All pull requests

Pull requests

• fix: propagate transient_payload to settings flow (#4609)

  #4612·Tyagiquamar opened Sep 23, 2026·

  ·
  1

  3

• fix: move session token exchanger to replacement flow in FromOldFlow (#4610)

  #4611·Tyagiquamar opened Sep 21, 2026·

  ·
  1

  1

• fix: propagate transient_payload to settings flow hooks

  #4608·icamys opened Sep 17, 2026·

  ·
  6

• feat(code): use 12-character lowercase alphanumeric one-time codes

  #4606·NikeNano opened Sep 16, 2026·

  ·
  4

• fix: clarify identity deletion usage and error output

  #4603·jjj-n opened Sep 11, 2026·

  ·
  1

  4

• feat(oidc): add suppress_generic_provider_nodes config

  #4602·NikeNano opened Sep 10, 2026·

  ·
  2

• fix: stop recording ErrCompletedByStrategy as a span error (closes #4109)

  #4597·pacocartones opened Aug 29, 2026·

  ·
  1

  5

• fix: prefer max-submissions error over stale CSRF

  #4596·BetterAndBetterII opened Aug 24, 2026·

  ·
  3

• fix: OIDC registration to login flow fails to invoke webhooks

  #4594·Roshan931 opened Aug 21, 2026·

  ·
  1

  5

• fix: construct missing-claims error before emitting event to avoid nil pointer panic

  #4593·waterWang opened Aug 21, 2026·

  ·
  1

  2

• feat: allow deleting the code credential via the admin API

  #4592·walter-hostaway opened Aug 13, 2026·

  ·
  1

  2

• fix: emit the OIDC configuration decode failure without the configuration

  #4587·jasonhernandez opened Jul 29, 2026·

  ·
  1

• feat: optionally resolve OIDC provider secrets from file:// and base64:// URIs

  #4586·jasonhernandez opened Jul 29, 2026·

  ·
  1

• docs: update examples in config.schema.json for domains

  #4583·unatasha8 opened Jul 16, 2026·

  ·
  3

• fix: handle JWKS with unsupported elliptic curves (Telegram OIDC)

  #4580·sergioperezcheco opened Jul 1, 2026·

  ·
  1

  8

• feat: allow disabling verification hook auto-inject

  #4577·David-Wobrock opened Jun 15, 2026Contributor·

  ·
  1

  3

• fix: duplicated "the" in clidoc/md_docs and oidc/provider_config comments

  #4567·oab24413gmai opened May 14, 2026·

  ·
  2

• fix: respect X-Forwarded-Prefix in RequestURL

  #4555·wyh0626 opened Apr 4, 2026·

  ·
  1

  2

• Xflow kratos deep

  #4546·deepesh-xflow opened Mar 10, 2026·

  ·
  1

• fix: preserve user_handle when adding a second WebAuthn security key

  #4543·Micaso opened Mar 4, 2026·

  ·
  1

  1

• feat: add OIDC third-party login initiation endpoint

  #4541·gmbuell opened Mar 2, 2026·

  ·

• feat: add login attempt throttling

  #4539·veeceey opened Feb 23, 2026·

  ·
  2

• feat: add use_oidc_discovery_issuer option for generic OIDC provider

  #4537·getlarge opened Feb 11, 2026·

  ·
  1

  2

• fix: use proper key format in ContinuityCookieManager and prevent panic in XChaCha20Poly1305

  #4532·d191 opened Jan 27, 2026·

  ·
  3

• feat: allow using identity external_id as oauth2 subject

  #4529·Micaso opened Jan 23, 2026·

  ·
  1

  22