Proper JSON round-tripping Fixed an issue causing custom claims to break if they were nested or unexpectedly typed. JSON round-trips are now correct. PR: #3819

Speed up public key retrieval Reduced overhead for the JWK public endpoint, solving CPU contention issues in large-scale deployments. PRs: #3787, #3870

Fix Docker Compose references The CLI now properly references docker compose instead of docker-compose, ensuring compatibility with modern Docker setups. PR: #3815

Dependency upgrades Bumped fosite, ory/x, pgx/v5, and various third-party libraries for improved stability and performance.

Updated docs Updated examples, improved JWK documentation, added notes on Docker Compose usage, and refined OpenID Connect discovery docs.

More tracing context Tracing calls have been consistently standardized with otelx.End(), and additional context ensures better observability.

Code generation & housekeeping Various housekeeping tasks: pinned GHA versions, fixed minor comment typos, updated newsletters/links, and more.

Correct span names (554238b)

Correctly pass multiple token audiences and prompt parameters when performing the authorization code flow from the CLI (#3736) (632faef)

Cpu contention when reading JWKs and suppress generating duplicate JWKs (#3870) (d5f65c5):

Previously each concurrent caller would need to lock a shared mutex when reading or writing a given JWK set. The read path now doesn't require locking a mutex at all and instead returns valid query results directly.

The write path is now protected by a concurrency control mechanism (using x/sync/singleflight) to ensure only one JWK set is generated and persisted.

Note: Duplicate JWK sets may still be improperly generated if running more than one Hydra instance in a high traffic environment.

Do not iteratively delete records (#3766) (5ef20a2):

Resolves performance issues on some databases when deleting consent.

Do not retry sending responses (#3764) (1bbfdb5)

docs: Adjust note about SDK support on oauth2 flow endpoints (#3812) (d0e047c)

Error log when RP responds with status code 204 (#3731) (153e4b5)

Faster GetPublicKeys (#3787) (04c34aa):

GetPublicKeys used to fetch all keys in a set, even if they were actually not being used. This patch fixes that.

Improve docker set up (#3924) (8ca6cbd), closes #3914 #3683:

Improves the docker set up and removes some unused files.

Incorrect context passthru (fa50e3e)

Incorrect indices (#3778) (cb0004b)

Limit HTTP response size (2559819)

Omit explicit transaction in ConfirmLoginSession and add tracing (#3886) (a5b2d75)

Pass context to database ping (fa21711)

Require redirect_uri in openid requests (#3900) (5caa629):

Resolves a deviation from the OpenID Connect spec, where the redirect_uri was not required when performing flows with scope=openid.

Untyped int build issues on 32bit architectures (#3885) (68aa167)

Upgrade fosite and improve webhook integration (#3727) (89323e2)

Use docker compose rather than docker-compose (#3815) (ffdfb73)

Wrap authorize response in transaction (#3763) (5b106aa)

Wrap token handler in transaction (#3730) (67a85cc)

Built-in login/consent UI for hydra perform authorization-code (#3845) (7f8bd90)

Graceful refresh token rotation (#3860) (e278b40), closes #1831 #3770:

This patch adds a configuration flag which enables graceful refresh token rotation. Previously, refresh tokens could only be used once. On reuse, all tokens of that chain would be revoked.

This is particularly challenging in environments, where it's difficult to make guarantees on synchronization. This could lead to refresh tokens being sent twice due to some parallel execution.

To resolve this, refresh tokens can now be graceful by changing oauth2.grant.refresh_token.grace_period=10s (example value). During this time, a refresh token can be used multiple times to generate new refresh, ID, and access tokens.

All tokens will correctly be invalidated, when the refresh token is re-used after the grace period expires, or when the delete consent endpoint is used.

Handle concurrent refreshes and improve graceful refreshing (#3895) (0a6c966):

This patch improves Ory Hydra's ability to deal with refresh flows which, for example, concurrently refresh the same token. Furthermore, graceful token refresh has been improved to handle a variety of edge cases and scenarios.

Additionally, serializability errors in CockroachDB are now correctly retried.

See https://github.com/ory-corp/cloud/issues/7311 Closes https://github.com/ory/hydra/pull/3895

Improve persistence logic (#3756) (50301e0)

Reduce size of verifiers (#3857) (0cd00dc)

Remove unused indices (#3859) (56fc3da)

Support more claims in password grant (#3864) (41476ec):

For the resource owner password grant, the Kratos identity ID is now written to the sub claim, and the username is written to the ext.username claim. Further, token hooks are called for the initial token issuance as well as refresh flows for access tokens issued via the resource owner password grant, allowing users to customize the fields present in the access token (for the jwt strategy) as well as on introspection.

Update clients from files through the CLI (#3874) (f777fd1)

Upgrade to jackc/pgx/v5 (#3798) (cd7e7ef)