Langfuse v4.57.0 adds FIPS auth and API key expiration

Langfuse v4.57.0 was published on GitHub on October 12, 2026 by the langfuse/langfuse project. The release notes list FIPS-mode authentication changes, API key expiration for the gateway, and an optional Cloudflare Turnstile captcha on credential auth.

Release facts

What changed

• FIPS mode: passwords are hashed with PBKDF2 in FIPS mode, and FIPS mode is refused with storage options that compute MD5.
• API keys: the gateway gains API key expiration, and new API keys no longer compute bcrypt.
• Auth: an optional Cloudflare Turnstile captcha is restored on credential auth, and the typed email carries over to the password reset form.
• Worker: an optional startup jitter can be added before queue registration.
• Evals: decision model evaluators graduate, and score persistence outcomes are now measured.
• Ingestion: inline media is extracted from raw OTEL documents.

The release also lists many fixes, mostly to sessions, topics and web UI polish, and a bump to Next.js 16.4 and React 19.3.

Questions

Is Langfuse v4.57.0 open source? The product site says all product features are MIT licensed. The GitHub API, however, reports no recognized license for the repository, so check the repository itself.

Does this release change authentication? Yes. According to the release notes, it adds PBKDF2 password hashing in FIPS mode, an optional Turnstile captcha on credential auth, and API key expiration in the gateway.

Does the release notes list breaking changes? The release notes excerpted here do not mention breaking changes; they list features and fixes only.

For more, see the Langfuse tool hub, the agent infra category, and the related launch Chrome Relay v0.11.0.