Highlights

Passwordless and recovery improvements

• Added passwordless login and registration via SMS.
• Recovery codes can now be delivered by SMS.
• Significantly improved recovery flows that now work with any and multiple address types (email or SMS).
• Added resend node for verification after registration.

Passkeys and other credentials

• Support for Android WebAuthn origins, enabling secure passkeys on Android.
• Emission of oryWebAuthnInitialized event when WebAuthn is ready in the browser.
• Graceful handling of failing password rehashing during login, improving reliability for long passwords.
• Conditional passkey handling improved (better retry behavior).

OIDC and SAML

• Added support for importing SAML credentials (Enterprise/Network only).
• Added support for Line v2.1 OIDC provider.
• Microsoft OIDC now uses oid instead of sub for stable identifiers.
• Added caching of OIDC providers to reduce calls to discovery endpoints.
• New policy callbacks for customizing OIDC credential linking.
• Added more extension points to the registry.

User flow enhancements

• require_verified_address now automatically starts a verification flow instead of failing.
• Captcha improvements: first-step captcha groups and domain allowlists (Ory Enterprise License / Ory Network only).
• Improved error reporting and handling across login, registration, and linking flows (Ory Enterprise License / Ory Network only).
• OIDC signup and account linking flows more robust, including better handling of login challenges in SPAs.
• alreadyAuthenticated cases in native login/registration flows now handled correctly.
• Verification hooks improved: correct status handling in recovery hooks and support in settings flows.
• Auto-linking and identifier updates fixed to ensure identities remain consistent.
• Division UI nodes added for dynamic script hooks.
• Console UI now supports multiple identity schemas.
• Admin API now allows deleting password credentials if not the last factor.

Events and observability

• New events: LoginStarted, RegistrationStarted.
• New courier events: CourierMessageAbandoned, CourierMessageDispatched.
• Events now emitted on Jsonnet mapping failures (OIDC claims, JWT templating).
• Admin recovery code events are logged.
• More attributes added to webhook events for better debugging.
• Extended tracing in settings, courier, and credential linking flows.

Operational and performance improvements

• Optimized secondary indices for self-service, session, and identity tables.
• Removed unused indices and improved query plans for CockroachDB.
• Reduced duplicate queries in settings and credential flows.
• Faster lookups for credential types and session handling.
• Added index hints for CockroachDB identity credential deletion.
• Improved handling of identity imports with reduced DB load.
• Recovery and OTP code submit count mechanism redesigned to prevent brute-forcing.
• New kratos migrate sql up|down|status commands replace old migration CLI commands.
• OIDC sessions now loaded only once when middleware is used.
• Courier improved with HTML email support and more reliable tracing.
• Added explicit config flag for secure cookies.
• External ID support for identities via API and webhooks.
• New endpoint to tokenize JWTs using webhooks.
• Improved domain telemetry for OSS deployments.
• Autoconfiguration for kratos-changefeed (Ory Enterprise License / Ory Network only).
• High-performance SQL connection pool with tracing and metrics (Ory Enterprise License / Ory Network only).

Developer and extension improvements

• More extension points available in registry and OIDC flows.
• Jsonnet body templating enabled for password migration hook.
• New attributes available for Login and Registration events.
• Webhook configuration handling refactored and extended.
• New division node attributes for UI extensibility.
• Added email domain matcher for flows.
• Added external IDs and webhook configurability.
• Console support for choosing identity schema during registration/login (Enterprise).

Documentation and tooling

• Improved docs for OAS verification, Facebook Graph API, and OIDC subject sources.
• Clarified error messages in security-related contexts.
• Better migration error handling and improved messages for operators.
• Added help text for new migration commands.
• CI/CD stability fixes, improved code coverage configuration, and dependency updates.

Breaking changes

• Sessions API: The x-total-count header has been removed from GET /admin/sessions.

  Commit: e24f993ea

• Account linking: Failed OIDC account linking flows now return HTTP 400 instead of 200 OK.

  Commit: ed4fba3ef

• Verification flow: The show_verification_ui element is only included if the hook is explicitly configured.

  Commit: 5b00fe15d

• OIDC registration: Failing fields are now placed in the default node group instead of oidc. Legacy behavior can be restored with feature_flags.legacy_oidc_registration_node_group=true.

  Commit: dc8b32e00

Known regressions

Unfortunately, this release contains a breaking change. Most applications will be unaffected by this issue. Read more about it here: https://github.com/ory/kratos/pull/4499

Auto-generated release notes

The require_verified_address hook no longer returns a plain error. Previously, users had to manually start the verification flow, which caused a poor experience. Now, Ory Kratos automatically creates a verification flow and redirects the user using continue_with or an HTTP redirect. The verification flow starts with the first verified address found for the user. This aligns the behavior of require_verified_address with using the verification and show_verification_ui hook combination for login.

Going forward, the node group of fields that are failing validation during oidc sign up are default and no longer oidc. For now, you can get the legacy behavior back by turning on feature_flags.legacy_oidc_registration_node_group=true.

Co-authored-by: Jonas Hungershausen jonas.hungershausen@ory.sh

Before this change, show_verification_ui would always be included in continue_with for the registration flow when verification was enabled. After this change, show_verification_ui is only included when the show_verification_ui post-registration hook is defined.

Account linking incorrectly returned a 200 OK status code even though the login flow was not completed successfully. Going forward, the correct 400 OK status code will be sent when using the API flow or Accept: application/json.

This patch changes the behavior of configuration item foo to do bar. To keep the existing behavior please do baz.

Bug Fixes

• Accept login challenge in session_issuer on SPA flows (#4288) (e13687a)

• Accept login_challenge in SPA verification flows (#4284) (7ca3b6b)

• Account linking should only happen after 2fa when required (#4174) (8e29b68)

• Account linking with 2FA (#4188) (4a870a6):

  This fixes some edge cases with OIDC account linking for accounts with 2FA enabled.

• Add default issuer URL for LINE (#4415) (292f65d):

  Fixed+expanded relevant comment.

  Fixed some tracing issues.

  Added error info and missing res.Body.Close() in courier.

• Add exists clause (#4191) (a313dd6)

• Add missing autocomplete attributes to identifier_first strategy (#4215) (e1f29c2)

• Add missing csrf_token (#4363) (f441f41)

• Add missing discriminator (#4365) (c10bb06)

• Add missing saml group (#4268) (44eb305)

• Add missing submit group (#4354) (106163d)

• Add missing values to the session method enum (a043b43):

• Add resend node to after registration verification flow (#4260) (9bc83a4)

• Add transient payload to fedcm (#4369) (245f5dc), closes #1234 #1234:

• Allow patching some /credentials sub-paths (#4277) (aefa806), closes #1234 #1234:

• Also update identifiers (#4321) (7c63727):

  This fixes a bug where when an identity is merged into another, the identifier of the original identity was not updated.

• Another apple fix (8a220c0):

• Apply strategy filters in identifier first as well (#4352) (ec3ecc5)

• Better tracing in proxy HTTP (ff5fa9b):

• Cancel conditional passkey before trying again (#4247) (d9f6f75)

• Check aal on sessions list endpoint (#4305) (44f97b8), closes #3671:

  The session check to list a user's own sessions now requires the same AAL level as the whoami check.

• Clarify import responses (2a44fd5):

• Context passing and missing body close (79f4e2a):

• Copybara script (b3af828):

• Correctly handle HTTP route patterns in metrics (dc992d3):

• Count MFA addresses in CountActiveMultiFactorCredentials for code method (9860c9a), closes ory/network#409

• Deduplicate down migrations (a000460):

• deps: Update go-x (ae80380):

• Detect whether external_id is set in webhook response (7d0d7f6):

• Div decoding (#4362) (ef9ee23)

• Do not roll back transaction on partial identity insert error (#4211) (82660f0)

• Don't remove OIDC buttons if invalid identifier is submitted (97848c7):

• Don't show oidc subject in login hints (#4264) (b95fd3f)

• Duplicate autocomplete trigger (6bbf915)

• Enable b2b_sso hook in more places (#4168) (0c48ad1):

  fix: allow b2b_sso hook in more places

• Ensure make quickstart-dev works without options (#4401) (327c5a4):

  make quickstart-dev uses the make variable QUICKSTART_OPTIONS which is set to "" by default. This will result in two double quotes ("") in the final shell command e.g. docker-compose "" up when the variable is not set on the make command line, which fails at the shell level. The fix is to leave the variable empty by default. No semantic changes.

• Ensure authentication method is added to session after linking OIDC provider (5cae1f7):

• Ensure context is not canceled during password hashing (#4364) (e9c6a18):

  Especially during large imports of plaintext passwords there can be a lot of useless hashing, even after the request timed out or got canceled.

• Ensure that auto_link_credentials markers are being properly overwritten (#4320) (a4fd8ac), closes #1234 #1234:

• Escape IPv6 regex string (b629ca7):

• Exclude nothing in copybara (98b7acd):

• Exclude orgs (#4351) (68500d1)

• Explicity set updated_at field when updating identity (#4131) (66afac1)

• Failing CI in OSS repos (26518b6):

• Fix back button for recovery flow not showing in AX v1/v2 (f1cfc36):

• Fix nil dereference & lint warnings (98f9897):

• Fixed typo in description of api (f9ffaae):

• Force profile to be first hydrator in profile_first strategy (#4380) (f475aea)

• Force SQL operator precedence in pagination v2 to ensure nid isolation (93d364c):

• Gracefully handle unused index (#4196) (3dbeb64)

• hydra: Instrument metrics also on public endpoints (a6ac143):

• hydra: Use prometheus metrics instead of SQA metrics (da4ea07):

• Identity queries (cf53971):

• IdentityCreated is over-reporting on error inserts (#4323) (c3f4ecf):

  defer was the incorrect code path here, as we should only record identity created if the transaction did not error (aka was rolled back).

• Ignore CSRF on all apple provider callback URLs (#4291) (b60edba)

• Ignore non SQL files when applying migrations (41b342c):

• Implicit transactions for cockroach v23.5 and simplified migration logic (e8170fc):

• Improve linking on OIDC signup (#4314) (687d578), closes #1234 #1234:

• Include go.mod in vendored oryx (7c0d9c6):

• Incorrect if switch in previous sceen case in two step registration (f8ee403), closes #374

• Incorrect query plan (#4218) (7d0e78a)

• Incorrect response code on account linking (#4336) (ed4fba3)

• Jsonx.ApplyJSONPatch (f3a3292):

• kratos: Do not explicitly pass identity schema on step-up login (639f765):

• Login otp sent message (335acd4):

• Make external_id settable through webhook (cfd213a):

• Make external_id settable through webhook (bf2b34d):

• Make node_type stricter per uiNodeAttributes type (d7d3ba4):

• Make RecoveryAddress.ID optional to prevent errors (6f5e79a):

• Migration problems (57d86d2):

• Order-by clause and span names (#4200) (b6278af)

• Otlp sampling rate default (4ac6122):

• Pass on correct context during verification (#4151) (7e0b500)

• Preview_credentials_identifier_similar (#4246) (5ee54ed)

• Print correct content of down migrations (3c84b7a):

• Quick typo fix for kratos-oss test script run (5bd3b52):

• Registration post persist hooks should not be cancelable (#4148) (18056a0)

• Reject invalid migration names (7dc28eb):

• Remove duplicate address verification (2cc2b69):

• Remove selfservice.methods.link.config.base_url (db8a94e):

• Rename b2b_sso hook (#4349) (d9e3295)

• Return return_to code if already authenticated (#4286) (119841a):

  This fixes a bug in native OIDC login and registration flows, where the user already has a session in the browser the flow is continued with (usually a web view, but depending on the platform it already has a session cookie set). In the callback, we now correctly handle the case in alreadyAuthenticated to return the session token exchange code.

• Return 404 on schema file not exists (dd589fa):

• Revert "fix: otlp sampling rate default (#9055)" (8379db8):

• Routes in AX with identity_schema (105018d):

• Schema key (#4332) (306316f)

• sdk: Add missing captcha group (#4254) (241111b)

• sdk: Add missing enum type to autocomplete (#4396) (4127cbb):

• sdk: Remove incorrect attributes (#4163) (88c68aa)

• Send correct verification status in post-recovery hook (#4224) (7f50400):

  The verification status is now correctly being transported when executing a recovery hook.

• Set correct request url in acc linking and oidc flows (#4282) (07cb83c)

• Set default for CYPRESS_OPTS (6fb39e2):

• Settings linking error override (#4368) (6e30865)

• Show code email in most error states (#4338) (905d1e5)

• Show_verification_ui in continue_with only if configured (#4402) (5b00fe1):

  This patch modifies the self-service registration flow so that the show_verification_ui continue_with element is only returned when the relevant post‑registration hook is defined (or when legacy behavior is enabled via configuration). It also adds a new attribute key and internal context handling for the registration flow and updates related tests and API signatures.

• Span names (#4232) (dbae98a)

• Stricter JSON patch checking for PATCH identities (#4263) (906f6c8)

• Support show_verification_hook in settings hooks (#4410) (c433c44)

• Tests for Kratos OSS Cypress (0332143):

• Throw upstream error on OIDC issues (332873d):

• Truncate updated at (#4149) (2f8aaee)

• Upgrade to go 1.24.4 to fix CVE-2025-4673 (13ebb69):

• Use appleid audience for secret exchange (38f8b36):

• Use batch insert to speed up project changes (928c9f8):

• Use context for readiness probes (#4219) (e6d2d4d)

• Use default group for signup nodes in oidc (#4414) (dc8b32e)

• Use git hash to render ory x schema references (6776835):

• Use hard-coded fallback key instead of panic (29eeb56):

• Use non-alerting errors for errors not needing alerts (49e472c):

• Use updated appleid issuer (76afd6d):

Chores

• Document test migration (#4265) (9959545), closes #1234 #1234:

• Upgrade to go 1.24 (#4313) (bdb046d), closes #1234 #1234:

Code Generation

• Prepare for OSS release - v25.4.0 (64e04ac):

Code Refactoring

• Hash comparator instantiation (#4195) (53a5a8b)

• Move database meta functions to root x folder for reusability (85bf18d):

• Remove total count from listSessions and improve secondary indices (#4173) (e24f993):

  This patch changes sorting to improve performance on list session endpoints. It also removes the x-total-count header from list responses.

• Two-step registration (#4348) (f46aed1):

  Refactors internals of the two-step registration to better fit into the architecture.

Documentation

• Add return_to query parameter to OAS Verification Flow for Native Apps (#4086) (b22135f)

• Clarify facebook graph API versioning (#4208) (a90df58)

• Defining oid as oidc subject_source (#4270) (b388a4a)

• Improve SecurityError error message for ory elements local (#4205) (0062d45)

• kratos: Better identity handler description (405f2f0):

• Remove unused SMS config from schema (#4212) (f076fe4)

• Usage of organization parameter in native self-service flows (#4176) (cb71e38)

Features

• Add a policy callback to customize OIDC credential linking (#4302) (e2f878a)

• Add a project revision field to set the maximum number of code submits (0e68c7e):

• Add ability to send recovery code via sms (eb9d934):

• Add allowed domains configuration for captcha (edb9e0c):

• Add attributes to webhook events for better debugging (#4206) (00da05d)

• Add captcha group to first-step registration (eca4ae9)

• Add context param to policy (#4315) (261596b)

• Add email domain matcher (#4373) (1c33c39)

• Add explicit config flag for secure cookies (#4180) (2aabe12):

  Adds a new config flag for session and all other cookies. Falls back to the previous behavior of using the dev mode to decide if the cookie should be secure or not.

• Add external ID to identities (335a1e8):

• Add failure reason to events (#4203) (afa7618)

• Add HTML email support to HTTP channel (#4387) (fb8856e), closes #4350

• Add Login with Amazon (6cb3e99):

• Add LoginStarted and RegistrationStarted events (#4404) (7032fec), closes ory/docs#2144:

  Changes:

  • Add LoginStarted and RegistrationStarted events along their required attributes
  • Sort all event attributes alphabetically
  • Emit these events when a new login/registration flow is created, after basic validation passed
  • It is unclear yet how many of these events will be emitted, as such it is suggested that in a first phase, they remain internal and are not yet sent externally to avoid surprises (note: sometimes, these events can be emitted without user action such as simply visiting/being redirected to the sign-in page, etc)

  Documentation PR:

• Add migrate sql up|down|status (#4228) (e6fa520):

  This patch adds the ability to execute down migrations using:

  kratos migrate sql down -e --steps {num_of_steps}
  

  Please read kratos migrate sql down --help carefully.

  Going forward, please use the following commands

  kratos migrate sql up ...
  kratos migrate sql status ...
  

  instead of the previous, now deprecated

  kratos migrate sql ...
  kratos migrate status ...
  

  commands.

  See https://github.com/ory-corp/cloud/issues/7350

• Add new Division ui node attributes (235af52):

  Division nodes may be used to hook dynamic scripts and are not actively used in the Ory Kratos open source.

• Add new endpoint to tokenize JWT with a webhook (f7fa792):

• Add oid as subject source for microsoft (#4171) (77beb4d), closes #4170:

  In the case of Microsoft, using sub as an identifier can lead to problems. Because the use of OIDC at Microsoft is based on an app registration, the content of sub changes with every new app registration. Sub is therefore not uniquely related to the user. It is therefore not possible to transfer users from one app registration to another without further problems. https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference#payload-claims

  With the use of oid it is possible to identify a user by a unique id.

• Add session in settings after hook (1b57fdf):

• Add support for Line v2.1 OIDC provider (#4240) (729effd):

  For OIDC Line Login, you only need to add id_token_key_type=JWK in the exchange step to issue tokens in ES256 format.

  https://github.com/ory/kratos/discussions/1116

• Allow deleting password credentials (#4304) (f2212d4):

  The admin API did not allow to delete passwords at all. The restriction is now lifted to only block deletion of the first-factor credential if it is the last one.

• Allow extra go migrations in persister (#4183) (7bec935)

• Allow listing identities by organization ID (#4115) (b4c453b)

• Allow setting the org ID on creation (#4306) (bccd2fb)

• Autoconfigure kratos-changefeed (b8bf4c7):

• Bump CRDB, establish foreign key, (d76e70f):

• Cache OIDC providers (#4222) (30485c4):

  This change significantly reduces the number of requests to /.well-known/openid-configuration endpoints.

• changelog-oel: Choose identity schema in self-service registration and login flows (53f4b9f):

• changelog-oel: Improved tracing and metrics for the high-performance SQL connection pool (ce1bf9f):

• changelog: Add a new feature flag for the Recovery V2 to ensure backwards-compatibility (d68736b):

• changelog: Add CourierMessageAbandoned & CourierMessageDispatched events (dfed493):

• changelog: Find-by and delete SAML credentials (0c80f61):

• changelog: Migrate http router to stdlib router (48f5adb):

• changelog: Reject new password same as old password when changing the password (a7f50ab):

• Console UI for multiple identity schemas (1145cda):

• Custom page token column extraction (c5cb85e):

• Domain telemetry improvements (93345d7):

• Drop unused indices post index migration (#4201) (1008639)

• Emit admin recovery code event (#4230) (a7cdc3a)

• Emit event on Jsonnet claims mapping error (#4394) (8caebdb):

  We now emit an event containing the Jsonnet input and output in anonymized form when mapping the claims in the OIDC flow fails.

• Emit events on jsonnet failure when templating a jwt (#4409) (959ded5):

  • Fix typo: parital -> partial
  • Document with comments why an event is not emitted or not documented
  • Emit JsonnetMappingFailed events on jsonnet failure when templating a jwt (see https://www.ory.sh/docs/identities/session-to-jwt-cors). After review it seems we otherwise always emit events in all the right places, except in this very case. Tested end-to-end manually with the UI.

• Emit oryWebAuthnInitialized event once webauthn is initialized (b4485f4):

• Enable JSONNet templating for password migration hook (#4390) (b162897):

  This enables JSONNet body templating for the password migration hook. There is also a significant refactoring of some internals around webhook config handling.

• Expose Ory-Error-Id HTTP header (f2b0cd5):

• Fast add credential type lookups (#4177) (eeb1355)

• Faster UpdateIdentity (4c2cfae):

• Fewer DB loads when linking credentials, add tracing (2c5bb21)

• Goreleaser (db10a68):

• Gracefully handle failing password rehashing during login (#4235) (3905787):

  This fixes an issue where we would successfully import long passwords (>72 chars), but fail when the user attempts to login with the correct password because we can't rehash it. In this case, we simply issue a warning to the logs, keep the old hash intact, and continue logging in the user.

• hydra: Split up persister (910cf9c):

• Improve domain telemetry for OSS (Hydra & Kratos) (86ab72a):

• Improve identity import limits (#4378) (e38e812)

• Improve kratos courier metrics and debug log message (c50ffcc):

• Improve QueryForCredentials (#4181) (ca0d6a7)

• Improve secondary indices for self service tables (#4179) (825aec2)

• Improve verification required flows (#4407) (2014a40)

• Improved events and identity recent activity (e47b858):

• Improved tracing for courier (85a7071)

• Index hint for CRDB when deleting identity credentials (#4276) (c703a33):

  Ref https://support.cockroachlabs.com/hc/en-us/requests/25430

• Jackson provider (#4242) (f18d1b2):

  This adds a jackson provider to Kratos.

• Load session only once when middleware is used (#4187) (234b6f2)

• Monorepo (31f1894):

• More extension points (#4272) (373a2e6):

  This adds more extension points to the Kratos registry.

• Move config testhelpers to ory/x (8d43aae):

• Optimize identity-related secondary indices (#4182) (53874c1)

• Passwordless SMS and expiry notice in code / link templates (#4104) (462cea9):

  This feature allows Ory Kratos to use the SMS gateway for login and registration with code via SMS.

  Additionally, the default email and sms templates have been updated. We now also expose ExpiresInMinutes / expires_in_minutes in the templates, making it easier to remind the user how long the code or link is valid for.

  Closes https://github.com/ory/kratos/issues/1570 Closes https://github.com/ory/kratos/issues/3779

• Recovery with any address including with a code via SMS (71844dd):

• Refactor cmd/daemon (#4371) (7fe55d9)

• Remove duplicate queries during settings flow and use better index hint for credentials lookup (#4193) (c33965e):

  This patch reduces duplicate GetIdentity queries as part of submitting the settings flow, and improves an index to significantly reduce credential lookup.

  For better debugging, more tracing ha been added to the settings module.

• Remove more unused indices (#4186) (b294804)

• Return field name in generated node text label (8c7a3dc):

• Rework the OTP code submit count mechanism (#4251) (4ca4d79):

  • feat: rework the OTP code submit count mechanism

  Unlike what the previous comment suggested, incrementing and checking the submit count inside the database transaction is not actually optimal peformance- or security-wise.

  We now check atomically increment and check the submit count as the first part of the operation, and abort as early as possible if we detect brute-forcing. This prevents a situation where the check works only on certain transaction isolation levels.

  • chore: bump dependencies

• Support android webauthn origins (#4155) (a82d288):

  This patch adds the ability to verify Android APK origins used during WebAuthn/Passkey exchange.

  Upgrades go-webauthn and includes fixes for Go 1.23 and workarounds for Swagger.

• Support CRUD OIDC providers through the onboarding portal API (664fd1a):

• Support importing more credentials (#4361) (9a6dadf):

  Adds support to import SAML credentials. SAML connections are only available in Ory Enterprise License / Ory Network.

• Trace identity id in errors (772572c):

• Update only necessary database columns in UpdateVerifiableAddress (#4292) (168a3f6):

  This is an optimization to reduce database load.

  When we specify exactly which columns changed, we should be able to elide updates to the identity_verifiable_addresses_status_via_uq_idx (nid,via,value) index. Updating that index requires contacting remote regions.

  Also fixed a bug where we did not set the verified_at timestamp correctly sometimes.

• Use one transaction for /admin/recovery/code (#4225) (3e87e0c)

• Use stdlib HTTP router in Kratos (acfa6ef):

• Use vendored ory/x (a9ab800):

• Webhook header allowlist configuration option (#4309) (871f5aa), closes #4290:

  Adds a clients.web_hook.header_allowlist configuration option for configuring the webhook header allowlist.

Reverts

• Tests: improve randomness in e2e tests (19a41ec):

• Use account.apple.com for oidc discovery and appleid.apple.com for token verification and signing (c772d8b):

• Use appleid audience for secret exchange (620e33e):

• Use updated appleid issuer (9697c45):

Tests

• Add golangci-lint config and GHA (0720950):

• Don't require DB for hasher tests (41c69db):

• hydra: Add snapshots for login & consent requests (ee39bdb):

• Improve pgxpool tests (6297a8f):

• Resturcture and improve integration tests (6f32d5d):

• Update snapshots (#4167) (b51f780)

Unclassified

• Improve randomness in e2e tests (ecfe435):

• Run credential validation in its own goroutine when changing the password (c7fedfe):

Changelog

• 85aeb5b7de3e8de87d31586ea267fa7b36ce11d9 chore(ci): adjust codecov config (#4234)
• cc014ee5ef91c75f0850faf1a91126f32b09e38c chore(deps): bump @nestjs/common and @openapitools/openapi-generator-cli (#4397)
• 4415b492a5c7ad0615513bbbfb4f600224e4bf39 chore(deps): bump axios and wait-on in /test/e2e (#4334)
• 6d8d8ed28cdf03488502e3687d40c858086408c2 chore(deps): bump axios, @openapitools/openapi-generator-cli and wait-on (#4366)
• f019a1c4cc359cab9ec48ecf64dc33d73cf90fe5 chore(deps): bump cookie and express in /test/e2e/proxy (#4153)
• 43ab7c55b3c7bd9dfddb53222df659a83fb54d83 chore(deps): bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 (#4325)
• 5522d42f1d94b6916a70cdac7f4a1a93465d33f5 chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#4319)
• 7fad5191220380b443c0a2d169942c5d84f52d9a chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#4189)
• 39f0276dbc2eeefaa797c994084d2abc4f16a8b0 chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#4358)
• 5f47ac4d97de168a2ac99bb6f858c595c9eac4a3 chore(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2 (#4357)
• c4423022a8ff0e01e445f42a7d60b243c215fa09 chore(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 (#4337)
• bb5f488283c529a2cff64b154cd0962c5f198694 chore(deps): bump path-to-regexp and express in /test/e2e/proxy (#4238)
• 67a703b660698a20d516cefba8f4dc6a2cb49611 chore(deps): update actions/setup-node action to v6
• c18dc337fd0f4f1e4c519404660ec6574b627940 chore(deps): update actions/upload-artifact action to v5
• 50f1b8f0df8636cea94d1100c1dc68dd8f6bdfc5 chore(deps): update dependency node to v24
• bb5d7e4d3262cbbd68c6338e0c9a5ba92c46a5f9 chore(deps): update hadolint/hadolint-action action to v3.3.0
• 6b92376a63970864546b33d0ed82dbd8e979e8a0 chore(deps): update kratos ci
• 8c43e3b8f6200f97e2dcdd5fb87e4a96360c34cb chore(deps): update oss workflows
• 732f098923a21b7013753495c5f0b96791b38fa0 chore(e2e): stabilize chromatic snapshots
• 6b2b90e53cec467a705875ca30085fc747a7f704 chore(hydra): registry setup refactoring
• 3215ab25b3868af3808cb94256d12c276015b662 chore(kratos): cleanup and improve some tests
• 56525d4ef9f6cd3611501925189f627ca40cef27 chore(kratos): simplify internal APIs
• 456a1477271a9f9bd3484f842e7f400d97699f54 chore: add migration tests in kratos non-oss for crdb
• 0969901779b4ead201d646ea0b1aaf435d02f407 chore: add missing deprecation events for legacy feature flags
• d5229ef8cd60d9a6a6110cab79b85ed79f022348 chore: add pagination secrets for Kratos
• fc68716addf9836b41abfd438f65f112f03172dc chore: add pre-release workflows for oss
• cfa170306ba9730027f23a3d90a6fd0d167f1683 chore: add recovery v2 new fields
• 187f7111316849e76968dc719145b6b4f133d7b0 chore: add utility functions to kratos/request & tests to RemoveDisallowedHe…
• 9871185838333359357ff1aaac8bfb663165d825 chore: additional pop options
• f9640ffb4034f2465f0ed9e53420f7dfa635d42f chore: adjust project automation (#4143)
• eb12772cbe5584ae5415ac63a531662005b812d8 chore: axios update
• 2e84f49ebe4c757424b9af4ee1d24d9ef9361318 chore: bump Go everywhere
• 802b45bd0f09ac6bed1293043afdae8c5fcad184 chore: bump deps
• 2b0acb78bd173386768aaba2cbab45c941431db3 chore: bump go deps
• f49b440d9922f708be8fd56dc01367acce33047d chore: bump go to 1.24.6
• c19b4e58a876e679c799b4ed917a59380d2306a8 chore: bump golang in kratos oss
• d03d37d5c9736adc0893477ada8d52ab661772a8 chore: bump golang.org/x/crypto
• d5cfa898aaf0ae3ce3e1875128131732b824bd2b chore: bump ory/x (#4229)
• bf674d1500e6128d447b0bc18cf2be2d70bc4569 chore: bump ory/x and ristretto (#4340)
• 94558e30cb0c85a0169896ab182b590130a92b2b chore: bump pop to master
• 2ee96b7feeb911ec100fe1524be8a83216dc199c chore: bump sec deps
• 332eaee35e29a79bf31b284070759a8562716166 chore: bump sec deps
• 9c7def89848ca6ecd35f1013bee33ec93830657c chore: cleanup oss workflows
• 9959545cb9d90364e1928fcc4f01b3171e052360 chore: document test migration (#4265)
• cb10bca7ce79de4dd1090f699a4e3e7f2c4d2cf0 chore: fix build for kratos-oss
• 3d0ae8373c1b0649f96d8e14995e26b37e69b6d0 chore: fix kratos linting issues
• a63b7ccc9ff46cb24970818424404a1c8eed90e2 chore: force replacements where expected
• 5ea53faaee79525a1db9679183866b54eea92ac2 chore: format
• 4609ebf86240037338327fee4e3798b0c76afd1d chore: gh actions and node lib updates
• 90f2490d36088665bb95d93e9876604d95568b32 chore: go mod tidy to unblock CI
• c27cbe67bb0e7e2b13d542024e64e3692f180e1a chore: improve migration testdata and assertions
• b26c65259e9233a1168319108355dd2ae68cd92e chore: make tools indirect dependencies (#4345)
• 06364339038b20b8c59793c8a06daf5c88fe5e61 chore: merge ory/x repo
• 3a726a236201fc597eeee3005aebd8cdbee5e755 chore: minor bugs and improvements (#4331)
• aa4229dfd393551c759473168bab404b8c31ee53 chore: more gh actions and npm lib updates
• 05409be352081386a7a9db2e270d77b07f57e926 chore: pin GHA PM action version (#4213)
• 888b42a316a3891418b23ce93aa4e4b972b8216c chore: recovery_code is duplicated in the schema
• 3dd9dec0f640669b9a57e88af8d2f65e2630d4f4 chore: refactor parameter parsing in ListIdentities and disallow combining filters
• 9c337a59b112af1faad6552c986711c103666eda chore: remove asserts on ory.sh
• 9931ea5e9b41b3033fd2d0eaee3e253bf5022df2 chore: remove counting courier messages
• f7f7bb975d8b8adef893357749d398414c7b690a chore: remove fizz migration files (#4343)
• 065e0c3130f9a83d8b5c1fdbf49a51c74df468d0 chore: remove sdk generation action
• 15ac98ec1b0206ecd9d64d5c88fc63fbcced5c63 chore: replace deprecated usages
• 7add07d4ffa88591d13b62618227f0fbdb4ace9f chore: revert external_id feature
• 67cb3642ba609aa968a514b5edaddb88b5c9d268 chore: run go mod tidy during internal SDK generation (#4344)
• 60a8c5bac1203573dc30831157053d5d18a0679b chore: run oss cypress tests on custom runners
• 286d87476a7f74b34eec27f2de3069678e96ccbe chore: shared serve config
• 9e94951d9eb784cd3accc81b082bed316cef57a0 chore: simplify service and option loading
• 4a07685e095034683c7bf8bf18dec784ac8e8109 chore: split network/enterprise SQL migrations in kratos
• 22887ef3985e56f1b57263cbaafe689b572030c7 chore: stabilize order of recovery addresses
• 629d8675cd4838d23cbb67978344208a960cbf02 chore: synchronize workspaces (#4140)
• 1642866e2dc984051c7d21607ae3082f6ca1c1aa chore: template migration command help
• ddcc58c37357ef6515e96820648bec95844a4be1 chore: tracing in errors
• a56c3c07d1738fb822e29bbe10a8b3065afb91ae chore: un-revert external_id feature
• 61a649d94befc8d43d6078c373ec24c9f30faeef chore: update OSS readme
• 73d287e5b9a050beb01be3e06903c66c3d48e555 chore: update codeowners (#4256)
• ef2dc191ec91718c00a7f9fc3a379261ac73e39e chore: update copybara rules
• 0ebf2ac0cd72cfd875029f1ca802c3899bc46709 chore: update copybara transformation
• 0bce294f78367cdcde07945f1fb67acb2e92d622 chore: update docs on ListIdentities (#4248)
• a7b80291ad75a1d518cf4410f2e656f65083e1ba chore: update error event name (#4375)
• edab00dbc988a68d08ba4bb53550809a5c9b8a36 chore: update gha in oss
• ab6d023cf110799c26c6140c1e8a73406064a4ab chore: update github actions
• 2515129312d9bd29c89d40d536151a43cef51ec9 chore: update github actions
• bd698b7b68b3104416f996e38e962ac5714af22b chore: update kratos goreleaser config
• 5badf8be0b557fe10b49db1aeea58f2e0cbff16b chore: update opencontainers/runc to v1.3.3
• 6a7a20388c094f86bf128bf208710f99b7d2de4a chore: update ory/x version to get the jsonnet runtime limits
• 964f5245c07445eba08f413123de933e6f398d35 chore: update oss release workflows
• c4b3dd6a35953dcba9ce2d74bce190d5c42a3793 chore: update repository templates to https://github.com/ory/meta/commit/000f213efcd4e98ac3462086c47de58005c4b697
• 8cbb5bd91540145a8de79e1c8f07457fdf512bd5 chore: update repository templates to https://github.com/ory/meta/commit/1af2225678e6ed0f1947b17a07626774bff38667
• 7578f00f925b853c5012f8d55e2eba592ebc23bf chore: update repository templates to https://github.com/ory/meta/commit/44efd83ab7aab755d07b60db9049091bd8ad2533
• 555c997f95ea1982dfdb6042658a4f3e7c24d420 chore: update repository templates to https://github.com/ory/meta/commit/6dd58197127fcc22f1602fe2481e65e3fb356441
• 2a4b8c77f16caa8e5dbc13aede1558e3d7057cf8 chore: update repository templates to https://github.com/ory/meta/commit/7ba40649aea8bbadc478c01f97ff6231fb492fb8
• 73045728036eaeb8c6a527c332f7c8af2ead3a30 chore: update repository templates to https://github.com/ory/meta/commit/83e71e6e97a5eab38bede33eceef40d550d1fe6e
• d4f96ceedb07581075c60380c0586894dbed7392 chore: update repository templates to https://github.com/ory/meta/commit/b1eed8856cd301603956084d58f021707ace940a
• 924fa61726471c0effad4257b9c84adf283a5c97 chore: update repository templates to https://github.com/ory/meta/commit/bc603a639a8b300ffed3cf80197d3839969d7ef9
• 1faf7cc4ebf4ce43d4b018d0be6bbc877f014602 chore: update repository templates to https://github.com/ory/meta/commit/c091d7964885eaf0458fca234bf3521ffc4bc43b
• 898fcb4b08016465c80186757a1e42f8348dea69 chore: update repository templates to https://github.com/ory/meta/commit/cb2a20fceb295da97a8988e4947a3555b3f026a8
• 38641c87e54e0a87e9121bb56a45a0b45b91b194 chore: update repository templates to https://github.com/ory/meta/commit/cbb120bd7c046b6af46b2148f5cfc1b3d03a1dd2
• c80dd80768ad92d4485269d1eb52a03bfc4fd1f7 chore: update repository templates to https://github.com/ory/meta/commit/d919e6f6e8c850524513abd42478dea7987b99c0
• 3622cd5f588721fa84eb138079347f40e480b946 chore: update repository templates to https://github.com/ory/meta/commit/e54ac5d59869341cc3ffb2e58fd8b0cba28ec7f7
• dc46e8dd91c21c97db95f425438b1230014a4130 chore: update repository templates to https://github.com/ory/meta/commit/fc1b4d66bcc436d1caa7b16777e093b1eca63cde
• 15f3eb3aa25c92e3d1e025082226f26d2ab58718 chore: update sdks and openapi spec
• 39047959bd3075b0f5a74a4ae80cac662909f181 chore: upgrade Cypress
• b42b42aa7760752a73b7e2263318d263312505f4 chore: upgrade crdb to v25.2 everywhere & deflake CI!
• 25429fa15268eacebf8a14139035bbc8f8b7661f chore: upgrade lib phone numbers to v1.4.1 (#4250)
• fee7cae56857983de8edfd001f5924780fc8864a chore: upgrade playwright (#4255)
• 66edaddf59508dd4afc01af699a1f0f990c87079 chore: upgrade sdk generator (#4327)
• bdb046da36c290f775ad4cabdbe6191295252cc7 chore: upgrade to go 1.24 (#4313)
• c829295c194f671c3e9c50743123c129aa8a70b6 chore: use dedicated ory fork of pop
• 25f17e7a9a9c8ae466043fb4642ae58683fa0adb ci: fix rate-limit trivy issue (#4184)
• 3d112f879458a8981d2dcf3c290927dcc3253823 ci: improve codecov config (#4339)
• 935070182827808d7acf5ceab451596620213bc8 ci: resolve test fixture issues (#4411)
• 405f2f0de6f9b175fd60595a97ef1ee584df445c docs(kratos): better identity handler description
• b22135fa05d7fb47dfeaccd7cdc183d16921a7ac docs: add return_to query parameter to OAS Verification Flow for Native Apps (#4086)
• a90df5852ba96704863cc576edcb8286eaa9b3f9 docs: clarify facebook graph API versioning (#4208)
• b388a4ab9fe101def70ca604fbfbef2bcccd01a9 docs: defining oid as oidc subject_source (#4270)
• 0062d45b6c9a6323f9dccb10f63dce752836c29e docs: improve SecurityError error message for ory elements local (#4205)
• f076fe4e1487f67f355eaa7f238090abf3796578 docs: remove unused SMS config from schema (#4212)
• cb71e38147d21f73e9bd1e081dc3443abb63353e docs: usage of organization parameter in native self-service flows (#4176)
• dfed493184c64d6eee061577549caf7501d017ad feat(changelog): add CourierMessageAbandoned & CourierMessageDispatched events
• d68736bed28e956e52a54fef5591bd4c88de6594 feat(changelog): add a new feature flag for the Recovery V2 to ensure backwards-compatibility
• 0c80f61ccafc24e5bb1a497e652edfc8e951431a feat(changelog): find-by and delete SAML credentials
• 48f5adb9ce720f6906283372515b85f365a7f0b5 feat(changelog): migrate http router to stdlib router
• a7f50abc99ddd7b6dac7dea09004feeb8e84c323 feat(changelog): reject new password same as old password when changing the password
• 53f4b9f943495ad265e4f0d87cbb018032f068a3 feat(changelog-oel): choose identity schema in self-service registration and login flows
• ce1bf9f46810553ffd8e7ff8aff4abc44e4ce1f0 feat(changelog-oel): improved tracing and metrics for the high-performance SQL connection pool
• 910cf9c0a220f310e08c35701fb721faeb8fb685 feat(hydra): split up persister
• fb8856eb11a3762ffb69dc2639b36d91121b4476 feat: add HTML email support to HTTP channel (#4387)
• 6cb3e9941b5e7e2c5127779adf2d63be7ae58609 feat: add Login with Amazon
• 7032fec71a01bfd0838310dd2b2d8ea4b9fcee63 feat: add LoginStarted and RegistrationStarted events (#4404)
• e2f878a3ed25b4617bf6bd43b6e147d87d3b8ca2 feat: add a policy callback to customize OIDC credential linking (#4302)
• 0e68c7ef0b31d1140483748059cbae707d508767 feat: add a project revision field to set the maximum number of code submits
• eb9d9342effb5ed2cbb670c829eedf8f414e06c9 feat: add ability to send recovery code via sms
• edb9e0c2fd37f7d571f19088aab324f6cfb01c08 feat: add allowed domains configuration for captcha
• 00da05da9f77bbfb68b364b3ba2a5d0a2d9e4f15 feat: add attributes to webhook events for better debugging (#4206)
• eca4ae9dcce37d03bbd1bf5f0cd492466c02acde feat: add captcha group to first-step registration
• 261596b7261c315b7d8291e886023c34fc9135c5 feat: add context param to policy (#4315)
• 1c33c39875c5c766f3fc18578e036156d6214ade feat: add email domain matcher (#4373)
• 2aabe12e5329acc807c495445999e5591bdf982b feat: add explicit config flag for secure cookies (#4180)
• 335a1e844a7e239d32f6f8738f8b34816f892956 feat: add external ID to identities
• afa76180e77df0ee0f96eef3b3f2b2d3fe08a33d feat: add failure reason to events (#4203)
• e6fa520058ca778e01d4e93a8ab4b31a74dd2e11 feat: add migrate sql up|down|status (#4228)
• 235af527dea47b87ad0f18ff04f9b807e4639ae3 feat: add new Division ui node attributes
• f7fa792a52af5bddbd2869fc4bc0383c73641dfb feat: add new endpoint to tokenize JWT with a webhook
• 77beb4de5209cee0bea4b63dfec21d656cf64473 feat: add oid as subject source for microsoft (#4171)
• 1b57fdf375e218ff1cb13fa4888ee01bbb2a986c feat: add session in settings after hook
• 729effd61e4b08f28099bba09acef87aeb0c7ffd feat: add support for Line v2.1 OIDC provider (#4240)
• f2212d48af47f24ca6e504ca98bc31afe6774241 feat: allow deleting password credentials (#4304)
• 7bec935c33b9adb6033aaecfa9a6dbe6c9c3daa1 feat: allow extra go migrations in persister (#4183)
• b4c453b0472f67d0a52b345691f66aa48777a897 feat: allow listing identities by organization ID (#4115)
• bccd2fb8c8efac96938e564f1f34cd711b41d0a1 feat: allow setting the org ID on creation (#4306)
• b8bf4c7ca4323adfa936cf2e24fc98e34123150a feat: autoconfigure kratos-changefeed
• d76e70f275846e598c601b63fc337e5ceefa8f81 feat: bump CRDB, establish foreign key,
• 30485c44e61c17231e0c46b321be842b19ea5a5f feat: cache OIDC providers (#4222)
• 1145cda7ce2a7b7b30d78f936d005edaf5060fc3 feat: console UI for multiple identity schemas
• c5cb85eabee29fe32b7b2ed4acae7308c41cb245 feat: custom page token column extraction
• 93345d7b9f2b302e3b35041191c44f85a6ea0973 feat: domain telemetry improvements
• 1008639428a6b72e0aa47bd13fe9c1d120aafb6e feat: drop unused indices post index migration (#4201)
• a7cdc3a6911e265f4e78c780d8e4b8922066875c feat: emit admin recovery code event (#4230)
• 8caebdb6eb67c2039251b53804aac6a9f166f578 feat: emit event on Jsonnet claims mapping error (#4394)
• 959ded5c8bb17b12b2bf242e959802a56f7c43e0 feat: emit events on jsonnet failure when templating a jwt (#4409)
• b4485f411651713a673b11e6984a3e467bd75e51 feat: emit oryWebAuthnInitialized event once webauthn is initialized
• b1628976a0251a0ad84fd2128d1df23f4dff5e99 feat: enable JSONNet templating for password migration hook (#4390)
• f2b0cd5a5669e9116d248d1a43a875e5a38d723c feat: expose Ory-Error-Id HTTP header
• eeb13552118504f17b48f2c7e002e777f5ee73f4 feat: fast add credential type lookups (#4177)
• 4c2cfaefc777c38fee35d529156629f148b6da85 feat: faster UpdateIdentity
• 2c5bb21224e28d5218354349f77514f4fbe71762 feat: fewer DB loads when linking credentials, add tracing
• db10a68529088b7e45489e8ad463661cbdcffbff feat: goreleaser
• 39057879821b387b49f5d4f7cb19b9e02ec924a7 feat: gracefully handle failing password rehashing during login (#4235)
• ca0d6a7ea717495429b8bac7fd843ac69c1ebf16 feat: improve QueryForCredentials (#4181)
• 86ab72ac7850b84e4608774a4fb98e4bd1d46ca0 feat: improve domain telemetry for OSS (Hydra & Kratos)
• e38e812314850c80cb18f8e1921dffc7d324aeda feat: improve identity import limits (#4378)
• c50ffcc5cb2210a79953f38af2f99d46f013c780 feat: improve kratos courier metrics and debug log message
• 825aec208d966b54df9eeac6643e6d8129cf2253 feat: improve secondary indices for self service tables (#4179)
• 2014a403e0bc05a10d1f805b9ef81bdd4d8e2223 feat: improve verification required flows (#4407)
• e47b85851539345abc70468eb8d05db882e19df6 feat: improved events and identity recent activity
• 85a7071d20d0f072316c74bee82c76ee690276f8 feat: improved tracing for courier
• c703a338894f865c7dc1dcebc6e6980ad98eaa1d feat: index hint for CRDB when deleting identity credentials (#4276)
• f18d1b24539f7d8dcf9c27986af861d0f8cb9683 feat: jackson provider (#4242)
• 234b6f2f6435c62b7e161c032b888c4e2b3328d4 feat: load session only once when middleware is used (#4187)
• 31f18944116f6fde546fdd5139faf7e9b68a4c10 feat: monorepo
• 373a2e6552f0da0488638306a58d8bd63a6ca10a feat: more extension points (#4272)
• 8d43aae7bc6c003287b03e6f8900a536fd13dcef feat: move config testhelpers to ory/x
• 53874c1753940e08e0bf50753a1d3126add77af1 feat: optimize identity-related secondary indices (#4182)
• 462cea91448a00a0db21e20c2c347bf74957dc8f feat: passwordless SMS and expiry notice in code / link templates (#4104)
• 71844dd75fed5c60d29399dc3595ccafcc5f0809 feat: recovery with any address including with a code via SMS
• 7fe55d9fec5e5f4048b211eaa56ac61e29635157 feat: refactor cmd/daemon (#4371)
• c33965e5735ead3acddac87ef84c3a730874f9ab feat: remove duplicate queries during settings flow and use better index hint for credentials lookup (#4193)
• b2948044de4eee1841110162fe874055182bd2d2 feat: remove more unused indices (#4186)
• 8c7a3dc5eb7e863b7a710cc9256a12e6125e359d feat: return field name in generated node text label
• 4ca4d79cff5185caad27eddee7e6f8d0e58463ba feat: rework the OTP code submit count mechanism (#4251)
• 664fd1a48d822f29b1ee2164818c560df63b29e2 feat: support CRUD OIDC providers through the onboarding portal API
• a82d288014411ae4eb82c718bfe825ca55b4fab0 feat: support android webauthn origins (#4155)
• 9a6dadfefaf0d54c227cdbab5a2cbe7da14faa96 feat: support importing more credentials (#4361)
• 772572c0d633d5848f12d41947d52df1d391329b feat: trace identity id in errors
• 168a3f6c68b1fbc0ddcd455f8762f6de19879442 feat: update only necessary database columns in UpdateVerifiableAddress (#4292)
• 3e87e0c4559736f9476eba943bac8d67cde91aad feat: use one transaction for /admin/recovery/code (#4225)
• acfa6ef2ec4aa61f9a1a7da6fdda59609f1360e3 feat: use stdlib HTTP router in Kratos
• a9ab800a4373875a29c58492f174165e0b4592e7 feat: use vendored ory/x
• 871f5aab6d7b2a655ebcd6f0f90e79635ffc85f6 feat: webhook header allowlist configuration option (#4309)
• ae80380d39a9f534f1e14160390807b5a7eb437a fix(deps): update go-x
• a6ac1432b136d6a715c9c93af5a169a212c87251 fix(hydra): instrument metrics also on public endpoints
• da4ea079f77bb2d1d4458c643437d0ec79e46a5a fix(hydra): use prometheus metrics instead of SQA metrics
• 639f7654a2a443533b0881e7faede4f768502e4a fix(kratos): do not explicitly pass identity schema on step-up login
• 241111b21f5d96b26ff8bc8106dc8a527c68063b fix(sdk): add missing captcha group (#4254)
• 4127cbb35ca3b7b1ea9d0f8c61d2aa56af57ce9a fix(sdk): add missing enum type to autocomplete (#4396)
• 88c68aa07281a638c9897e76d300d1095b17601d fix(sdk): remove incorrect attributes (#4163)
• c3f4ecf2562ffe400e500da97a93327b6115ddb6 fix: IdentityCreated is over-reporting on error inserts (#4323)
• e13687ad51cdb889f0e680a005145a0134086fc7 fix: accept login challenge in session_issuer on SPA flows (#4288)
• 7ca3b6be14c53e16c3a8f4e7eb83efe0b0e7c88e fix: accept login_challenge in SPA verification flows (#4284)
• 8e29b68a595d2ef18e48c2a01072335cefa36d86 fix: account linking should only happen after 2fa when required (#4174)
• 4a870a678dd3676abda7afc9803399dec4411b05 fix: account linking with 2FA (#4188)
• 292f65d6bd1bc70b2f13b92bdbcb8e30256e0a17 fix: add default issuer URL for LINE (#4415)
• a313dd6ba6d823deb40f14c738e3b609dbaad56c fix: add exists clause (#4191)
• e1f29c2d3524f9444ec067c52d2c9f1d44fa6539 fix: add missing autocomplete attributes to identifier_first strategy (#4215)
• f441f41312b81a570e99348f69b88008f4516660 fix: add missing csrf_token (#4363)
• c10bb06bb9125fbc71863c5aa82194da2f2e2888 fix: add missing discriminator (#4365)
• 44eb305cf91672798f7d57550a026c6b970f7566 fix: add missing saml group (#4268)
• 106163d15e2eb84c3403d0ce8f829a9d9b3ce94f fix: add missing submit group (#4354)
• a043b43ceb5e7e1ce4fd1ef25f4ba8db72d7b478 fix: add missing values to the session method enum
• 9bc83a410b8de9d649b6393f136889dd14098b0d fix: add resend node to after registration verification flow (#4260)
• 245f5dc1c83d35d7e228a45ee267d6bcdb705e98 fix: add transient payload to fedcm (#4369)
• aefa80623ee942254653b03ef4b273ae2779af0e fix: allow patching some /credentials sub-paths (#4277)
• 7c6372794a94868555f647f6160be8205072c506 fix: also update identifiers (#4321)
• 8a220c04365a30f9a4b939de7db6f21fd9ead230 fix: another apple fix
• ec3ecc562a4d6ab511e53210d14c143903176b8c fix: apply strategy filters in identifier first as well (#4352)
• ff5fa9be2b7c864324c187639997476559d017ea fix: better tracing in proxy HTTP
• d9f6f75b6a43aad996f6390f73616a2cf596c6e4 fix: cancel conditional passkey before trying again (#4247)
• 44f97b85e36160b8cce272fd61fbe3ac7d810fbf fix: check aal on sessions list endpoint (#4305)
• 2a44fd55d741de50f93ff186e014904472a41e73 fix: clarify import responses
• 79f4e2ab44deecdb8a400d5d43e65eab7e9400ed fix: context passing and missing body close
• b3af828d3b460a7d22d30b8d95849911b7c7b80e fix: copybara script
• dc992d33d270d6ad284d9e604c00ab4c218d7dde fix: correctly handle HTTP route patterns in metrics
• 9860c9a4faa5bd5d725c742c4d4ce9473baa0963 fix: count MFA addresses in CountActiveMultiFactorCredentials for code method
• a0004605f6c23d7dcd246ed43f0beb89a772732e fix: deduplicate down migrations
• 7d0d7f6069d9a415dfb642b129ff6a38630ad781 fix: detect whether external_id is set in webhook response
• ef9ee235866c6f3958574d2e98f09de3ca1e83af fix: div decoding (#4362)
• 82660f04e2f33d0aa86fccee42c90773a901d400 fix: do not roll back transaction on partial identity insert error (#4211)
• 97848c7cd7f37117503754c2d08f7ac9db2240e5 fix: don't remove OIDC buttons if invalid identifier is submitted
• b95fd3fa723521807824cad84e4a9ce812172311 fix: don't show oidc subject in login hints (#4264)
• 6bbf91593a37e4973a86f610290ebab44df8dc81 fix: duplicate autocomplete trigger
• 0c48ad12b978bf58b6bc68b0684a7879f93ebf06 fix: enable b2b_sso hook in more places (#4168)
• 327c5a44f6d646fc6e318a50154c0e3bb4574557 fix: ensure make quickstart-dev works without options (#4401)
• 5cae1f7af0d190ae65967c92e7b6cdab43ea81ea fix: ensure authentication method is added to session after linking OIDC provider
• e9c6a1803daa622e559d0b8904cde4dc8834f1e2 fix: ensure context is not canceled during password hashing (#4364)
• a4fd8acbbbd0cd0ff054e0f8737b076745aa71c8 fix: ensure that auto_link_credentials markers are being properly overwritten (#4320)
• b629ca79df83f67fa47194e5850bda3bdafa69f4 fix: escape IPv6 regex string
• 98b7acd7f3888acba45439a78f5428575c08900d fix: exclude nothing in copybara
• 68500d14509a2697d2832eafafa5608fd8cfbf47 fix: exclude orgs (#4351)
• 66afac173dc08b1d6666b107cf7050a2b0b27774 fix: explicity set updated_at field when updating identity (#4131)
• 26518b69894c0dd1fe077b78936f3d54733616b1 fix: failing CI in OSS repos
• f1cfc3684278416b869248c0eb4b56a7b82204a9 fix: fix back button for recovery flow not showing in AX v1/v2
• 98f9897aeb636f7573334b45d99cab685defa856 fix: fix nil dereference & lint warnings
• f9ffaaeac6d24c2ca177359d0c7ce9fc5bbbf282 fix: fixed typo in description of api
• 93d364c8e0b892ff2d61dd0c0a6cec7d2e2fc310 fix: force SQL operator precedence in pagination v2 to ensure nid isolation
• f475aea476fee5c7cbde74b695a3f080a585b868 fix: force profile to be first hydrator in profile_first strategy (#4380)
• 3dbeb64b3f99a3aeba5f7126c301b72fda4c3e3c fix: gracefully handle unused index (#4196)
• cf53971654e37cfe86572b78f919b4e26cf75f42 fix: identity queries
• b60edba1f4642f07b411271b6c7a442665dc2a74 fix: ignore CSRF on all apple provider callback URLs (#4291)
• 41b342c9b1c5cea65844ec462a0af3e486de6add fix: ignore non SQL files when applying migrations
• e8170fcacaa9d8c3decdd768a40e1f9f4388a142 fix: implicit transactions for cockroach v23.5 and simplified migration logic
• 687d5787b12450895ba613ceee47da408917a0a7 fix: improve linking on OIDC signup (#4314)
• 7c0d9c6ddc4691b24de541f09fd503765296c846 fix: include go.mod in vendored oryx
• f8ee40396a36a2e7a348c9cf983dec7db13814c5 fix: incorrect if switch in previous sceen case in two step registration
• 7d0e78a4f6631b0662beee3b8e9dd0d774b875ea fix: incorrect query plan (#4218)
• ed4fba3efd1e1c88a4920216a515e9820b74eb93 fix: incorrect response code on account linking (#4336)
• f3a3292b8e1451d396b8b92ce598995266a1aa99 fix: jsonx.ApplyJSONPatch
• 335acd469e9276133be12cca07239a64596ddf8f fix: login otp sent message
• 6f5e79a57181dfb6478b1406f784096e76dfaf2e fix: make RecoveryAddress.ID optional to prevent errors
• cfd213a6301c904453f1b56a3d20c59c2cebdd67 fix: make external_id settable through webhook
• bf2b34d23ef820fa12f49f2dd37d7965fef48ed6 fix: make external_id settable through webhook
• d7d3ba4fa7f451aaef40924688fe5fda38310f5d fix: make node_type stricter per uiNodeAttributes type
• 57d86d2376ab102f97559c1d007a79c8a17723ee fix: migration problems
• b6278af5c7ed7fb845a71ad0e64f8b87402a8f4b fix: order-by clause and span names (#4200)
• 4ac612223d06e84560775e1b1cffd8cf299c9cd0 fix: otlp sampling rate default
• 7e0b500aada9c1931c759a43db7360e85afb57e3 fix: pass on correct context during verification (#4151)
• 5ee54eda909638fa10c543f156042a217b34cba6 fix: preview_credentials_identifier_similar (#4246)
• 3c84b7aac70d9bc889e16855dcc28b59b6d8480b fix: print correct content of down migrations
• 5bd3b52e2848133a380673853722e4eb55745ac0 fix: quick typo fix for kratos-oss test script run
• 18056a0f1cfdf42769e5a974b2526ccf5c608cc2 fix: registration post persist hooks should not be cancelable (#4148)
• 7dc28eb76528f34239852cdce7b8dfd1e6e482c0 fix: reject invalid migration names
• 2cc2b69e59d42bdb0136bed109c99f167685062c fix: remove duplicate address verification
• db8a94ef538cfe0f1fc08bf5366643222a7bedfc fix: remove selfservice.methods.link.config.base_url
• d9e3295d98b0446a90a960d0f0e957e7a6513dfc fix: rename b2b_sso hook (#4349)
• dd589fa4432b4b570885e35c9e96bfd06a494c7e fix: return 404 on schema file not exists
• 119841a304917e222d8c0fd4606419a520f481c1 fix: return return_to code if already authenticated (#4286)
• 8379db8fc8085b0d2ecc6bd4d803ada9fcf49e80 fix: revert "fix: otlp sampling rate default (#9055)"
• 105018d2fa51ac99748b11924735bac0ed55c391 fix: routes in AX with identity_schema
• 306316fedf20467059776c003f8285880d272c95 fix: schema key (#4332)
• 7f5040080578e194dde3605dbb1a344fe9ff27ae fix: send correct verification status in post-recovery hook (#4224)
• 07cb83c672326848162998a9cfbc8ca34af42bf0 fix: set correct request url in acc linking and oidc flows (#4282)
• 6fb39e2e0f62aeec249378e7bf4cf3c8981c02df fix: set default for CYPRESS_OPTS
• 6e30865e1314bc4c4fdc3b472b34c92019eadfa4 fix: settings linking error override (#4368)
• 905d1e5dc8fcdc7f96afa14a5ee036060ea43056 fix: show code email in most error states (#4338)
• 5b00fe15d94c5169fd62809ef44ffd8102078297 fix: show_verification_ui in continue_with only if configured (#4402)
• dbae98a26b8e2a3328d8510745ddb58c18b7ad3d fix: span names (#4232)
• 906f6c8fdf9ec0834993a44f8a19697b38dd63d2 fix: stricter JSON patch checking for PATCH identities (#4263)
• c433c44aa121a6011309eaec115370f266a4a2a6 fix: support show_verification_hook in settings hooks (#4410)
• 03321433376e4e3f240a93f9792453b7cbb894e2 fix: tests for Kratos OSS Cypress
• 332873ddbd34a375dcff736b9823149f5e0d5ed0 fix: throw upstream error on OIDC issues
• 2f8aaee0716835caaba0dff9b6cc457c2cdff5d4 fix: truncate updated at (#4149)
• 13ebb69d41a77c964da3a96c2d56f48092fd5edc fix: upgrade to go 1.24.4 to fix CVE-2025-4673
• 38f8b36ff474604f5011217b44fbe3ee5fccf1ba fix: use appleid audience for secret exchange
• 928c9f885ef0fc055420e711ef69509519802276 fix: use batch insert to speed up project changes
• e6d2d4d0c04e60ab5b0658b9e5c4c52104446368 fix: use context for readiness probes (#4219)
• dc8b32e0049e842d7aca27a38bf73c8cefb9cae3 fix: use default group for signup nodes in oidc (#4414)
• 6776835a7f3c6dcc9a0149a3bd8a86f664cb85d4 fix: use git hash to render ory x schema references
• 29eeb5605f03074de5bba1d7e18e987d30830fb2 fix: use hard-coded fallback key instead of panic
• 49e472c12699d6ae2deb8643c62d005a0cc793e0 fix: use non-alerting errors for errors not needing alerts
• 76afd6dc6fcd33969071fa96d04e523d3ed8c6af fix: use updated appleid issuer
• c7fedfe21f2e95f89b54ced34bf9b49bd5f64fb9 performance: run credential validation in its own goroutine when changing the password
• 53a5a8b93cec274456df3d988eb3bd12bc11fa87 refactor: hash comparator instantiation (#4195)
• 85bf18df5d3ca4710f9376f78591a2069dbf1239 refactor: move database meta functions to root x folder for reusability
• e24f993ea4236bac4e23bd4250c11b5932040fd9 refactor: remove total count from listSessions and improve secondary indices (#4173)
• f46aed12a244094e9e3e4014792543d6fb1a2a4b refactor: two-step registration (#4348)
• 19a41ecd505e1a78dcbefb8c1f264268adfd4415 revert: tests: improve randomness in e2e tests
• c772d8b87b1e13e761a2f64f545607c70b330b55 revert: use account.apple.com for oidc discovery and appleid.apple.com for token verification and signing
• 620e33e11343b84f80cc1e83ec585fcc375bd65b revert: use appleid audience for secret exchange
• 9697c453933a3ca33e35a8fbd2c59908603db28b revert: use updated appleid issuer
• ee39bdb5bd337dade757ed9f6ac33dd07bd76c35 test(hydra): add snapshots for login & consent requests
• 0720950361ffa44deb7078c6c842a2d9b49540c0 test: add golangci-lint config and GHA
• 41c69db6b2b44cdc8d3a72d3fb5c459bf96c1358 test: don't require DB for hasher tests
• 6297a8fc22cdb9c9a9301cfbba4496160d2b4aa5 test: improve pgxpool tests
• 6f32d5d623882e3e742c305f0eddd81156283173 test: resturcture and improve integration tests
• b51f780b7e4abc79a757ac1efe1cb65b3d35c8a4 test: update snapshots (#4167)
• ecfe43591d6a9e476e22d4a3872d393f8b7179d0 tests: improve randomness in e2e tests

Artifacts can be verified with cosign using this public key.