Skipper
Skipper patches its second filter advisory in a week, this one in the OPA request-body filter.
A side-by-side editorial comparison of Hanko and Payload CMS — release velocity, themes, recent moves, and the top alternatives to consider.
Hanko ships Firebase migration support and tightens session management — targeting auth stack replacements.
Hanko is a passkey-first authentication platform available as open-source self-hosted or cloud-managed. Monthly releases show consistent refinement across the auth stack: stronger passcode options, inactivity-based session termination, session token transparency, device trust handling improvements, and expanded OAuth/OIDC integration. The June 2026 Firebase Scrypt hash import signals an active effort to reduce friction for teams migrating away from Firebase Auth.
Payload v4 beta 3 adds Next.js cache components and moves TanStack Start to React Flight.
Payload 4.0 is on its fourth beta. beta.3 adds support for Next.js cache components, with the admin rendered at request time, and switches the TanStack Start adapter to React Flight for RSC responses, a breaking change for that adapter. The rest is fixes: per-locale validation when writing all locales, live-preview and bulk-upload UI bugs, and a Drizzle locale index tweak. The beta.0 bundle of admin redesign, TanStack Start support and the rewritten MCP server remains the release's core.
Hanko is a passkey-first authentication platform available as open-source self-hosted or cloud-managed. Monthly releases show consistent refinement across the auth stack: stronger passcode options, inactivity-based session termination, session token transparency, device trust handling improvements, and expanded OAuth/OIDC integration. The June 2026 Firebase Scrypt hash import signals an active effort to reduce friction for teams migrating away from Firebase Auth.
The consistent themes across these releases are session management hardening, migration tooling, and auth protocol breadth. Custom OAuth connections, user metadata via Admin API, Firebase import, and OIDC updates together sketch a product trying to compete with established auth platforms (Auth0, Clerk) on flexibility and self-hostability. The monthly cadence is execution-focused — incremental improvements rather than architectural shifts.
The next likely moves are broader migration support (other providers beyond Firebase, e.g. Supabase Auth or Cognito) and enterprise session controls such as SAML or organization-level device trust policies. Custom OAuth was the groundwork; SAML is the common next ask.
Payload 4.0 is on its fourth beta. beta.3 adds support for Next.js cache components, with the admin rendered at request time, and switches the TanStack Start adapter to React Flight for RSC responses, a breaking change for that adapter. The rest is fixes: per-locale validation when writing all locales, live-preview and bulk-upload UI bugs, and a Drizzle locale index tweak. The beta.0 bundle of admin redesign, TanStack Start support and the rewritten MCP server remains the release's core.
The betas are converging on two framework adapters with comparable rendering models: Next.js gains cache-components support while TanStack Start moves onto React Flight. Breaking changes are now confined to the newer adapter, and most of each beta is fixes and repo tooling, which points toward a stable 4.0.
Expect further weekly betas with adapter fixes and migration docs before 4.0 stable. The entries still give no stable date, and further TanStack Start breaking changes remain possible.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Hanko or Payload CMS.
Skipper patches its second filter advisory in a week, this one in the OPA request-body filter.
Aviator moves from merging code to judging it: Verify checks PRs against their stated intent.
Infisical stores PAM session recordings in S3 and backs internal CAs with AWS KMS keys.
Airflow 3.4.0 reaches its second beta a day after the common-ai provider hit 1.0.
ESPHome adds a sixth 2026.10 beta, one more than 2026.9 needed before its .0.
Semgrep adds Objective-C as an alpha target, its first new language since Dart went GA.
See all Hanko alternatives → · See all Payload CMS alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Payload CMS is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Payload CMS is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
Top Hanko alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Hanko alternatives" section above for the current picks, or visit /alternatives/hanko for the full list with editorial commentary on each.
Top Payload CMS alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Payload CMS alternatives" section above for the current picks, or visit /alternatives/payload-cms for the full list with editorial commentary on each.