Release v1.47.0

Added

• Hide sections of well known urls if Identity Federation is hidden.

Changed

• Updated dependencies

Full Changelog: v1.46.0...v1.47.0

Release v1.46.0

Added

• Support for routing Ory's local dev host

Changed

• Updated dependencies

Full Changelog: v1.45.3...v1.46.0

Release v1.45.3

Fixed

• PKCE flow requires a code_verifier for token exchange
• Support GET method for SLO callback

Changed

• Updated dependencies

Full Changelog: v1.45.2...v1.45.3

Release v1.45.2

Fixed

• Clear timers on db close. (thanks @Reductions)

Changed

• Updated dependencies

Full Changelog: v1.45.1...v1.45.2

Release v1.45.1

Added

• New configuration options to hide Audit Logs (ADMIN_PORTAL_HIDE_AUDIT_LOGS) and Identity Federation (ADMIN_PORTAL_HIDE_IDENTITY_FEDERATION) in the sidebar of the Admin Portal

Changed

• Updated dependencies

Full Changelog: v1.45.0...v1.45.1

Release v1.45.0

Added

• id_token now contains the full profile as claims

Fixed

• Disallow Private IPs as metadata URL to prevent potential SSRF attacks

Changed

• Updated dependencies

Full Changelog: v1.44.0...v1.45.0

Release v1.44.0

Added

• Added an option FLATTEN_RAW_CLAIMS to flatten the raw attribute in the OAuth2 profile

Fixed

• Added validation of SSO URL's in the SAML metadata to prevent potential XSS attacks
• Fixed validation of SAML connection APIs

Changed

• Updated dependencies

Full Changelog: v1.43.0...v1.44.0

Release v1.43.0

Added

• Added new attribute samlAudienceOverride to SAML connections, this can be used to override the SAML Audience if needed

Changed

• Updated dependencies

Full Changelog: v1.42.0...v1.43.0

Release v1.42.0

Please update to this version for critical security fixes.

Security Fixes

• Addresses CVE-2025-29774, CVE-2025-29775

Changed

• Updated dependencies

Full Changelog: v1.41.2...v1.42.0

Release v1.41.2

Changed

• Updated tag for OTEL db connections gauges

Full Changelog: v1.41.1...v1.41.2