Add default issuer URL for LINE (#4415) (292f65d):

Fixed+expanded relevant comment.

Fixed some tracing issues.

Added error info and missing res.Body.Close() in courier.

Add exists clause (#4191) (a313dd6)

Add missing autocomplete attributes to identifier_first strategy (#4215) (e1f29c2)

Add missing csrf_token (#4363) (f441f41)

Add missing discriminator (#4365) (c10bb06)

Add missing saml group (#4268) (44eb305)

Add missing submit group (#4354) (106163d)

Add missing values to the session method enum (a043b43):

Add resend node to after registration verification flow (#4260) (9bc83a4)

Add transient payload to fedcm (#4369) (245f5dc), closes #1234 #1234:

Allow patching some /credentials sub-paths (#4277) (aefa806), closes #1234 #1234:

Also update identifiers (#4321) (7c63727):

This fixes a bug where when an identity is merged into another, the identifier of the original identity was not updated.

Another apple fix (8a220c0):

Apply strategy filters in identifier first as well (#4352) (ec3ecc5)

Better tracing in proxy HTTP (ff5fa9b):

Cancel conditional passkey before trying again (#4247) (d9f6f75)

Check aal on sessions list endpoint (#4305) (44f97b8), closes #3671:

The session check to list a user's own sessions now requires the same AAL level as the whoami check.

Clarify import responses (2a44fd5):

Context passing and missing body close (79f4e2a):

Copybara script (b3af828):

Correctly handle HTTP route patterns in metrics (dc992d3):

Count MFA addresses in CountActiveMultiFactorCredentials for code method (9860c9a), closes ory/network#409

Deduplicate down migrations (a000460):

deps: Update go-x (ae80380):

Detect whether external_id is set in webhook response (7d0d7f6):

Div decoding (#4362) (ef9ee23)

Do not roll back transaction on partial identity insert error (#4211) (82660f0)

Don't remove OIDC buttons if invalid identifier is submitted (97848c7):

Don't show oidc subject in login hints (#4264) (b95fd3f)

Duplicate autocomplete trigger (6bbf915)

Enable b2b_sso hook in more places (#4168) (0c48ad1):

fix: allow b2b_sso hook in more places

Ensure make quickstart-dev works without options (#4401) (327c5a4):

make quickstart-dev uses the make variable QUICKSTART_OPTIONS which is set to "" by default. This will result in two double quotes ("") in the final shell command e.g. docker-compose "" up when the variable is not set on the make command line, which fails at the shell level. The fix is to leave the variable empty by default. No semantic changes.

Ensure authentication method is added to session after linking OIDC provider (5cae1f7):

Ensure context is not canceled during password hashing (#4364) (e9c6a18):

Especially during large imports of plaintext passwords there can be a lot of useless hashing, even after the request timed out or got canceled.

Ensure that auto_link_credentials markers are being properly overwritten (#4320) (a4fd8ac), closes #1234 #1234:

Escape IPv6 regex string (b629ca7):

Exclude nothing in copybara (98b7acd):

Exclude orgs (#4351) (68500d1)

Explicity set updated_at field when updating identity (#4131) (66afac1)

Failing CI in OSS repos (26518b6):

Fix back button for recovery flow not showing in AX v1/v2 (f1cfc36):

Fix nil dereference & lint warnings (98f9897):

Fixed typo in description of api (f9ffaae):

Force profile to be first hydrator in profile_first strategy (#4380) (f475aea)

Force SQL operator precedence in pagination v2 to ensure nid isolation (93d364c):

Gracefully handle unused index (#4196) (3dbeb64)

hydra: Instrument metrics also on public endpoints (a6ac143):

hydra: Use prometheus metrics instead of SQA metrics (da4ea07):

Identity queries (cf53971):

IdentityCreated is over-reporting on error inserts (#4323) (c3f4ecf):

defer was the incorrect code path here, as we should only record identity created if the transaction did not error (aka was rolled back).

Ignore CSRF on all apple provider callback URLs (#4291) (b60edba)

Ignore non SQL files when applying migrations (41b342c):

Implicit transactions for cockroach v23.5 and simplified migration logic (e8170fc):

Improve linking on OIDC signup (#4314) (687d578), closes #1234 #1234:

Include go.mod in vendored oryx (7c0d9c6):

Incorrect if switch in previous sceen case in two step registration (f8ee403), closes #374

Incorrect query plan (#4218) (7d0e78a)

Incorrect response code on account linking (#4336) (ed4fba3)

Jsonx.ApplyJSONPatch (f3a3292):

kratos: Do not explicitly pass identity schema on step-up login (639f765):

Login otp sent message (335acd4):

Make external_id settable through webhook (cfd213a):

Make external_id settable through webhook (bf2b34d):

Make node_type stricter per uiNodeAttributes type (d7d3ba4):

Make RecoveryAddress.ID optional to prevent errors (6f5e79a):

Migration problems (57d86d2):

Order-by clause and span names (#4200) (b6278af)

Otlp sampling rate default (4ac6122):

Pass on correct context during verification (#4151) (7e0b500)

Preview_credentials_identifier_similar (#4246) (5ee54ed)

Print correct content of down migrations (3c84b7a):

Quick typo fix for kratos-oss test script run (5bd3b52):

Registration post persist hooks should not be cancelable (#4148) (18056a0)

Reject invalid migration names (7dc28eb):

Remove duplicate address verification (2cc2b69):

Remove selfservice.methods.link.config.base_url (db8a94e):

Rename b2b_sso hook (#4349) (d9e3295)

Return return_to code if already authenticated (#4286) (119841a):

This fixes a bug in native OIDC login and registration flows, where the user already has a session in the browser the flow is continued with (usually a web view, but depending on the platform it already has a session cookie set). In the callback, we now correctly handle the case in alreadyAuthenticated to return the session token exchange code.

Return 404 on schema file not exists (dd589fa):

Revert "fix: otlp sampling rate default (#9055)" (8379db8):

Routes in AX with identity_schema (105018d):

Schema key (#4332) (306316f)

sdk: Add missing captcha group (#4254) (241111b)

sdk: Add missing enum type to autocomplete (#4396) (4127cbb):

sdk: Remove incorrect attributes (#4163) (88c68aa)

Send correct verification status in post-recovery hook (#4224) (7f50400):

The verification status is now correctly being transported when executing a recovery hook.

Set correct request url in acc linking and oidc flows (#4282) (07cb83c)

Set default for CYPRESS_OPTS (6fb39e2):

Settings linking error override (#4368) (6e30865)

Show code email in most error states (#4338) (905d1e5)

Show_verification_ui in continue_with only if configured (#4402) (5b00fe1):

This patch modifies the self-service registration flow so that the show_verification_ui continue_with element is only returned when the relevant post‑registration hook is defined (or when legacy behavior is enabled via configuration). It also adds a new attribute key and internal context handling for the registration flow and updates related tests and API signatures.

Span names (#4232) (dbae98a)

Stricter JSON patch checking for PATCH identities (#4263) (906f6c8)

Support show_verification_hook in settings hooks (#4410) (c433c44)

Tests for Kratos OSS Cypress (0332143):

Throw upstream error on OIDC issues (332873d):

Truncate updated at (#4149) (2f8aaee)

Upgrade to go 1.24.4 to fix CVE-2025-4673 (13ebb69):

Use appleid audience for secret exchange (38f8b36):

Use batch insert to speed up project changes (928c9f8):

Use context for readiness probes (#4219) (e6d2d4d)

Use default group for signup nodes in oidc (#4414) (dc8b32e)

Use git hash to render ory x schema references (6776835):

Use hard-coded fallback key instead of panic (29eeb56):

Use non-alerting errors for errors not needing alerts (49e472c):

Use updated appleid issuer (76afd6d):

Remove unused SMS config from schema (#4212) (f076fe4)

Usage of organization parameter in native self-service flows (#4176) (cb71e38)

Add context param to policy (#4315) (261596b)

Add email domain matcher (#4373) (1c33c39)

Add explicit config flag for secure cookies (#4180) (2aabe12):

Adds a new config flag for session and all other cookies. Falls back to the previous behavior of using the dev mode to decide if the cookie should be secure or not.

Add external ID to identities (335a1e8):

Add failure reason to events (#4203) (afa7618)

Add HTML email support to HTTP channel (#4387) (fb8856e), closes #4350

Add Login with Amazon (6cb3e99):

Add LoginStarted and RegistrationStarted events (#4404) (7032fec), closes ory/docs#2144:

Changes:

• Add LoginStarted and RegistrationStarted events along their required attributes
• Sort all event attributes alphabetically
• Emit these events when a new login/registration flow is created, after basic validation passed
• It is unclear yet how many of these events will be emitted, as such it is suggested that in a first phase, they remain internal and are not yet sent externally to avoid surprises (note: sometimes, these events can be emitted without user action such as simply visiting/being redirected to the sign-in page, etc)

Documentation PR:

Add migrate sql up|down|status (#4228) (e6fa520):

This patch adds the ability to execute down migrations using:

kratos migrate sql down -e --steps {num_of_steps}

Please read kratos migrate sql down --help carefully.

Going forward, please use the following commands

kratos migrate sql up ...
kratos migrate sql status ...

instead of the previous, now deprecated

kratos migrate sql ...
kratos migrate status ...

commands.

See https://github.com/ory-corp/cloud/issues/7350

Add new Division ui node attributes (235af52):

Division nodes may be used to hook dynamic scripts and are not actively used in the Ory Kratos open source.

Add new endpoint to tokenize JWT with a webhook (f7fa792):

Add oid as subject source for microsoft (#4171) (77beb4d), closes #4170:

In the case of Microsoft, using sub as an identifier can lead to problems. Because the use of OIDC at Microsoft is based on an app registration, the content of sub changes with every new app registration. Sub is therefore not uniquely related to the user. It is therefore not possible to transfer users from one app registration to another without further problems. https://learn.microsoft.com/en-us/entra/identity-platform/id-token-claims-reference#payload-claims

With the use of oid it is possible to identify a user by a unique id.

Add session in settings after hook (1b57fdf):

Add support for Line v2.1 OIDC provider (#4240) (729effd):

For OIDC Line Login, you only need to add id_token_key_type=JWK in the exchange step to issue tokens in ES256 format.

https://github.com/ory/kratos/discussions/1116

Allow deleting password credentials (#4304) (f2212d4):

The admin API did not allow to delete passwords at all. The restriction is now lifted to only block deletion of the first-factor credential if it is the last one.

Allow extra go migrations in persister (#4183) (7bec935)

Allow listing identities by organization ID (#4115) (b4c453b)

Allow setting the org ID on creation (#4306) (bccd2fb)

Autoconfigure kratos-changefeed (b8bf4c7):

Bump CRDB, establish foreign key, (d76e70f):

Cache OIDC providers (#4222) (30485c4):

This change significantly reduces the number of requests to /.well-known/openid-configuration endpoints.

changelog-oel: Choose identity schema in self-service registration and login flows (53f4b9f):

changelog-oel: Improved tracing and metrics for the high-performance SQL connection pool (ce1bf9f):

changelog: Add a new feature flag for the Recovery V2 to ensure backwards-compatibility (d68736b):

changelog: Add CourierMessageAbandoned & CourierMessageDispatched events (dfed493):

changelog: Find-by and delete SAML credentials (0c80f61):

changelog: Migrate http router to stdlib router (48f5adb):

changelog: Reject new password same as old password when changing the password (a7f50ab):

Console UI for multiple identity schemas (1145cda):

Custom page token column extraction (c5cb85e):

Domain telemetry improvements (93345d7):

Drop unused indices post index migration (#4201) (1008639)

Emit admin recovery code event (#4230) (a7cdc3a)

Emit event on Jsonnet claims mapping error (#4394) (8caebdb):

We now emit an event containing the Jsonnet input and output in anonymized form when mapping the claims in the OIDC flow fails.

Emit events on jsonnet failure when templating a jwt (#4409) (959ded5):

• Fix typo: parital -> partial
• Document with comments why an event is not emitted or not documented
• Emit JsonnetMappingFailed events on jsonnet failure when templating a jwt (see https://www.ory.sh/docs/identities/session-to-jwt-cors). After review it seems we otherwise always emit events in all the right places, except in this very case. Tested end-to-end manually with the UI.

Emit oryWebAuthnInitialized event once webauthn is initialized (b4485f4):

Enable JSONNet templating for password migration hook (#4390) (b162897):

This enables JSONNet body templating for the password migration hook. There is also a significant refactoring of some internals around webhook config handling.

Expose Ory-Error-Id HTTP header (f2b0cd5):

Fast add credential type lookups (#4177) (eeb1355)

Faster UpdateIdentity (4c2cfae):

Fewer DB loads when linking credentials, add tracing (2c5bb21)

Goreleaser (db10a68):

Gracefully handle failing password rehashing during login (#4235) (3905787):

This fixes an issue where we would successfully import long passwords (>72 chars), but fail when the user attempts to login with the correct password because we can't rehash it. In this case, we simply issue a warning to the logs, keep the old hash intact, and continue logging in the user.

hydra: Split up persister (910cf9c):

Improve domain telemetry for OSS (Hydra & Kratos) (86ab72a):

Improve identity import limits (#4378) (e38e812)

Improve kratos courier metrics and debug log message (c50ffcc):

Improve QueryForCredentials (#4181) (ca0d6a7)

Improve secondary indices for self service tables (#4179) (825aec2)

Improve verification required flows (#4407) (2014a40)

Improved events and identity recent activity (e47b858):

Improved tracing for courier (85a7071)

Index hint for CRDB when deleting identity credentials (#4276) (c703a33):

Ref https://support.cockroachlabs.com/hc/en-us/requests/25430

Jackson provider (#4242) (f18d1b2):

This adds a jackson provider to Kratos.

Load session only once when middleware is used (#4187) (234b6f2)

Monorepo (31f1894):

More extension points (#4272) (373a2e6):

This adds more extension points to the Kratos registry.

Move config testhelpers to ory/x (8d43aae):

Optimize identity-related secondary indices (#4182) (53874c1)

Passwordless SMS and expiry notice in code / link templates (#4104) (462cea9):

This feature allows Ory Kratos to use the SMS gateway for login and registration with code via SMS.

Additionally, the default email and sms templates have been updated. We now also expose ExpiresInMinutes / expires_in_minutes in the templates, making it easier to remind the user how long the code or link is valid for.

Closes https://github.com/ory/kratos/issues/1570 Closes https://github.com/ory/kratos/issues/3779

Recovery with any address including with a code via SMS (71844dd):

Refactor cmd/daemon (#4371) (7fe55d9)

Remove duplicate queries during settings flow and use better index hint for credentials lookup (#4193) (c33965e):

This patch reduces duplicate GetIdentity queries as part of submitting the settings flow, and improves an index to significantly reduce credential lookup.

For better debugging, more tracing ha been added to the settings module.

Remove more unused indices (#4186) (b294804)

Return field name in generated node text label (8c7a3dc):

Rework the OTP code submit count mechanism (#4251) (4ca4d79):

• feat: rework the OTP code submit count mechanism

Unlike what the previous comment suggested, incrementing and checking the submit count inside the database transaction is not actually optimal peformance- or security-wise.

We now check atomically increment and check the submit count as the first part of the operation, and abort as early as possible if we detect brute-forcing. This prevents a situation where the check works only on certain transaction isolation levels.

• chore: bump dependencies

Support android webauthn origins (#4155) (a82d288):

This patch adds the ability to verify Android APK origins used during WebAuthn/Passkey exchange.

Upgrades go-webauthn and includes fixes for Go 1.23 and workarounds for Swagger.

Support CRUD OIDC providers through the onboarding portal API (664fd1a):

Support importing more credentials (#4361) (9a6dadf):

Adds support to import SAML credentials. SAML connections are only available in Ory Enterprise License / Ory Network.

Trace identity id in errors (772572c):

Update only necessary database columns in UpdateVerifiableAddress (#4292) (168a3f6):

This is an optimization to reduce database load.

When we specify exactly which columns changed, we should be able to elide updates to the identity_verifiable_addresses_status_via_uq_idx (nid,via,value) index. Updating that index requires contacting remote regions.

Also fixed a bug where we did not set the verified_at timestamp correctly sometimes.

Use one transaction for /admin/recovery/code (#4225) (3e87e0c)

Use stdlib HTTP router in Kratos (acfa6ef):

Use vendored ory/x (a9ab800):

Webhook header allowlist configuration option (#4309) (871f5aa), closes #4290:

Adds a clients.web_hook.header_allowlist configuration option for configuring the webhook header allowlist.