better hyphen handling and conflict detection. CLI login for signups completes properly. SPIFFE bundles use native format. Seven documentation updates keep guides current.
Week of September 14, 2026
What shipped
- Light mode support added, letting users choose System, Dark, or Light from the profile menu. Pull request #7708
- Event-triggered alerts now fire immediately on events instead of waiting for daily cron scans. Pull request #8072
- Agent Vault services can now filter by HTTP methods and path prefixes, add custom headers, and substitute placeholders. Pull request #8130
- Recursive secret syncs now push secrets from a folder and all folders beneath it to their destinations. Pull request #8087
- Certificate syncs in applications now pick certificates by filter, picking up new ones automatically as they are issued. Pull request #8107
- PowerDNS added as a DNS-01 provider for ACME certificate authorities, with Gateway routing and TLS proxy support. Pull request #8139
- Billing V2 now breaks down metered usage by organization and project, helping admins see where usage lives across their account. Pull request #8099
- Secrets bulk selection bar now includes copy to clipboard and copy to new source options via dropdown. Pull request #8189
- Validation rules can now prevent reusing values already present in the project. Pull request #8094
- Frontend build tooling upgraded from Vite 6.4.2 to Vite 8.2.2 with Rolldown. Pull request #8161
Why it matters
Light mode brings the application to users who prefer bright interfaces. Better event handling for alerts and certificate management makes the platform more responsive. Recursive syncs and filter-based certificate selection reduce manual configuration work for teams managing many secrets and certificates.
Changelog entry
- Light mode support added with System, Dark, and Light options in profile menu Pull request #7708
- Event-triggered alerts fire immediately on events instead of scheduled cron scans Pull request #8072
- Agent Vault services now support HTTP method and path filtering, custom headers, and placeholder substitution Pull request #8130
- Recursive secret syncs push secrets from a folder and all nested folders to destinations Pull request #8087
- Certificate syncs now pick certificates by filter, automatically picking up new issues Pull request #8107
- PowerDNS added as DNS-01 provider for ACME certificate authorities with Gateway routing support Pull request #8139
- Billing V2 usage breakdown now shows metered usage per organization and project Pull request #8099
- Secrets bulk selection bar adds dropdown with copy to clipboard and copy to new source options Pull request #8189
- Validation rules can prevent reusing values already present in the project Pull request #8094
- Frontend build tooling upgraded from Vite 6.4.2 to Vite 8.2.2 with Rolldown Pull request #8161
- Detail cards on access-control pages no longer collapse with adjacent wide tables Pull request #8216
- Agent Vault contrast improved in light mode with darker green color override Pull request #8220
- Certificate Manager pages migrated to v3 page headers with v3 tabs for page sections Pull request #8159
- User notifications render progressively with 20 initial notifications and more on demand Pull request #8205
- Server Console admin surfaces completed v3 treatment with updated table adapters and icons Pull request #8158
- Released images now scanned with Trivy for fixable CRITICAL and HIGH findings Pull request #8162
- Gateway v1 completely deprecated except for actual data Pull request #8127
- LDAP auth machine identity updates now require bind password when changing LDAP URL Pull request #8160
- Privilege boundary enforcement added when changing identity authentication methods on legacy systems Pull request #8061
V0.165.13 ships light mode, event-triggered alerts, recursive secret syncs, and filter-based certificate picks. PowerDNS support and better billing insights round out the week.
This week Infisical v0.165.13 brings light mode support so users can choose their preferred interface theme. Event-triggered alerts now fire immediately instead of waiting for daily scans. Recursive secret syncs push secrets from entire folder hierarchies, and certificate syncs pick certificates by filter to automatically handle new issues. PowerDNS joins as a DNS-01 provider, and billing V2 now shows usage broken down by organization and project.