diff --git a/docs/self-hosted/oel/keto/changelog/v26.3.4.md b/docs/self-hosted/oel/keto/changelog/v26.3.4.md new file mode 100644 index 000000000..39e3a7079 --- /dev/null +++ b/docs/self-hosted/oel/keto/changelog/v26.3.4.md @@ -0,0 +1,38 @@ +## v26.3.4 + +### Metrics endpoints now support OpenMetrics and trace exemplars + +The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition +format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive +it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary. + +OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this: + +- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so + latency dashboards can link slow-request outliers and error spikes to the traces that caused them. +- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count + when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can + link retry spikes directly to the traces that caused them. + +That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business +operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction` +wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match +specific `caller` label values may need updating, because existing label values change with this release. + +### YugabyteDB support for Kratos, Hydra, and Keto (OEL) + +Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB. + +#### Enabling YugabyteDB + +Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works): + +``` +yugabyte://user@host:5433/database?sslmode=disable +``` + +#### Recovering an interrupted migration + +YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an +interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use +multi-statement migrations and are safe. diff --git a/docs/self-hosted/oel/kratos/changelog/v26.3.4.md b/docs/self-hosted/oel/kratos/changelog/v26.3.4.md new file mode 100644 index 000000000..6532d5f2f --- /dev/null +++ b/docs/self-hosted/oel/kratos/changelog/v26.3.4.md @@ -0,0 +1,112 @@ +## v26.3.4 + +### Account linking now works when registration is disabled + +Automatic account linking now works when registration is disabled. Signing in with an OIDC or SAML provider whose email matches an +existing account starts the account linking flow even if `selfservice.flows.registration.enabled` is `false`. New sign-ups remain +blocked. Previously, the linking attempt failed with "Registration is not allowed because it was disabled." + +### Bound the password identifier-similarity check by length + +The password validator's identifier-similarity check now bounds the length of the identifier and password it compares. Real +identifiers and passwords are far shorter than this bound, so legitimate flows are unaffected. This hardens the check against +excessive resource use on very long inputs. + +### Exclude already registered credentials in WebAuthn and passkey settings + +The WebAuthn and passkey settings flows now populate `excludeCredentials` in the registration challenge with the identity's +already registered credentials. Browsers no longer silently overwrite an existing platform-authenticator entry (Touch ID, Windows +Hello, Android) when a user re-enrolls the same device; instead the authenticator reports the credential as already registered. +Kratos additionally rejects a registration response whose credential ID is already registered on the identity. + +### Metrics endpoints now support OpenMetrics and trace exemplars + +The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition +format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive +it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary. + +OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this: + +- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so + latency dashboards can link slow-request outliers and error spikes to the traces that caused them. +- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count + when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can + link retry spikes directly to the traces that caused them. + +That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business +operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction` +wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match +specific `caller` label values may need updating, because existing label values change with this release. + +### Opt-in cleanup of expired data on CockroachDB + +Ory Kratos Enterprise License deployments on CockroachDB can now set up row-level TTL jobs that automatically delete expired data. +Run the new `kratos migrate row-ttl up` command to configure these retention periods: + +- Self-service flows, one-time codes, tokens, and continuity containers: 7 days after they expire. +- Sessions: 30 days after they expire. +- Courier messages, message dispatches, and self-service errors: 30 days after they are created. + +The command is opt-in: `kratos migrate sql up` does not change TTL settings. Use `kratos migrate row-ttl dump` to print the SQL +statements — for review, or to adapt the retention periods and apply them manually. `kratos migrate row-ttl status` shows which +TTL migrations are applied, and `kratos migrate row-ttl down` removes the TTL configuration again. + +Running `kratos migrate row-ttl up` replaces any custom row-level TTL settings on the affected tables with the defaults above. The +command requires CockroachDB and exits with an error on other databases. + +CockroachDB deletes expired rows on a schedule, not at the exact moment the retention period ends. Expired rows can remain in the +database for some time: either the TTL job has not processed them yet, or it has deleted them but garbage collection has not yet +removed them. + +### Persist WebAuthn and passkey sign counter for clone detection + +Ory now updates the stored WebAuthn and passkey authenticator state after every successful login. The signature counter, +clone-warning flag, and backup state are written back to the credential, so W3C WebAuthn clone detection works as intended. + +Previously the signature counter stayed at its registration value, which left clone detection inert. A login that presents a +non-increasing counter is still allowed — synced passkeys (such as Apple iCloud or Google) legitimately report a static counter — +but the possible-clone warning is now recorded on the credential and is visible through the admin identity API. + +### Revoke a single DeviceAuthn key by identifier + +`DELETE /admin/identities/{id}/credentials/deviceauthn` now revokes a single DeviceAuthn key selected by the `identifier` query +parameter, where the identifier is the key's `client_key_id`. This is the same parameter that OIDC and SAML credential deletion +already use. + +Because the `client_key_id` is unique per identity, administrators can revoke exactly one device key without affecting other keys +— including keys that share the same device name. Before, deleting the `deviceauthn` credential type removed all device keys at +once. + +The endpoint returns `404 Not Found` when the identity has no `deviceauthn` credential or when no key matches the identifier, and +`400 Bad Request` when the identifier is missing. Removing the last key leaves the `deviceauthn` credential with no keys. + +Find the client key ids by calling `GET /admin/identities/{id}?include_credential=deviceauthn`. + +### Second-factor enrollment now refreshes the session's authenticated_at timestamp + +Setting up a second factor — authenticator app (TOTP), security key, passkey, or lookup secret — in a settings flow now refreshes +the session's `authenticated_at` timestamp, in addition to elevating the session to AAL2. Linking a social sign-in provider in a +settings flow also refreshes the timestamp. + +Previously, enrolling a second factor raised the session to AAL2 but left `authenticated_at` unchanged. Because AAL2 +re-authentication prompts are timed from `authenticated_at`, users could be asked to re-authenticate immediately after proving +possession of the factor they had just enrolled. The timestamp now reflects the enrollment as the most recent authentication +event. + +### YugabyteDB support for Kratos, Hydra, and Keto (OEL) + +Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB. + +#### Enabling YugabyteDB + +Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works): + +``` +yugabyte://user@host:5433/database?sslmode=disable +``` + +#### Recovering an interrupted migration + +YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an +interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use +multi-statement migrations and are safe. diff --git a/docs/self-hosted/oel/oathkeeper/changelog/v26.3.4.md b/docs/self-hosted/oel/oathkeeper/changelog/v26.3.4.md new file mode 100644 index 000000000..991672636 --- /dev/null +++ b/docs/self-hosted/oel/oathkeeper/changelog/v26.3.4.md @@ -0,0 +1,20 @@ +## v26.3.4 + +### Metrics endpoints now support OpenMetrics and trace exemplars + +The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition +format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive +it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary. + +OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this: + +- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so + latency dashboards can link slow-request outliers and error spikes to the traces that caused them. +- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count + when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can + link retry spikes directly to the traces that caused them. + +That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business +operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction` +wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match +specific `caller` label values may need updating, because existing label values change with this release. diff --git a/docs/self-hosted/oel/oauth2/changelog/v26.3.4.md b/docs/self-hosted/oel/oauth2/changelog/v26.3.4.md new file mode 100644 index 000000000..5733fe589 --- /dev/null +++ b/docs/self-hosted/oel/oauth2/changelog/v26.3.4.md @@ -0,0 +1,96 @@ +## v26.3.4 + +### `hydra update oauth2-client` no longer resets fields you did not pass + +The `hydra update oauth2-client` command now updates only the fields you provide as flags. Previously, the command replaced the +entire client: any field not passed again on the command line was silently reset to its default value, which could drop redirect +URIs, secrets-related settings, CORS origins, and other configuration. + +The command now sends a partial update (`PATCH /admin/clients/{id}`) built from exactly the flags you set. For example, running +`hydra update oauth2-client --name "new name"` changes only the client name and leaves all other settings untouched. + +Updating from a file (`--file client.json` or `--file -`) keeps the previous behavior and replaces the entire client, since a file +represents a complete client configuration. + +#### Breaking changes + +Scripts that relied on `hydra update oauth2-client` resetting unspecified fields to their defaults must now pass a complete client +definition with `--file` to get replace semantics. + +#### Ory CLI + +The equivalent change in the Ory CLI (`ory update oauth2-client`) will land in CLI v1.3.2. + +### Faster OAuth2 token issuance under database latency + +Ory Hydra no longer serializes JSON Web Key reads behind a global lock. Token issuance, the authorize flow, and the OpenID Connect +discovery endpoint now read signing keys concurrently, so a slow database query no longer queues all other requests behind it. + +Generating a missing key set is now deduplicated per network and key set: concurrent requests that race on a fresh installation +trigger exactly one key generation per instance and share its result. A request that is canceled while waiting no longer aborts +the generation for other waiting requests. + +The Ory Hydra OEL key-set cache now scopes cache entries by network ID. + +### Fix OIDC session leak in the device authorization grant + +The OpenID Connect device grant now deletes its stored OIDC session after issuing an `id_token`. Previously the session was looked +up by the device-code signature but deleted using the raw `device_code`, so the delete never matched and every successful +device-flow `id_token` issuance left one OIDC session behind. On storage backends without a TTL this grew without bound. + +This is an availability fix only. Device codes could still not be replayed, so there was no token-reuse or authorization impact. + +### Hydra CLI reports the key set name when getting JSON Web Keys + +`hydra get jwks` (and `ory get jwk` in the Ory CLI) now reports which key set each key belongs to. Previously the `set` attribute +was missing from JSON and YAML output for single-key sets, and empty in every output format for sets with more than one key. + +Each key in the output now carries its own `set` attribute. When keys from several sets are fetched in one command, the keys are +attributed to their correct sets instead of an empty name. + +The API reference for creating a JSON Web Key now documents that generating a key into an existing set keeps the existing keys, +except on deployments using a Hardware Security Module (HSM), where the set is replaced and contains only the new key. + +### Metrics endpoints now support OpenMetrics and trace exemplars + +The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition +format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive +it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary. + +OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this: + +- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so + latency dashboards can link slow-request outliers and error spikes to the traces that caused them. +- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count + when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can + link retry spikes directly to the traces that caused them. + +That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business +operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction` +wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match +specific `caller` label values may need updating, because existing label values change with this release. + +### OAuth2 client secret rotation + +Hydra now supports zero-downtime client secret rotation. See the +[documentation](https://www.ory.com/docs/hydra/guides/oauth2-clients) for details. + +Thanks to @SamuelDev (https://github.com/SamuelDev) for the initial implementation! + +### YugabyteDB support for Kratos, Hydra, and Keto (OEL) + +Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB. + +#### Enabling YugabyteDB + +Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works): + +``` +yugabyte://user@host:5433/database?sslmode=disable +``` + +#### Recovering an interrupted migration + +YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an +interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use +multi-statement migrations and are safe. diff --git a/docs/self-hosted/oel/oel-hydra-image-tags.md b/docs/self-hosted/oel/oel-hydra-image-tags.md index 15e6198e6..cd3d6045b 100644 --- a/docs/self-hosted/oel/oel-hydra-image-tags.md +++ b/docs/self-hosted/oel/oel-hydra-image-tags.md @@ -1,5 +1,6 @@ | Image Tag | Release Date | | ---------------------------------------- | ------------ | +| 26.3.4 | 2026-07-28 | | 26.3.3 | 2026-07-10 | | 26.3.2 | 2026-07-09 | | 26.3.1 | 2026-07-06 | diff --git a/docs/self-hosted/oel/oel-keto-image-tags.md b/docs/self-hosted/oel/oel-keto-image-tags.md index e99540b9c..3df8e416f 100644 --- a/docs/self-hosted/oel/oel-keto-image-tags.md +++ b/docs/self-hosted/oel/oel-keto-image-tags.md @@ -1,5 +1,6 @@ | Image Tag | Release Date | | ---------------------------------------- | ------------ | +| 26.3.4 | 2026-07-28 | | 26.3.3 | 2026-07-10 | | 26.3.2 | 2026-07-09 | | 26.3.1 | 2026-07-06 | diff --git a/docs/self-hosted/oel/oel-kratos-image-tags.md b/docs/self-hosted/oel/oel-kratos-image-tags.md index 53d0de0c5..97cff1abd 100644 --- a/docs/self-hosted/oel/oel-kratos-image-tags.md +++ b/docs/self-hosted/oel/oel-kratos-image-tags.md @@ -1,5 +1,6 @@ | Image Tag | Release Date | | ---------------------------------------- | ------------ | +| 26.3.4 | 2026-07-28 | | 26.3.3 | 2026-07-10 | | 26.3.2 | 2026-07-09 | | 26.3.1 | 2026-07-06 | diff --git a/docs/self-hosted/oel/oel-oathkeeper-image-tags.md b/docs/self-hosted/oel/oel-oathkeeper-image-tags.md index 28faada86..8fb022588 100644 --- a/docs/self-hosted/oel/oel-oathkeeper-image-tags.md +++ b/docs/self-hosted/oel/oel-oathkeeper-image-tags.md @@ -1,5 +1,6 @@ | Image Tag | Release Date | | ---------------------------------------- | ------------ | +| 26.3.4 | 2026-07-28 | | 26.3.3 | 2026-07-10 | | 26.3.2 | 2026-07-09 | | 26.3.1 | 2026-07-06 | diff --git a/docs/self-hosted/oel/oel-polis-image-tags.md b/docs/self-hosted/oel/oel-polis-image-tags.md index 3f86cd683..54f987470 100644 --- a/docs/self-hosted/oel/oel-polis-image-tags.md +++ b/docs/self-hosted/oel/oel-polis-image-tags.md @@ -1,5 +1,6 @@ | Image Tag | Release Date | | ---------------------------------------- | ------------ | +| 26.3.4 | 2026-07-28 | | 26.3.3 | 2026-07-10 | | 26.3.2 | 2026-07-09 | | 26.3.1 | 2026-07-06 | diff --git a/docs/self-hosted/oel/polis/changelog/v26.3.4.md b/docs/self-hosted/oel/polis/changelog/v26.3.4.md new file mode 100644 index 000000000..1bda846df --- /dev/null +++ b/docs/self-hosted/oel/polis/changelog/v26.3.4.md @@ -0,0 +1 @@ +No changelog entries found for polis/oel in versions v26.3.4