Tools
Langfuse backported four security changes to v3, cutting the default JWT session lifetime from longer to 14 days
v3.225.7, released 2026-09-02T13:13Z, is almost entirely security and correctness backports to the v3 line: a breaking change reducing the default JWT session max age to 14 days (#16677), gating organization API key creation behind the admin-api entitlement (#16679), redacting credentials from rejected PostHog host logs in the worker (#16882), and suppressing a sub-second remainder chunk in blob storage that was causing silent key collisions (#16678). Self-hosted v3 operators who have not upgraded are running longer-lived sessions and can silently lose blob-stored data to key collisions.
Source
↳ Follow the thread