changelog-oel: Cap grace period for refresh token rotation at 30d (35d5d58):

changelog-oel: Reduce rows read when checking past consents (ace80c2):

changelog-oel: Replace returning * with defined column names (0b26e27):

changelog-oel: Update expires_at on token use (0588744):

changelog-oel: Use keyset pagination instead of offset (cbf14c0):

CLI usage help examples (#3943) (e24f9a7)

Copybara script (7b33358):

Correct multiple instances of 'stragegy' typo (#3906) (50eefbc):

This commit addresses several occurrences where 'strategy' was misspelled as 'stragegy' throughout the codebase.

Additionally, a similar issue was found and corrected in the Ory documentation repository (ory/docs), with a corresponding pull request submitted.

Deduplicate down migrations (02baf36):

deps: Update go-x (582a3c5):

Escape IPv6 regex string (0ba326a):

Failing CI in OSS repos (c900985):

Fix expires_at timestamp not in UTC leading to local test failures (337000a):

Fixed typo in description of api (4551eb6):

Force autocommit for device auth code migration (#3991) (29761f4), closes #1234 #1234:

Force SQL operator precedence in pagination v2 to ensure nid isolation (43c9be1):

Hydra CI (dde63d8):

Hydra tracing (38ee050):

hydra: Instrument metrics also on public endpoints (8aee364):

hydra: Use prometheus metrics instead of SQA metrics (7a6592e):

Identity queries (a30f021):

Ignore flaky keys in Hydra HSM tests (469b2ad):

Ignore non SQL files when applying migrations (38a28d4):

Implicit transactions for cockroach v23.5 and simplified migration logic (fbc982a):

Include go.mod in vendored oryx (08a3ab4):

Increase refresh token grace period (50608c2):

infrastructure: Hydra oss CI (e846541):

Jsonx.ApplyJSONPatch (c6fa2a6):

JWT documentation link to point to the correct resource (#3907) (b746e41):

The previous link in the documentation led to a page unrelated to JWT. Updated the URL to https://www.ory.sh/docs/oauth2-oidc/jwt-access-token, which provides proper JWT guidance.

Migration problems (fe459ea):

Migrations on CockroachDB v25+ (#3994) (38efece), closes #3964 #3993:

I've added some output to the generated migrations files to make them easier to recreate, hence the big diff.

These are important:

persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.down.sql
persistence/sql/migrations/20211004110001000000_change_client_primary_key.cockroach.up.sql
persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.down.sql
persistence/sql/migrations/20211004110003000000_change_client_primary_key.cockroach.up.sql

persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.down.sql
persistence/sql/migrations/20211011000001000000_change_jwk_primary_key.cockroach.up.sql
persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.down.sql
persistence/sql/migrations/20211011000003000000_change_jwk_primary_key.cockroach.up.sql

persistence/sql/src/20220210000001_nid/20220210000001000000_nid.cockroach.up.sql

Otlp sampling rate default (cbd5094):

Print correct content of down migrations (4a4a088):

Regression in UsedTimes calculation (b432e46):

Reject invalid migration names (eb3b6ac):

Remove strict decoding on consent and login endpoints (fb7dc75):

Return 404 on schema file not exists (76079c0):

Revert "fix: otlp sampling rate default (#9055)" (02e86bc):

Revoke by consent request ID (#3947) (5d8635c), closes #3932 #3932 #3941

Routes in AX with identity_schema (5014348):

Simplify and fix Copybara sync job (f998d09):

Tos_uri validation (#3945) (007e224):

Contributes to https://github.com/ory-corp/cloud/issues/7395

Towards fixing fosite CI (061d3fb):

Update debian version in httpd test image (f6720c4):

Upgrade to go 1.24.4 to fix CVE-2025-4673 (c14e538):

Use batch insert to speed up project changes (692e41c):

Use git hash to render ory x schema references (0a6ea5b):

Use hard-coded fallback key instead of panic (e1f6450):

Use main branch for polis (6c24e68):

Using uuid_generate_v4 function (#3958) (c206066):

Removing the md5 function for the uuid generation with native pgsql function https://www.postgresql.org/docs/current/uuid-ossp.html

Closes https://github.com/ory/hydra/issues/3844

changelog-oel: Add hydra debug challenge command (a94662f):

changelog-oel: Add expiry and TTL to authentication_session table (d9ea549):

changelog-oel: Choose identity schema in self-service registration and login flows (a398b64):

changelog-oel: Improved tracing and metrics for the high-performance SQL connection pool (17a4c4f):

changelog-oel: Reduce hydra CPU and memory consumption (018709e):

changelog: Graceful refresh count limit (470713d):

changelog: Migrate http router to stdlib router (a147e3b):

Custom page token column extraction (756708e):

Domain telemetry improvements (abd5f04):

Expose Ory-Error-Id HTTP header (8ff62f8):

Full user-code configuration (b6ac894):

hydra: Configurable JWK cache (994ea18):

hydra: Split up persister (bea6b4d):

Implement RFC 8628 (#3912) (5215d24), closes #3851 #3252 #3230 #2416:

This patch introduces the OAuth 2.0 Device Authorization Grant to Ory Hydra. The OAuth 2.0 device authorization grant is designed for Internet-connected devices that either lack a browser to perform a user-agent-based authorization or are input constrained to the extent that requiring the user to input text in order to authenticate during the authorization flow is impractical. It enables OAuth clients on such devices (like smart TVs, media consoles, digital picture frames, and printers) to obtain user authorization to access protected resources by using a user agent on a separate device.

The OAuth 2.0 Device Authorization Grant may also become relevant for AI Agent authentication flows and is generally an amazing step and innovation for this project.

A very special thanks goes to @nsklikas from Canonical, @supercairos from shadow.tech and @BuzzBumbleBee.

For more details, please check out the documentation (https://github.com/ory/docs/pull/2026)

To implement this feature, you will need to implement two additional screens in your login and consent application. A reference implementation can be found here.

Improve domain telemetry for OSS (Hydra & Kratos) (02c5757):

Improve oauth2 event data (#3975) (6da0fd3)

Improve openapi spec (#3908) (4053c9e), closes #1234 #1234:

Improved events and identity recent activity (a8449c8):

List clients by ID (f8a53b0):

Monorepo (3ff992e):

Monorepo (a77b206):

Move config testhelpers to ory/x (3a4ba08):

Revoke Kratos session asynchronously (#3936) (a0e7ee2):

This change makes the session revocation in Kratos async to improve observed latency.

Revoke token chain by consent challenge ID (#3932) (4a40193):

This change adds the ability to revoke token chains by "consent challenge ID".

"Consent sessions"

Each time the user goes through a GET /oauth2/auth?response_type=code&... auth code flow, we persist a new "consent session" to the database.

This is independent of whether the user has previously logged in and/or granted consent, or whether the user was actively asked to grant consent by the consent app. A successful journey through the auth code flow results in a new "consent session".

This consent session is uniquely identified by its "consent challenge ID". This ID is obtained from the GET /admin/oauth2/auth/requests/consent?consent_challenge=... API. Note that it is not the same as the consent_challenge=... query parameter!

Any access and refresh tokens obtained from a token exchange following that particular user journey are bound to that consent session.

We call the totality of all refresh+access tokens derived from a particular consent session a "token chain".

Token revocation

Revoking an access token (AT) is simple: send the AT to /oauth2/revoke and it is revoked. If this AT was derived from a refresh token (RT), the parent RT is not revoked.

Revoking a refresh token (RT) also revokes associated access tokens.

Revocation by consent challenge ID

During an authorization code flow, save the consent challenge ID into the access token session data:

GET /admin/oauth2/auth/requests/consent?consent_challenge=abcdef

Response:

{
  "acr": ...,
  "challenge": "G_TIM3XABG14UwIgDoT1DRfipjhC1uix" # <- this is the ID we need
  ...
}

Accept the consent request:

PUT /admin/oauth2/auth/requests/consent/accept?consent_challenge=abcdef
{
  "remember": true,
  "remember_for": 3600,
  "session": {
    "access_token": {
      "ccid": "G_TIM3XABG14UwIgDoT1DRfipjhC1uix"
    }
  },
  ...
}

To revoke the token chain associated with this consent challenge ID, use

POST admin/oauth2/auth/sessions/consent?consent_challenge_id=G_TIM3XABG14UwIgDoT1DRfipjhC1uix

Use stdlib HTTP router in Kratos (8f81931):

Use vendored jackson (a0a9062):

Use vendored ory/x (6581e01):

hydra: Refactor consent handler tests (4d61925):

Parallelize and improve (#3989) (a47e395)

Resturcture and improve integration tests (2769a75):

Split up consent manager test (42b6a79):