alphyron

It's pretty easy to check it yourself with docker:

docker run aquasec/trivy image casbin/casdoor:v1.924.0
docker run aquasec/trivy image casbin/casdoor-all-in-one:v1.924.0

The most of the stuff are just missing dependency updates. The most of them are just patch updates so it shouldn't be breaking changes...

there are multiple options and features that can helps you.
So there is a custom metadata field in every user object you can fill and update with the API so you can store specific user information. But if you want to store specific user information in another database you can use the sync job. it depends on how and what specific you want to implement. I think there is no right way solution... casdoor just gives you many ways...

in casdoor you can create application. Per application you must defined from which organisation / user pool can login and create custom login forms and endpoints. I think, thats what you need?

With an enforcer, you can check the permissions from external with the enforce api.
The Permissions model hat an Effect field, which you can use for that as far as I know.

Okay I understand. But then, why there is a field sub groups if it doens't matter?
Its just a question for understanding