Skip to content

Commit b7a67db

Browse files
ory-botory-bot
authored
chore(docs): update of OEL images (#2697)
1 parent e311b1f commit b7a67db

10 files changed

Lines changed: 272 additions & 0 deletions

File tree

‎docs/self-hosted/oel/keto/changelog/v26.3.4.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## v26.3.4
2+
3+
### Metrics endpoints now support OpenMetrics and trace exemplars
4+
5+
The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
6+
format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
7+
it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
8+
9+
OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
10+
11+
- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
12+
latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
13+
- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
14+
when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
15+
link retry spikes directly to the traces that caused them.
16+
17+
That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
18+
operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
19+
wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
20+
specific `caller` label values may need updating, because existing label values change with this release.
21+
22+
### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
23+
24+
Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
25+
26+
#### Enabling YugabyteDB
27+
28+
Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
29+
30+
```
31+
yugabyte://user@host:5433/database?sslmode=disable
32+
```
33+
34+
#### Recovering an interrupted migration
35+
36+
YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
37+
interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
38+
multi-statement migrations and are safe.

‎docs/self-hosted/oel/kratos/changelog/v26.3.4.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
## v26.3.4
2+
3+
### Account linking now works when registration is disabled
4+
5+
Automatic account linking now works when registration is disabled. Signing in with an OIDC or SAML provider whose email matches an
6+
existing account starts the account linking flow even if `selfservice.flows.registration.enabled` is `false`. New sign-ups remain
7+
blocked. Previously, the linking attempt failed with "Registration is not allowed because it was disabled."
8+
9+
### Bound the password identifier-similarity check by length
10+
11+
The password validator's identifier-similarity check now bounds the length of the identifier and password it compares. Real
12+
identifiers and passwords are far shorter than this bound, so legitimate flows are unaffected. This hardens the check against
13+
excessive resource use on very long inputs.
14+
15+
### Exclude already registered credentials in WebAuthn and passkey settings
16+
17+
The WebAuthn and passkey settings flows now populate `excludeCredentials` in the registration challenge with the identity's
18+
already registered credentials. Browsers no longer silently overwrite an existing platform-authenticator entry (Touch ID, Windows
19+
Hello, Android) when a user re-enrolls the same device; instead the authenticator reports the credential as already registered.
20+
Kratos additionally rejects a registration response whose credential ID is already registered on the identity.
21+
22+
### Metrics endpoints now support OpenMetrics and trace exemplars
23+
24+
The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
25+
format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
26+
it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
27+
28+
OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
29+
30+
- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
31+
latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
32+
- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
33+
when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
34+
link retry spikes directly to the traces that caused them.
35+
36+
That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
37+
operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
38+
wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
39+
specific `caller` label values may need updating, because existing label values change with this release.
40+
41+
### Opt-in cleanup of expired data on CockroachDB
42+
43+
Ory Kratos Enterprise License deployments on CockroachDB can now set up row-level TTL jobs that automatically delete expired data.
44+
Run the new `kratos migrate row-ttl up` command to configure these retention periods:
45+
46+
- Self-service flows, one-time codes, tokens, and continuity containers: 7 days after they expire.
47+
- Sessions: 30 days after they expire.
48+
- Courier messages, message dispatches, and self-service errors: 30 days after they are created.
49+
50+
The command is opt-in: `kratos migrate sql up` does not change TTL settings. Use `kratos migrate row-ttl dump` to print the SQL
51+
statements — for review, or to adapt the retention periods and apply them manually. `kratos migrate row-ttl status` shows which
52+
TTL migrations are applied, and `kratos migrate row-ttl down` removes the TTL configuration again.
53+
54+
Running `kratos migrate row-ttl up` replaces any custom row-level TTL settings on the affected tables with the defaults above. The
55+
command requires CockroachDB and exits with an error on other databases.
56+
57+
CockroachDB deletes expired rows on a schedule, not at the exact moment the retention period ends. Expired rows can remain in the
58+
database for some time: either the TTL job has not processed them yet, or it has deleted them but garbage collection has not yet
59+
removed them.
60+
61+
### Persist WebAuthn and passkey sign counter for clone detection
62+
63+
Ory now updates the stored WebAuthn and passkey authenticator state after every successful login. The signature counter,
64+
clone-warning flag, and backup state are written back to the credential, so W3C WebAuthn clone detection works as intended.
65+
66+
Previously the signature counter stayed at its registration value, which left clone detection inert. A login that presents a
67+
non-increasing counter is still allowed — synced passkeys (such as Apple iCloud or Google) legitimately report a static counter —
68+
but the possible-clone warning is now recorded on the credential and is visible through the admin identity API.
69+
70+
### Revoke a single DeviceAuthn key by identifier
71+
72+
`DELETE /admin/identities/{id}/credentials/deviceauthn` now revokes a single DeviceAuthn key selected by the `identifier` query
73+
parameter, where the identifier is the key's `client_key_id`. This is the same parameter that OIDC and SAML credential deletion
74+
already use.
75+
76+
Because the `client_key_id` is unique per identity, administrators can revoke exactly one device key without affecting other keys
77+
— including keys that share the same device name. Before, deleting the `deviceauthn` credential type removed all device keys at
78+
once.
79+
80+
The endpoint returns `404 Not Found` when the identity has no `deviceauthn` credential or when no key matches the identifier, and
81+
`400 Bad Request` when the identifier is missing. Removing the last key leaves the `deviceauthn` credential with no keys.
82+
83+
Find the client key ids by calling `GET /admin/identities/{id}?include_credential=deviceauthn`.
84+
85+
### Second-factor enrollment now refreshes the session's authenticated_at timestamp
86+
87+
Setting up a second factor — authenticator app (TOTP), security key, passkey, or lookup secret — in a settings flow now refreshes
88+
the session's `authenticated_at` timestamp, in addition to elevating the session to AAL2. Linking a social sign-in provider in a
89+
settings flow also refreshes the timestamp.
90+
91+
Previously, enrolling a second factor raised the session to AAL2 but left `authenticated_at` unchanged. Because AAL2
92+
re-authentication prompts are timed from `authenticated_at`, users could be asked to re-authenticate immediately after proving
93+
possession of the factor they had just enrolled. The timestamp now reflects the enrollment as the most recent authentication
94+
event.
95+
96+
### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
97+
98+
Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
99+
100+
#### Enabling YugabyteDB
101+
102+
Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
103+
104+
```
105+
yugabyte://user@host:5433/database?sslmode=disable
106+
```
107+
108+
#### Recovering an interrupted migration
109+
110+
YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
111+
interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
112+
multi-statement migrations and are safe.

‎docs/self-hosted/oel/oathkeeper/changelog/v26.3.4.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
## v26.3.4
2+
3+
### Metrics endpoints now support OpenMetrics and trace exemplars
4+
5+
The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
6+
format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
7+
it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
8+
9+
OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
10+
11+
- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
12+
latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
13+
- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
14+
when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
15+
link retry spikes directly to the traces that caused them.
16+
17+
That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
18+
operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
19+
wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
20+
specific `caller` label values may need updating, because existing label values change with this release.

‎docs/self-hosted/oel/oauth2/changelog/v26.3.4.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
## v26.3.4
2+
3+
### `hydra update oauth2-client` no longer resets fields you did not pass
4+
5+
The `hydra update oauth2-client` command now updates only the fields you provide as flags. Previously, the command replaced the
6+
entire client: any field not passed again on the command line was silently reset to its default value, which could drop redirect
7+
URIs, secrets-related settings, CORS origins, and other configuration.
8+
9+
The command now sends a partial update (`PATCH /admin/clients/{id}`) built from exactly the flags you set. For example, running
10+
`hydra update oauth2-client <id> --name "new name"` changes only the client name and leaves all other settings untouched.
11+
12+
Updating from a file (`--file client.json` or `--file -`) keeps the previous behavior and replaces the entire client, since a file
13+
represents a complete client configuration.
14+
15+
#### Breaking changes
16+
17+
Scripts that relied on `hydra update oauth2-client` resetting unspecified fields to their defaults must now pass a complete client
18+
definition with `--file` to get replace semantics.
19+
20+
#### Ory CLI
21+
22+
The equivalent change in the Ory CLI (`ory update oauth2-client`) will land in CLI v1.3.2.
23+
24+
### Faster OAuth2 token issuance under database latency
25+
26+
Ory Hydra no longer serializes JSON Web Key reads behind a global lock. Token issuance, the authorize flow, and the OpenID Connect
27+
discovery endpoint now read signing keys concurrently, so a slow database query no longer queues all other requests behind it.
28+
29+
Generating a missing key set is now deduplicated per network and key set: concurrent requests that race on a fresh installation
30+
trigger exactly one key generation per instance and share its result. A request that is canceled while waiting no longer aborts
31+
the generation for other waiting requests.
32+
33+
The Ory Hydra OEL key-set cache now scopes cache entries by network ID.
34+
35+
### Fix OIDC session leak in the device authorization grant
36+
37+
The OpenID Connect device grant now deletes its stored OIDC session after issuing an `id_token`. Previously the session was looked
38+
up by the device-code signature but deleted using the raw `device_code`, so the delete never matched and every successful
39+
device-flow `id_token` issuance left one OIDC session behind. On storage backends without a TTL this grew without bound.
40+
41+
This is an availability fix only. Device codes could still not be replayed, so there was no token-reuse or authorization impact.
42+
43+
### Hydra CLI reports the key set name when getting JSON Web Keys
44+
45+
`hydra get jwks` (and `ory get jwk` in the Ory CLI) now reports which key set each key belongs to. Previously the `set` attribute
46+
was missing from JSON and YAML output for single-key sets, and empty in every output format for sets with more than one key.
47+
48+
Each key in the output now carries its own `set` attribute. When keys from several sets are fetched in one command, the keys are
49+
attributed to their correct sets instead of an empty name.
50+
51+
The API reference for creating a JSON Web Key now documents that generating a key into an existing set keeps the existing keys,
52+
except on deployments using a Hardware Security Module (HSM), where the set is replaced and contains only the new key.
53+
54+
### Metrics endpoints now support OpenMetrics and trace exemplars
55+
56+
The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition
57+
format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive
58+
it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.
59+
60+
OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:
61+
62+
- The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so
63+
latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
64+
- The `ory_x_popx_cockroach_transaction_retries_total` counter attaches an exemplar whose value is the transaction's retry count
65+
when a transaction is retried during a traced request, and the trace records a `db.transaction.retry` span event. Dashboards can
66+
link retry spikes directly to the traces that caused them.
67+
68+
That counter's `caller` label now also more reliably attributes automatic CockroachDB transaction retries to the business
69+
operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence `Transaction`
70+
wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match
71+
specific `caller` label values may need updating, because existing label values change with this release.
72+
73+
### OAuth2 client secret rotation
74+
75+
Hydra now supports zero-downtime client secret rotation. See the
76+
[documentation](https://www.ory.com/docs/hydra/guides/oauth2-clients) for details.
77+
78+
Thanks to @SamuelDev (https://github.com/SamuelDev) for the initial implementation!
79+
80+
### YugabyteDB support for Kratos, Hydra, and Keto (OEL)
81+
82+
Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.
83+
84+
#### Enabling YugabyteDB
85+
86+
Point the `dsn` at your YugabyteDB cluster using the `yugabyte://` scheme (the synonym `yugabytedb://` also works):
87+
88+
```
89+
yugabyte://user@host:5433/database?sslmode=disable
90+
```
91+
92+
#### Recovering an interrupted migration
93+
94+
YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an
95+
interruption may leave the first statements applied without a row in `schema_migration`. Current versions of Ory no longer use
96+
multi-statement migrations and are safe.

‎docs/self-hosted/oel/oel-hydra-image-tags.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| Image Tag | Release Date |
22
| ---------------------------------------- | ------------ |
3+
| 26.3.4 | 2026-07-28 |
34
| 26.3.3 | 2026-07-10 |
45
| 26.3.2 | 2026-07-09 |
56
| 26.3.1 | 2026-07-06 |

‎docs/self-hosted/oel/oel-keto-image-tags.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| Image Tag | Release Date |
22
| ---------------------------------------- | ------------ |
3+
| 26.3.4 | 2026-07-28 |
34
| 26.3.3 | 2026-07-10 |
45
| 26.3.2 | 2026-07-09 |
56
| 26.3.1 | 2026-07-06 |

‎docs/self-hosted/oel/oel-kratos-image-tags.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| Image Tag | Release Date |
22
| ---------------------------------------- | ------------ |
3+
| 26.3.4 | 2026-07-28 |
34
| 26.3.3 | 2026-07-10 |
45
| 26.3.2 | 2026-07-09 |
56
| 26.3.1 | 2026-07-06 |

‎docs/self-hosted/oel/oel-oathkeeper-image-tags.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| Image Tag | Release Date |
22
| ---------------------------------------- | ------------ |
3+
| 26.3.4 | 2026-07-28 |
34
| 26.3.3 | 2026-07-10 |
45
| 26.3.2 | 2026-07-09 |
56
| 26.3.1 | 2026-07-06 |

‎docs/self-hosted/oel/oel-polis-image-tags.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| Image Tag | Release Date |
22
| ---------------------------------------- | ------------ |
3+
| 26.3.4 | 2026-07-28 |
34
| 26.3.3 | 2026-07-10 |
45
| 26.3.2 | 2026-07-09 |
56
| 26.3.1 | 2026-07-06 |

‎docs/self-hosted/oel/polis/changelog/v26.3.4.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
No changelog entries found for polis/oel in versions v26.3.4

0 commit comments

Comments
 (0)