chore(docs): update of OEL images

docs/self-hosted/oel/keto/changelog/v26.3.4.md

@@ -0,0 +1,38 @@
+## v26.3.4
+
+### Metrics endpoints now support OpenMetrics and trace exemplars
+
+The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
+format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
+it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
+
+OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
+
+- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
+  latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
+- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
+  when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
+  link retry spikes directly to the traces that caused them.
+
+That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
+operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
+wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
+specific `caller` label values may need updating, because existing label values change with this release.
+
+### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
+
+Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
+
+#### Enabling YugabyteDB
+
+Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
+
+```
+yugabyte://user@host:5433/database?sslmode=disable
+```
+
+#### Recovering an interrupted migration
+
+YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
+interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
+multi-statement migrations and are safe.

docs/self-hosted/oel/kratos/changelog/v26.3.4.md

@@ -0,0 +1,112 @@
+## v26.3.4
+
+### Account linking now works when registration is disabled
+
+Automatic account linking now works when registration is disabled. Signing in with an OIDC or SAML provider whose email matches an
+existing account starts the account linking flow even if `selfservice.flows.registration.enabled` is `false`. New sign-ups remain
+blocked. Previously, the linking attempt failed with "Registration is not allowed because it was disabled."
+
+### Bound the password identifier-similarity check by length
+
+The password validator's identifier-similarity check now bounds the length of the identifier and password it compares. Real
+identifiers and passwords are far shorter than this bound, so legitimate flows are unaffected. This hardens the check against
+excessive resource use on very long inputs.
+
+### Exclude already registered credentials in WebAuthn and passkey settings
+
+The WebAuthn and passkey settings flows now populate `excludeCredentials` in the registration challenge with the identity's
+already registered credentials. Browsers no longer silently overwrite an existing platform-authenticator entry (Touch ID, Windows
+Hello, Android) when a user re-enrolls the same device; instead the authenticator reports the credential as already registered.
+Kratos additionally rejects a registration response whose credential ID is already registered on the identity.
+
+### Metrics endpoints now support OpenMetrics and trace exemplars
+
+The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
+format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
+it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
+
+OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
+
+- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
+  latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
+- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
+  when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
+  link retry spikes directly to the traces that caused them.
+
+That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
+operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
+wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
+specific `caller` label values may need updating, because existing label values change with this release.
+
+### Opt-in cleanup of expired data on CockroachDB
+
+Ory Kratos Enterprise License deployments on CockroachDB can now set up row-level TTL jobs that automatically delete expired data.
+Run the new `kratos migrate row-ttl up` command to configure these retention periods:
+
+- Self-service flows, one-time codes, tokens, and continuity containers: 7 days after they expire.
+- Sessions: 30 days after they expire.
+- Courier messages, message dispatches, and self-service errors: 30 days after they are created.
+
+The command is opt-in: `kratos migrate sql up` does not change TTL settings. Use `kratos migrate row-ttl dump` to print the SQL
+statements — for review, or to adapt the retention periods and apply them manually. `kratos migrate row-ttl status` shows which
+TTL migrations are applied, and `kratos migrate row-ttl down` removes the TTL configuration again.
+
+Running `kratos migrate row-ttl up` replaces any custom row-level TTL settings on the affected tables with the defaults above. The
+command requires CockroachDB and exits with an error on other databases.
+
+CockroachDB deletes expired rows on a schedule, not at the exact moment the retention period ends. Expired rows can remain in the
+database for some time: either the TTL job has not processed them yet, or it has deleted them but garbage collection has not yet
+removed them.
+
+### Persist WebAuthn and passkey sign counter for clone detection
+
+Ory now updates the stored WebAuthn and passkey authenticator state after every successful login. The signature counter,
+clone-warning flag, and backup state are written back to the credential, so W3C WebAuthn clone detection works as intended.
+
+Previously the signature counter stayed at its registration value, which left clone detection inert. A login that presents a
+non-increasing counter is still allowed — synced passkeys (such as Apple iCloud or Google) legitimately report a static counter —
+but the possible-clone warning is now recorded on the credential and is visible through the admin identity API.
+
+### Revoke a single DeviceAuthn key by identifier
+
+`DELETE /admin/identities/{id}/credentials/deviceauthn` now revokes a single DeviceAuthn key selected by the `identifier` query
+parameter, where the identifier is the key's `client_key_id`. This is the same parameter that OIDC and SAML credential deletion
+already use.
+
+Because the `client_key_id` is unique per identity, administrators can revoke exactly one device key without affecting other keys
+— including keys that share the same device name. Before, deleting the `deviceauthn` credential type removed all device keys at
+once.
+
+The endpoint returns `404 Not Found` when the identity has no `deviceauthn` credential or when no key matches the identifier, and
+`400 Bad Request` when the identifier is missing. Removing the last key leaves the `deviceauthn` credential with no keys.
+
+Find the client key ids by calling `GET /admin/identities/{id}?include_credential=deviceauthn`.
+
+### Second-factor enrollment now refreshes the session's authenticated_at timestamp
+
+Setting up a second factor — authenticator app (TOTP), security key, passkey, or lookup secret — in a settings flow now refreshes
+the session's `authenticated_at` timestamp, in addition to elevating the session to AAL2. Linking a social sign-in provider in a
+settings flow also refreshes the timestamp.
+
+Previously, enrolling a second factor raised the session to AAL2 but left `authenticated_at` unchanged. Because AAL2
+re-authentication prompts are timed from `authenticated_at`, users could be asked to re-authenticate immediately after proving
+possession of the factor they had just enrolled. The timestamp now reflects the enrollment as the most recent authentication
+event.
+
+### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
+
+Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
+
+#### Enabling YugabyteDB
+
+Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
+
+```
+yugabyte://user@host:5433/database?sslmode=disable
+```
+
+#### Recovering an interrupted migration
+
+YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
+interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
+multi-statement migrations and are safe.

docs/self-hosted/oel/oathkeeper/changelog/v26.3.4.md

@@ -0,0 +1,20 @@
+## v26.3.4
+
+### Metrics endpoints now support OpenMetrics and trace exemplars
+
+The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
+format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
+it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
+
+OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
+
+- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
+  latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
+- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
+  when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
+  link retry spikes directly to the traces that caused them.
+
+That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
+operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
+wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
+specific `caller` label values may need updating, because existing label values change with this release.

docs/self-hosted/oel/oauth2/changelog/v26.3.4.md

@@ -0,0 +1,96 @@
+## v26.3.4
+
+### `hydra update oauth2-client` no longer resets fields you did not pass
+
+The `hydra update oauth2-client` command now updates only the fields you provide as flags. Previously, the command replaced the
+entire client: any field not passed again on the command line was silently reset to its default value, which could drop redirect
+URIs, secrets-related settings, CORS origins, and other configuration.
+
+The command now sends a partial update (`PATCH /admin/clients/{id}`) built from exactly the flags you set. For example, running
+`hydra update oauth2-client <id> --name "new name"` changes only the client name and leaves all other settings untouched.
+
+Updating from a file (`--file client.json` or `--file -`) keeps the previous behavior and replaces the entire client, since a file
+represents a complete client configuration.
+
+#### Breaking changes
+
+Scripts that relied on `hydra update oauth2-client` resetting unspecified fields to their defaults must now pass a complete client
+definition with `--file` to get replace semantics.
+
+#### Ory CLI
+
+The equivalent change in the Ory CLI (`ory update oauth2-client`) will land in CLI v1.3.2.
+
+### Faster OAuth2 token issuance under database latency
+
+Ory Hydra no longer serializes JSON Web Key reads behind a global lock. Token issuance, the authorize flow, and the OpenID Connect
+discovery endpoint now read signing keys concurrently, so a slow database query no longer queues all other requests behind it.
+
+Generating a missing key set is now deduplicated per network and key set: concurrent requests that race on a fresh installation
+trigger exactly one key generation per instance and share its result. A request that is canceled while waiting no longer aborts
+the generation for other waiting requests.
+
+The Ory Hydra OEL key-set cache now scopes cache entries by network ID.
+
+### Fix OIDC session leak in the device authorization grant
+
+The OpenID Connect device grant now deletes its stored OIDC session after issuing an `id_token`. Previously the session was looked
+up by the device-code signature but deleted using the raw `device_code`, so the delete never matched and every successful
+device-flow `id_token` issuance left one OIDC session behind. On storage backends without a TTL this grew without bound.
+
+This is an availability fix only. Device codes could still not be replayed, so there was no token-reuse or authorization impact.
+
+### Hydra CLI reports the key set name when getting JSON Web Keys
+
+`hydra get jwks` (and `ory get jwk` in the Ory CLI) now reports which key set each key belongs to. Previously the `set` attribute
+was missing from JSON and YAML output for single-key sets, and empty in every output format for sets with more than one key.
+
+Each key in the output now carries its own `set` attribute. When keys from several sets are fetched in one command, the keys are
+attributed to their correct sets instead of an empty name.
+
+The API reference for creating a JSON Web Key now documents that generating a key into an existing set keeps the existing keys,
+except on deployments using a Hardware Security Module (HSM), where the set is replaced and contains only the new key.
+
+### Metrics endpoints now support OpenMetrics and trace exemplars
+
+The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
+format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
+it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
+
+OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
+
+- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
+  latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
+- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
+  when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
+  link retry spikes directly to the traces that caused them.
+
+That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
+operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
+wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
+specific `caller` label values may need updating, because existing label values change with this release.
+
+### OAuth2 client secret rotation
+
+Hydra now supports zero-downtime client secret rotation. See the
+[documentation](https://www.ory.com/docs/hydra/guides/oauth2-clients) for details.
+
+Thanks to @SamuelDev (https://github.com/SamuelDev) for the initial implementation!
+
+### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
+
+Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
+
+#### Enabling YugabyteDB
+
+Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
+
+```
+yugabyte://user@host:5433/database?sslmode=disable
+```
+
+#### Recovering an interrupted migration
+
+YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
+interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
+multi-statement migrations and are safe.

docs/self-hosted/oel/oel-hydra-image-tags.md

@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.3.4                                   | 2026-07-28   |
 | 26.3.3                                   | 2026-07-10   |
 | 26.3.2                                   | 2026-07-09   |
 | 26.3.1                                   | 2026-07-06   |

docs/self-hosted/oel/oel-keto-image-tags.md

@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.3.4                                   | 2026-07-28   |
 | 26.3.3                                   | 2026-07-10   |
 | 26.3.2                                   | 2026-07-09   |
 | 26.3.1                                   | 2026-07-06   |

docs/self-hosted/oel/oel-kratos-image-tags.md

@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.3.4                                   | 2026-07-28   |
 | 26.3.3                                   | 2026-07-10   |
 | 26.3.2                                   | 2026-07-09   |
 | 26.3.1                                   | 2026-07-06   |

docs/self-hosted/oel/oel-oathkeeper-image-tags.md

@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.3.4                                   | 2026-07-28   |
 | 26.3.3                                   | 2026-07-10   |
 | 26.3.2                                   | 2026-07-09   |
 | 26.3.1                                   | 2026-07-06   |

docs/self-hosted/oel/oel-polis-image-tags.md

@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.3.4                                   | 2026-07-28   |
 | 26.3.3                                   | 2026-07-10   |
 | 26.3.2                                   | 2026-07-09   |
 | 26.3.1                                   | 2026-07-06   |

docs/self-hosted/oel/polis/changelog/v26.3.4.md

@@ -0,0 +1 @@
+No changelog entries found for polis/oel in versions v26.3.4