v25.4.0 brings first-class support for agentic authorization with the Device Authorization Grant (RFC 8628) and OAuth 2.1 discovery endpoint, making it easier for agents, IoT devices, and headless clients to obtain and manage access securely. Combined with new consent-chain revocation and migration fixes for CockroachDB v25+, Hydra v25.4 strengthens its role as the web and AI scale-ready OAuth 2.1 and OpenID Connect server for modern applications.

Ory has moved to a new versioning scheme. Read about our new version scheme. Interested in self-hosting Ory with support, SLAs, and advanced features? Check out our offerings.

Highlights

Agentic authentication use cases

This release makes Ory Hydra a stronger foundation for agentic authentication, where autonomous agents or constrained devices need to obtain and manage access without a full browser or direct human interaction. Two key updates enable this:

• Device authorization grant (RFC 8628): Essential for headless or limited-input clients (e.g., smart TVs, IoT devices, AI agents). It allows users to securely authorize agents through a secondary device, solving a common gap in agentic workflows.
• OAuth 2.1 discovery endpoint: Hydra now serves both OpenID Connect and OAuth 2.1 discovery documents, aligning with emerging standards. This simplifies integration for agents that expect OAuth 2.1 metadata and removes friction in federated or automated flows.

Together, these features address longstanding issues for agentic use cases by combining standards compliance with Hydra’s production-grade session and consent handling.

Device authorization grant (RFC 8628)

Adds full device flow support for devices without a browser or with limited input (smart TVs, consoles, agents).

Revoke token chains by consent challenge ID

New capability to revoke the entire token chain (refresh token and all derived access tokens) produced by a specific consent session.

OAuth 2.1 discovery endpoint

Hydra now serves /.well-known/oauth-authorization-server in addition to /.well-known/openid-configuration to aid OAuth 2.1 and certain integrations (per RFC 8414).

Improvements

• Lower latency when revoking linked Kratos sessions by making revocation asynchronous.
• Client updates with JWKS URI: PATCH/PUT no longer blocked when json_web_keys_uri is set (and json_web_keys present).
• JWT query performance: added an index for faster JWT-related lookups.
• CLI: clearer usage/help examples.

Fixes

• CockroachDB v25+ migrations: corrected/updated migration scripts; includes device-flow down/auto-commit fixes.
• Postgres UUIDs: use uuid_generate_v4() instead of MD5-based generation (enable the uuid-ossp extension if not already).
• Case-insensitive user_code scrubbing in device flow.
• Validation: tos_uri validation corrected.
• Docs: fixed JWT access token documentation link.

Security and dependencies

• go-jose v3.0.4 with a backport for CVE-2025-27144.
• Go toolchain upgrades (1.24.x) and crypto stack updates (e.g., ThalesGroup/crypto11, circl) addressing advisories.
• General dependency hygiene and CI hardening.

Upgrade notes

1. Run migrations before rolling out v2.4.0.
   • CockroachDB users on v25+: this release includes specific migration fixes; ensure your migration runner picks up the updated scripts.
   • Postgres users: ensure uuid-ossp is enabled (CREATE EXTENSION IF NOT EXISTS "uuid-ossp";) to support native UUIDs.
2. Device flow UI: add the two required screens/routes in your login/consent app to use RFC 8628.
3. Monitoring: if you scrape Prometheus on public endpoints, expect additional metrics.

Auto-generated release notes

Bug Fixes

• Add repo syncing for polis (46d17f8):

• Add virtual expiry column to flow for easy cross-db querying (1c402e3):

• Allow updating when JWKS URI is set (#3935) (#3946) (fb1655b):

  The client validator no longer rejects PATCH and PUT updates when JSONWebKeysURI is non-empty and JSONWebKeys is not nil.

• Always use EC private keys in tests (7481827):

• Better tracing in proxy HTTP (0d8a797):

• Case-insensitive user_code scrubbing (#3979) (d389fd0)

• changelog-oel: Cap grace period for refresh token rotation at 30d (35d5d58):

• changelog-oel: Reduce rows read when checking past consents (ace80c2):

• changelog-oel: Replace returning * with defined column names (0b26e27):

• changelog-oel: Update expires_at on token use (0588744):

• changelog-oel: Use keyset pagination instead of offset (cbf14c0):

• CLI usage help examples (#3943) (e24f9a7)

• Copybara script (7b33358):

• Correct multiple instances of 'stragegy' typo (#3906) (50eefbc):

  This commit addresses several occurrences where 'strategy' was misspelled as 'stragegy' throughout the codebase.

  Additionally, a similar issue was found and corrected in the Ory documentation repository (ory/docs), with a corresponding pull request submitted.

• Deduplicate down migrations (02baf36):

• deps: Update go-x (582a3c5):

• Escape IPv6 regex string (0ba326a):

• Failing CI in OSS repos (c900985):

• Fix expires_at timestamp not in UTC leading to local test failures (337000a):

• Fixed typo in description of api (4551eb6):

• Force autocommit for device auth code migration (#3991) (29761f4), closes #1234 #1234:

• Force SQL operator precedence in pagination v2 to ensure nid isolation (43c9be1):

• Hydra CI (dde63d8):

• Hydra tracing (38ee050):

• hydra: Instrument metrics also on public endpoints (8aee364):

• hydra: Use prometheus metrics instead of SQA metrics (7a6592e):

• Identity queries (a30f021):

• Ignore flaky keys in Hydra HSM tests (469b2ad):

• Ignore non SQL files when applying migrations (38a28d4):

• Implicit transactions for cockroach v23.5 and simplified migration logic (fbc982a):

• Include go.mod in vendored oryx (08a3ab4):

• Increase refresh token grace period (50608c2):

• infrastructure: Hydra oss CI (e846541):

• Jsonx.ApplyJSONPatch (c6fa2a6):

• JWT documentation link to point to the correct resource (#3907) (b746e41):

  The previous link in the documentation led to a page unrelated to JWT. Updated the URL to https://www.ory.sh/docs/oauth2-oidc/jwt-access-token, which provides proper JWT guidance.

• Migration problems (fe459ea):

• Migrations on CockroachDB v25+ (#3994) (38efece), closes #3964 #3993:

  I've added some output to the generated migrations files to make them easier to recreate, hence the big diff.

  These are important:

  persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.down.sql
  persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.up.sql
  persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.down.sql
  persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.up.sql
  
  persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.down.sql
  persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.up.sql
  persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.down.sql
  persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.up.sql
  
  persistence/sql/src/20220210000001_nid/20220210000001000000_nid.cockroach.up.sql
  

• Otlp sampling rate default (cbd5094):

• Print correct content of down migrations (4a4a088):

• Regression in UsedTimes calculation (b432e46):

• Reject invalid migration names (eb3b6ac):

• Remove strict decoding on consent and login endpoints (fb7dc75):

• Return 404 on schema file not exists (76079c0):

• Revert "fix: otlp sampling rate default (#9055)" (02e86bc):

• Revoke by consent request ID (#3947) (5d8635c), closes #3932 #3932 #3941

• Routes in AX with identity_schema (5014348):

• Simplify and fix Copybara sync job (f998d09):

• Tos_uri validation (#3945) (007e224):

  Contributes to https://github.com/ory-corp/cloud/issues/7395

• Towards fixing fosite CI (061d3fb):

• Update debian version in httpd test image (f6720c4):

• Upgrade to go 1.24.4 to fix CVE-2025-4673 (c14e538):

• Use batch insert to speed up project changes (692e41c):

• Use git hash to render ory x schema references (0a6ea5b):

• Use hard-coded fallback key instead of panic (e1f6450):

• Use main branch for polis (6c24e68):

• Using uuid_generate_v4 function (#3958) (c206066):

  Removing the md5 function for the uuid generation with native pgsql function https://www.postgresql.org/docs/current/uuid-ossp.html

  Closes https://github.com/ory/hydra/issues/3844

Code Generation

• Prepare for OSS release - v25.4.0 (de9baaa):

Code Refactoring

• Move database meta functions to root x folder for reusability (7e49133):

Features

• Add allowed domains configuration for captcha (df3f05c):

• Add error reason to OAuth2TokenExchangeError event (#3971) (241dd45)

• Add handler for /.well-known/oauth-authorization-server. (#3980) (5baca28):

  In order to support OAuth2.1 and some specific integrations that leverage the /.well-known/oauth-authorization-server endpoint, this PR adds a handler for the specific endpoint. The /.well-known/openid-configuration endpoint already supports all configuration items that conform to this endpoint as seen here: https://datatracker.ietf.org/doc/html/rfc8414

• Autoconfigure kratos-changefeed (d92dabe):

• Bump CRDB, establish foreign key, (52c0432):

• changelog-oel: Add hydra debug challenge command (a94662f):

• changelog-oel: Add expiry and TTL to authentication_session table (d9ea549):

• changelog-oel: Choose identity schema in self-service registration and login flows (a398b64):

• changelog-oel: Improved tracing and metrics for the high-performance SQL connection pool (17a4c4f):

• changelog-oel: Reduce hydra CPU and memory consumption (018709e):

• changelog: Graceful refresh count limit (470713d):

• changelog: Migrate http router to stdlib router (a147e3b):

• Custom page token column extraction (756708e):

• Domain telemetry improvements (abd5f04):

• Expose Ory-Error-Id HTTP header (8ff62f8):

• Full user-code configuration (b6ac894):

• hydra: Configurable JWK cache (994ea18):

• hydra: Split up persister (bea6b4d):

• Implement RFC 8628 (#3912) (5215d24), closes #3851 #3252 #3230 #2416:

  This patch introduces the OAuth 2.0 Device Authorization Grant to Ory Hydra. The OAuth 2.0 device authorization grant is designed for Internet-connected devices that either lack a browser to perform a user-agent-based authorization or are input constrained to the extent that requiring the user to input text in order to authenticate during the authorization flow is impractical. It enables OAuth clients on such devices (like smart TVs, media consoles, digital picture frames, and printers) to obtain user authorization to access protected resources by using a user agent on a separate device.

  The OAuth 2.0 Device Authorization Grant may also become relevant for AI Agent authentication flows and is generally an amazing step and innovation for this project.

  A very special thanks goes to @nsklikas from Canonical, @supercairos from shadow.tech and @BuzzBumbleBee.

• Improve domain telemetry for OSS (Hydra & Kratos) (02c5757):

• Improve oauth2 event data (#3975) (6da0fd3)

• Improve openapi spec (#3908) (4053c9e), closes #1234 #1234:

• Improved events and identity recent activity (a8449c8):

• List clients by ID (f8a53b0):

• Monorepo (3ff992e):

• Monorepo (a77b206):

• Move config testhelpers to ory/x (3a4ba08):

• Revoke Kratos session asynchronously (#3936) (a0e7ee2):

  This change makes the session revocation in Kratos async to improve observed latency.

• Revoke token chain by consent challenge ID (#3932) (4a40193):

  This change adds the ability to revoke token chains by "consent challenge ID".

  "Consent sessions"

  Each time the user goes through a GET /oauth2/auth?response_type=code&... auth code flow, we persist a new "consent session" to the database.

  This is independent of whether the user has previously logged in and/or granted consent, or whether the user was actively asked to grant consent by the consent app. A successful journey through the auth code flow results in a new "consent session".

  This consent session is uniquely identified by its "consent challenge ID". This ID is obtained from the GET /admin/oauth2/auth/requests/consent?consent_challenge=... API. Note that it is not the same as the consent_challenge=... query parameter!

  Any access and refresh tokens obtained from a token exchange following that particular user journey are bound to that consent session.

  We call the totality of all refresh+access tokens derived from a particular consent session a "token chain".

  Token revocation

  Revoking an access token (AT) is simple: send the AT to /oauth2/revoke and it is revoked. If this AT was derived from a refresh token (RT), the parent RT is not revoked.

  Revoking a refresh token (RT) also revokes associated access tokens.

  Revocation by consent challenge ID

  During an authorization code flow, save the consent challenge ID into the access token session data:

  GET /admin/oauth2/auth/requests/consent?consent_challenge=abcdef
  

  Response:

  {
    "acr": ...,
    "challenge": "G_TIM3XABG14UwIgDoT1DRfipjhC1uix" # <- this is the ID we need
    ...
  }
  

• Use stdlib HTTP router in Kratos (8f81931):

• Use vendored jackson (a0a9062):

• Use vendored ory/x (6581e01):

Performance Improvements

• Add index to optimize jwt query (72fa16d):

• Index hint for CRDB consents query (919b73f):

Tests

• Add golangci-lint config and GHA (1209de7):

• Ensure current encoded flows stay valid (f4301e6):

• hydra: Add snapshots for login & consent requests (687cfae):

• hydra: Clean oauth2 session setup (699e382):

• hydra: Clean up some helpers (7840b0e):

• hydra: Convert custom JWT claim tests to table (8391d1b):

• hydra: New and better e2e go tests (aefe5e2):

• hydra: Refactor consent handler tests (4d61925):

• Parallelize and improve (#3989) (a47e395)

• Resturcture and improve integration tests (2769a75):

• Split up consent manager test (42b6a79):

Unclassified

• Merge branch 'fosite-monorepo' (2c3ba13):

• Merge 3834fab8c161a7dc98d43f32acf8efd9e6e95352 into 4dae0f4a8785eb36d8dbb27137f6b924c1e0f0b5 (dc84053):

Changelog

• 1ec40dd5b2eff83100ce849c263a41d8a3dddf1a chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 in the go_modules group (#3952)
• 35d63932d85b7aa84c6464e862646d8e33af5fca chore(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 in the go_modules group across 1 directory (#3961)
• 36f21d0f01e962ee0155d4f64b68811f293f6651 chore(deps): update actions/setup-node action to v6
• edb9ba8dc99ef4bd8a2acd2396cffd07675a0493 chore(deps): update dependency node to v24
• 1449aff35ddd94d41ce6ea8406952d8765b39a36 chore(deps): update hadolint/hadolint-action action to v3.3.0
• ea8f607e303ccdaccd86d6145576d0b1ffd631aa chore(deps): update hydra
• 6ac3c3119f293c0b09258657fb825cf8d356e233 chore(deps): update hydra workflows
• ad05646598f31768dde459e5087868e613495011 chore(deps): update oss workflows
• fbae2397904c1393c6d9b47fa72a3bf70287ec37 chore(hydra): clean up command setup
• 29ba474a84987bb539ef21cb910fd817ba36b376 chore(hydra): improve test config setup
• add73e41e292a4d7d44b7f14dd7dce5bb7e426b0 chore(hydra): minor internal improvements
• dd97ec88ea5a321d6cb63179bd1c420f56e8ddee chore(hydra): registry setup refactoring
• ae2dda150b9a39fbc558e570e58c03246ca5a561 chore(hydra): remove CreateConsentRequest
• 6ba796b5842d08c0cb04b7728d589dae172842d2 chore(hydra): remove unnecessary registry functionality
• 7f02e54b0e7a0f77b6a655b9663e8aea8ffe1b23 chore(kratos): cleanup and improve some tests
• 0e7f0008d20a9b57efd156e68d5f9170fd1f8ae3 chore: add migration tests in kratos non-oss for crdb
• dcd696d923eb968c83a20b35060a8ca600c36414 chore: add pagination secrets for Kratos
• ceacf86e65a4f7be5da2a59f594162bd278e7ea1 chore: add pre-release workflows for oss
• b688b9b1acc7f2a96432737ae6ca67c262be7689 chore: additional pop options
• afc5ade3a98aed01ad8046f111b9a63bb08fbf25 chore: axios update
• e55a1fab89f50528f66e92500ccd8ec98d6df5ba chore: bump Go everywhere
• cc92fea45f5df6763935477bab4f243149098b2d chore: bump dependencies and move tools (#3968)
• 241f5139ecf488594ef5252f07262234ceec22fe chore: bump deps
• 1ca102060b43ffd7204c0e1824a4395b2185dadb chore: bump go deps
• cd2f9e54f154567f6829be018b14fa47d4f14206 chore: bump go to 1.24.6
• 8d0537a40b7496960ca704571ec6d32694de2af9 chore: bump pop to master
• f5b1e6bd50ceea9129c44a80c67b492a1d96c38f chore: bump sec deps
• 6445cd15d8484549968135193954bee164f9765b chore: cleanup oss workflows
• 35a6403a06064996f8e0302980deb426957a7a2e chore: dedicated state transition helper
• cdfb02508e9c6a3c1039baee63d7819066e0bd7b chore: explicitly skip errnorows errors in token rotation
• 4999d20db2cc0d15e45fa5302d740b55fc19db33 chore: fix all hydra linter issues
• 1c3dbb0cd1d91f30ba27f706d5677b271804799f chore: fix build for kratos-oss
• af36516b361476d2d67ac0a014256472f04dcdb0 chore: fix down migrations for device flow (#3988)
• a5854b1f57452c3b6bc22281123c1d5255cddf98 chore: fix vulnerable dependencies
• 50739a1f06ad7965151a7153be7f9d49b86d972b chore: force replacements where expected
• 7c471372c9daf74dc1887ed2fafc7a9a6b502ade chore: gh actions and node lib updates
• 1a110c963c7a6b4eabf1e30df17927454bd2101c chore: go mod tidy to unblock CI
• 6884b97b434f33c4f3d6e672986a66bd5c601a5a chore: improve migration testdata and assertions
• 20d419bfed06c0e763b2264d4e8644dce5fcd94c chore: merge ory/x repo
• f6427da213ffdac270a695724d4fcb26c820de83 chore: more gh actions and npm lib updates
• a6bec8fa4d893ad269ccee36e777e37e6e1730b7 chore: move flowctx to flow
• ba6c18aaca9f9612efa463fabaa72c009b171eb3 chore: npm security updates
• 4b09dfddd650464d2221c373bb2e751f3cd41b6d chore: reduce complexity of invalidating login
• cb0f1de3e1b9f4c7e323b610dbe6cc2789a9ef7e chore: reduce use of external-facing AcceptOAuth2ConsentRequest
• c3091857a69cf903dc4869eabeffeeec3969c383 chore: refactored fosite interfaces
• 0692df7e5e55ade56dd6c04d23aa317361eff552 chore: remove CreateLoginRequest*
• d0ec7e3cbbf162d8e8afd1d3108b34f7a6e9b29e chore: remove counting courier messages
• ba0cb06ce44d0bcfbb2818193764ba54541ff5d7 chore: remove db tags from fields that are not supposed to be stored
• 3c33a64ac3dc38dbcd8a51bced9006bd1eabb9a5 chore: remove device challenge ID from API
• 9a226afc18008078dbd9fe7ddea71bb70fd385e0 chore: remove internal fields from device challenge
• 8e3a7b82e1aa54e2f2e9cefd5f9cb26ea7421e56 chore: remove non-existing key from OpenAPI spec
• bbac4a4be5c1eaf61bd14bcda2e1e528cc178635 chore: remove redundant internal state
• 800f3fef03be0c3b5f3d817fc7bb2e57606498a0 chore: remove sdk generation action
• 63e28b0ed8492689f462f3da9e7ce66a4c9598ae chore: remove superfluous flow fields and states
• 1c6dc2ada2f7edeb56f51ba6a9edb66a464abcec chore: remove two more db field tags
• c463c64db0de238d29231ec923f6b88ea8c2f1e0 chore: remove unused random verifier fields
• 82ea6a2f9b4fc6b4e582ba49793e04f80af3b4df chore: replace ThalesIgnite/crypto11 with ThalesGroup/crypto11 (#3966)
• 9a683de907c9ec2fbde375c23f5db293952d73f6 chore: replace deprecated usages
• c6f6ae4258468775a2de81447739d6d5861dcadd chore: run oss cypress tests on custom runners
• 2d28980ded7a9c9eeaac2553c514f873830e8d9d chore: shared serve config
• d170459d62981ecb1e75aabecf6a7eaaaff27545 chore: simplify CreateDeviceUserAuthRequest
• 5745f7df04dba8e543fc5e22eac9f6da879abeec chore: simplify GetDeviceUserAuthRequest
• 83e2251cf673be13f79ee2ed33c69dbe2c1a28c1 chore: simplify HandleLoginRequest
• 1c8ba50e35e76cfdb99cd7195319c1f518ae4fe1 chore: simplify VerifyAndInvalidateDeviceUserAuthRequest
• 550274a5de6d31c2989d5dcbc72fd4b3945eb730 chore: simplify consent challenge decoding
• bb675f40ac773319561c5fdc4cb532c4f8716e2c chore: simplify consent matching logic
• a64f8faae6ec7bb2318efebeadb407628d855d8d chore: simplify consent verifier invalidation
• 6abc899da2db6488a77f2229fca31635de87ac84 chore: simplify login challenge decoding
• 442c5d0d237eeb72b43eddf5fd41ab066662d08c chore: simplify login verifier invalidation
• 5a768490b1cd7b836620458f5e897502481579c8 chore: simplify service and option loading
• 172b36b5e165f699442f509c0c4dc6b3c73e1f4b chore: split up consent manager
• 9a803533fe54018da1fe7108db780ca1525ea654 chore: template migration command help
• a88bf39a2e1b42b0f7facba347317e3add5ca295 chore: update Hydra dependencies
• 0be582a5c6072f4664c848232e8659dbc93f5b18 chore: update OSS readme
• 66c66abf8f256af22ce4f2c8bdb48f98a12890b8 chore: update actions-cache to v4 (#3948)
• bbeee840e2cf1ab806a889eb071bfc32799efe74 chore: update copybara rules
• 49e0815acacb0c618ef670b0e0ed612cea723c2f chore: update copybara transformation
• 7a92fb235f33962a43ab16ce09ccb1ddbb15d2a0 chore: update fosite to latest master commit
• 573ce56b765bb803bcd3d81108c4a51db3e5f1fe chore: update gha in oss
• 05968cd09de7d0f30ccc77c08df3852c525c6f12 chore: update github actions
• 5170fe77268454322fbe2fed0f31168b553aaf27 chore: update github actions
• ab35ad473ae556ccd12b7fd3634ba42796b291f1 chore: update opencontainers/runc to v1.3.3
• 4de96ef41197796756e1536b2d8a063f7081e06d chore: update repository templates to https://github.com/ory/meta/commit/bc603a639a8b300ffed3cf80197d3839969d7ef9
• 605649ea4fe6eadbfe795523bac30d5e70a56ea7 chore: update repository templates to https://github.com/ory/meta/commit/d919e6f6e8c850524513abd42478dea7987b99c0
• 12b62b6af6da2d9613023fd523d6c510ae807407 chore: update repository templates to https://github.com/ory/meta/commit/fc1b4d66bcc436d1caa7b16777e093b1eca63cde
• 29cbfe627123df656548a7d6535e4514fab55a24 chore: updated circl to resolve GHSA-2x5j-vhc8-9cwm
• 6b496e21c30cecd0ac094c71a177903bb57d4668 chore: upgrade crdb to v25.2 everywhere & deflake CI!
• 4103f1b62da9a6339f3544b165f8567afc4812ff chore: use TLS termination validation middleware from ory/x (#3984)
• 96aec6f351f2d6b983c0218ddaa86dd2bc253bcb chore: use dedicated ory fork of pop
• 63e617630a985e913034bd3b501528f8125d5c7b chore: use un-deprecated WithStack and cmp.Or
• 7f1b9221b70f6fb34c1b94d5fae2cd4cb9115d31 ci: renew certificates and increase validity days
• 470713da36862745ca0222c284e0692fa40559ae feat(changelog): graceful refresh count limit
• a147e3b64007a3c7b2c5dd0351321c1aa92d5b70 feat(changelog): migrate http router to stdlib router
• a94662f1edc49e662a5e1818dbfd4cac15bd9ead feat(changelog-oel): add hydra debug challenge command
• d9ea5496d81c6218abfc407d7b0849ff03a41915 feat(changelog-oel): add expiry and TTL to authentication_session table
• a398b6444bff9476b2768e9e5f840bcf73fff3a6 feat(changelog-oel): choose identity schema in self-service registration and login flows
• 17a4c4fac55a210282cfed8130ec3d8709714fb5 feat(changelog-oel): improved tracing and metrics for the high-performance SQL connection pool
• 018709e32ea23448d751d93cb48cb5325af76115 feat(changelog-oel): reduce hydra CPU and memory consumption
• 994ea185c3b83f99e2268ad829f000f6088630c4 feat(hydra): configurable JWK cache
• bea6b4dd4cd227f4674f36885b12fc6afa8ce041 feat(hydra): split up persister
• df3f05c6ffbd3f00e62a33b2b68416ccf2009112 feat: add allowed domains configuration for captcha
• 241dd45fa17ed10d1101d890199df47dab4dbce5 feat: add error reason to OAuth2TokenExchangeError event (#3971)
• 5baca2843a98c222006b27b20e7e6392421ecad8 feat: add handler for /.well-known/oauth-authorization-server. (#3980)
• d92dabedf2f55d8b74f5898c987c3e6712fb0b16 feat: autoconfigure kratos-changefeed
• 52c0432c66d4776c0a1442300e3f62f36bf16de8 feat: bump CRDB, establish foreign key,
• 756708ee5215030b68cb528be8168304424360b1 feat: custom page token column extraction
• abd5f04a9886eb3b073ecaf1f0a10663ce21c35c feat: domain telemetry improvements
• 8ff62f85170c7e5c75609ca1c0d5fdbf5490cbc8 feat: expose Ory-Error-Id HTTP header
• b6ac8945d7d47a94b4991f5273ee7ab98966dcad feat: full user-code configuration
• 5215d2482adc6328f6ed78ac7799f1f5243d1e7f feat: implement RFC 8628 (#3912)
• 02c575751089688dba55b58b5aec7673796b2c2a feat: improve domain telemetry for OSS (Hydra & Kratos)
• 6da0fd327e16d0bf40a5f637766a11b087e7ff1e feat: improve oauth2 event data (#3975)
• 4053c9ecc19f50a3793c595eeb3e242a47bbedf0 feat: improve openapi spec (#3908)
• a8449c8a1272e7d12083a7e5c5423a53ffd546e4 feat: improved events and identity recent activity
• f8a53b0193b34388ebd7e982928916e5df925aa8 feat: list clients by ID
• 3ff992e38abe10156bc3b7bed37d35784bf3021b feat: monorepo
• a77b20608238b292192498bc35a20ebd0e47c9f0 feat: monorepo
• 3a4ba084c74cf49a521856f150a8a2c6f3c1aa25 feat: move config testhelpers to ory/x
• a0e7ee29298d4f882a7d471e0601b01c6848c40d feat: revoke Kratos session asynchronously (#3936)
• 4a40193f246dd4e8e72f45e4fa31d2ee7282acec feat: revoke token chain by consent challenge ID (#3932)
• 8f8193179a39dc142d502fbc559891ffa0385ed8 feat: use stdlib HTTP router in Kratos
• a0a906211bce4ced3e1f4324eb9d287ef10892a6 feat: use vendored jackson
• 6581e01679b2e146433061cbaaebb80a0e3905b5 feat: use vendored ory/x
• 35d5d586aa19780116b6ef20321433af7ba45325 fix(changelog-oel): cap grace period for refresh token rotation at 30d
• ace80c2c145ddb541dd06110ace4039439ab3139 fix(changelog-oel): reduce rows read when checking past consents
• 0b26e279d8b9c5b27961ba3b943e8a94d338d50b fix(changelog-oel): replace returning * with defined column names
• 0588744a246e924012f46200b31b993796b5f3a6 fix(changelog-oel): update expires_at on token use
• cbf14c0b9c763e60424949358126258cbf3c316a fix(changelog-oel): use keyset pagination instead of offset
• 582a3c5f2de833a7996812d4873b305d162e1c7b fix(deps): update go-x
• 8aee364805a0fa20cd5d786324efb5c6e5cdfcb5 fix(hydra): instrument metrics also on public endpoints
• 7a6592e10fc5cd1b00d9bc12ab8c027c4e967293 fix(hydra): use prometheus metrics instead of SQA metrics
• e84654185cdfffbf160d5309f744795d15d723f9 fix(infrastructure): hydra oss CI
• e24f9a704c22c72690bc20c498439865181d9239 fix: CLI usage help examples (#3943)
• 50eefbc21c2c43d221b6079bbd78a33ef8c754c4 fix: Correct multiple instances of 'stragegy' typo (#3906)
• b746e41eda6dc3fe376b147d146a6fcc7dafb455 fix: JWT documentation link to point to the correct resource (#3907)
• 46d17f8bfdc59e2185e9ce65823eb2652e01f1b8 fix: add repo syncing for polis
• 1c402e392cb08da78ccab2c229d19dce2d414b08 fix: add virtual expiry column to flow for easy cross-db querying
• fb1655ba86077b10141132ed332ba8d6f8c70582 fix: allow updating when JWKS URI is set (#3935) (#3946)
• 748182721768a6bf331e51a6989420f20383ae05 fix: always use EC private keys in tests
• 0d8a7976ac51e8392520ceeeea340a973b4c2f73 fix: better tracing in proxy HTTP
• d389fd0269f93c8b7c787f1b3683ae4c6e9e1909 fix: case-insensitive user_code scrubbing (#3979)
• 7b333585bb44a069bf47267c853aa2e91db0efa3 fix: copybara script
• 02baf364c5f1fe09a74edb879c711983f761dc7f fix: deduplicate down migrations
• 0ba326ad59ab227bc6e9f47a846fbf1ac75c0f1c fix: escape IPv6 regex string
• c9009858dc96edbbec1dd256cb1a734beb4f90aa fix: failing CI in OSS repos
• 337000aacd07a1af6e77918a011903b6f39701a3 fix: fix expires_at timestamp not in UTC leading to local test failures
• 4551eb6e34cae866f66adf5c74469ed0d3ab2543 fix: fixed typo in description of api
• 43c9be1b5bfa56831e14dcaea0d766153f6853b8 fix: force SQL operator precedence in pagination v2 to ensure nid isolation
• 29761f4ac7586478ea6f553cb571ac11b0275e6d fix: force autocommit for device auth code migration (#3991)
• dde63d87ca5f7b3941131ba9989649dab10d3f85 fix: hydra CI
• 38ee050214499aa96b06dd6b0eb8d18ead9dcd32 fix: hydra tracing
• a30f021fd98969c2dbc31a4dc3e45365d60c1a25 fix: identity queries
• 469b2ad538865a38738a10f46d270f53d12101ad fix: ignore flaky keys in Hydra HSM tests
• 38a28d4169c492f6f5eae7d33347fabad2f04840 fix: ignore non SQL files when applying migrations
• fbc982ac8a227e90b5b587f70899fbebe381e4b1 fix: implicit transactions for cockroach v23.5 and simplified migration logic
• 08a3ab43ddb1e2a0df430224f969fe3f0ba161bf fix: include go.mod in vendored oryx
• 50608c296615851e381b078d653b243ca6135d9b fix: increase refresh token grace period
• c6fa2a6f17f63e43cfecb576bd2a1c1b58c778ed fix: jsonx.ApplyJSONPatch
• fe459ea61391aaac097ceedbc8f171a9fdc356f9 fix: migration problems
• 38efece55be02d722eafef9d0cec06ec12a29d65 fix: migrations on CockroachDB v25+ (#3994)
• cbd50947ff7e03a4c32d0ad52acd55b595b393ce fix: otlp sampling rate default
• 4a4a0880dc6222870b1e177ce04f81842359f922 fix: print correct content of down migrations
• b432e46f763d28cd20bb3e60cbb785ce373a4c85 fix: regression in UsedTimes calculation
• eb3b6ace6bca3d3692622b544678d73ab8285848 fix: reject invalid migration names
• fb7dc75d9810d835ce5f04eddcadfb2030f8bfe3 fix: remove strict decoding on consent and login endpoints
• 76079c0da191a902284c015fd9e8e057d09b48f4 fix: return 404 on schema file not exists
• 02e86bc192c8f693c23aa430481a1e719d8e2e21 fix: revert "fix: otlp sampling rate default (#9055)"
• 5d8635c94389ff3c87bfae66afe95105c147bec1 fix: revoke by consent request ID (#3947)
• 50143483fd66fb7d545e8a8e2c7e95857f35fbbb fix: routes in AX with identity_schema
• f998d090ca6408b05524aea5e5f3a79c5d44b1a4 fix: simplify and fix Copybara sync job
• 007e22412ae72403415e8b2f2283154b8d88f511 fix: tos_uri validation (#3945)
• 061d3fbae416a39b7258905938b1e435f6827d4b fix: towards fixing fosite CI
• f6720c4e62f66c245ce8370da40acbc91eca3ffb fix: update debian version in httpd test image
• c14e538d8d993252a246eb17832c09234825a98c fix: upgrade to go 1.24.4 to fix CVE-2025-4673
• 692e41c75446a51e3d38b37f5aada51358e4741a fix: use batch insert to speed up project changes
• 0a6ea5b70a4fa4508bd2bfde9c810d38695c3f2a fix: use git hash to render ory x schema references
• e1f645012f43f62928fdc79710b45d935878367f fix: use hard-coded fallback key instead of panic
• 6c24e68995b8eae9ba0b8872867270ef1d35113b fix: use main branch for polis
• c20606606654af975e5d82998956bb998acee576 fix: using uuid_generate_v4 function (#3958)
• 72fa16d5f677bdf505847fa781d1ca84bc2ceb39 perf: add index to optimize jwt query
• 919b73ff72c9ca154fdb8cea0ac50b944a5f437e perf: index hint for CRDB consents query
• 7e49133f435d6a0f74a63e8f8d03c5d314d7d3c6 refactor: move database meta functions to root x folder for reusability
• 687cfae2092b90bcde11b0976b3f944bc8bb9a4a test(hydra): add snapshots for login & consent requests
• 699e38238220f857148b503dfb96d9b057bb4583 test(hydra): clean oauth2 session setup
• 7840b0e0aade3b8fac6f1677a75b192e9c094b23 test(hydra): clean up some helpers
• 8391d1bc57a85420f50c2e0b856a509b6784963d test(hydra): convert custom JWT claim tests to table
• aefe5e2663608ec945dc49be466d48c0d43810f2 test(hydra): new and better e2e go tests
• 4d6192599dc4f1020e8c5418398c6a85820c74cb test(hydra): refactor consent handler tests
• 1209de78736c6730fa84cbf4e7046535aeba094f test: add golangci-lint config and GHA
• f4301e6d58919288935690576a24cd2dd57ddbb0 test: ensure current encoded flows stay valid
• a47e39513f1f08076849f77517977abffa195364 test: parallelize and improve (#3989)
• 2769a75d0c911803485002c63453f1fdcf967ba6 test: resturcture and improve integration tests
• 42b6a790410f54d2d1ea3a8330515c49ea516676 test: split up consent manager test

Artifacts can be verified with cosign using this public key.