Roadmap & Changelog
HelloJohn's planned features and release history. Track what's shipping next and what changed in each version.
What's coming
HelloJohn is under active development. The roadmap below reflects current priorities. Dates are targets, not commitments.
In progress
| Feature | Target | Edition |
|---|---|---|
| Directory sync (SCIM 2.0) | Q2 2026 | Cloud Enterprise |
| Passkey-first auth (WebAuthn primary factor) | Q2 2026 | OSS + Cloud |
| SMS MFA via Twilio / Vonage | Q2 2026 | OSS + Cloud |
| Admin audit log UI | Q2 2026 | Cloud |
| Token introspection endpoint | Q2 2026 | OSS + Cloud |
Planned
| Feature | Target | Edition |
|---|---|---|
| Organization-level SSO override | Q3 2026 | Cloud Enterprise |
| Device fingerprinting & session binding | Q3 2026 | OSS + Cloud |
| Impersonation (admin-as-user) | Q3 2026 | OSS + Cloud |
| Native Android/iOS SDKs | Q3 2026 | OSS + Cloud |
| Magic links (passwordless email) | Q4 2026 | OSS + Cloud |
| Fine-grained API key scopes | Q4 2026 | OSS + Cloud |
Vote on features — Open a GitHub Discussion to request features or upvote existing ones.
Changelog
v0.9.0 — March 2026
New
- MCP Server: 46 tools for AI agent control via stdio and SSE transport
- React Native SDK with
expo-secure-storesupport - Vue 3 composables:
useAuth,useSession,useUser,useOrg - Python SDK: FastAPI dependency + Django middleware
Improved
- EdDSA key rotation: JWKS endpoint now supports multiple active keys
- Organization invitations: resend + revoke from SDK
hjctlv2: newsessionsandorgcommand groups
Fixed
- Refresh token rotation: concurrent refresh requests no longer cause 401 loops
- TOTP enrollment: QR code generation failure on non-UTF-8 secrets
v0.8.0 — January 2026
New
- TOTP MFA with backup codes
- WebAuthn / Passkeys (FIDO2) — second factor
- Custom JWT claims via tenant configuration
- Organizations: invite by email, role assignment
Improved
- Go SDK: all methods now return typed errors with
CodeandHTTPStatusfields - Next.js SDK: App Router support,
auth()server helper
Fixed
- Session revocation: sessions revoked server-side now return 401 on next refresh
- CORS: pre-flight requests on
/v1/oauth/callbackno longer rejected
v0.7.0 — November 2025
New
- Multi-tenant architecture: per-tenant database isolation
- 9 social providers: Google, GitHub, Apple, Microsoft, Discord, Twitter/X, Facebook, LinkedIn, Slack
- HelloJohn Cloud launch (managed service)
Improved
- Control Plane API: tenant provisioning time reduced from ~2s to ~200ms
- Rate limiting: per-tenant limits configurable via API
v0.6.0 — September 2025
New
- Initial public release (OSS)
- Email + password auth
- JWT (EdDSA/Ed25519) issuance
- React and Node.js SDKs
hjctlCLI v1- Docker Compose deployment
Stay updated
- GitHub Releases: github.com/HelloJohn-OSS/hellojohn/releases
- GitHub Discussions: github.com/HelloJohn-OSS/hellojohn/discussions