4625 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
4 people	f85a2373c5	chore(test): streamline integration tests for instance management (#12243) ... - Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures. # Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed redundant relational instance handling in integration tests for adding and removing custom domains. - Simplified test cases by consolidating instance creation and context management. - Enhanced clarity and maintainability of test logic by reducing complexity in test structures.newly introduced terms). # Additional Context - related to https://github.com/zitadel/zitadel/pull/12241 --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-06-05 11:36:45 +00:00
Tim MöhlmannandGitHub	7019a03ec4	chore(test): disable event_testing in backend/v3 (#12241) ... # Which Problems Are Solved `backed/v3` tests are flaky, but the code is not productive. Development is paused for the moment. Disabling flaky tests helps us to maintain the product easier. # How the Problems Are Solved - Removed 'events_testing' from the integration test command in both `CONTRIBUTING.md` and `apps/api/project.json` to streamline the testing process. - Adjusted the command to ensure it only includes relevant integration tests, improving clarity and focus for contributors.	2026-06-05 10:46:49 +02:00
4 people	cdc6c43d09	fix: update dependencies (#12216) ... # Which Problems Are Solved Fixes open vulnerabilities # How the Problems Are Solved Updated npm/js dependencies across console, new login v2, and docs Based on https://github.com/zitadel/zitadel/pull/12164 --------- Co-authored-by: conblem <[email protected]> Co-authored-by: Livio Spring <[email protected]>	2026-06-04 14:33:04 +02:00
4 people	fc6e2a0f05	fix(login): retry logic for session creation after registration on NotFound (#12189) ... After user registration, the backend projections may not be up to date yet when the Login UI immediately tries to create a session. This results in a `QUERY-Dfbg2` ("User could not be found") error even though the user was created successfully. This adds retry logic with backoff (500ms/1s/2s, up to 3 attempts) around `createSessionAndUpdateCookie` in the registration flow. Only `NotFound` errors are retried — other errors are thrown immediately. Closes #12173 --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>	2026-06-01 16:49:07 +02:00
3 people	f4f43f5248	docs: fix broken GitHub code-reference blocks after fumadocs migration (#12213) ... # Which Problems Are Solved Pages in `apps/docs` that embed source from GitHub via the Docusaurus convention ```` ```js reference https://github.com/zitadel/actions/blob/main/examples/org_metadata_claim.js ``` ```` stopped working after the migration from Docusaurus to fumadocs. The old `docusaurus-theme-github-codeblock` plugin used to fetch the file and render it; fumadocs has no support for that meta, so the page rendered the raw URL as plain code-block text. Visible at `/docs/apis/actions/code-examples` and 16 other pages. # How the Problems Are Solved - Converted every ```` ```<lang> reference\n<URL>\n``` ```` block (46 total across 17 `.mdx` files) to the native fumadocs JSX form: `<GithubCodeBlock url="<URL>" />`. The existing `<details>`/`<summary>` collapsibles around blocks are kept — they're an authoring choice, not part of the rendering bug. - Updated `apps/docs/components/github-code-block.tsx` to render via `DynamicCodeBlock` from `fumadocs-ui/components/dynamic-codeblock` (proper shiki highlighting) instead of raw `CodeBlock` + `Pre` (which produced unhighlighted output). Also fixed language detection so a URL hash like `#L10-L20` no longer pollutes the language token. - Registered `GithubCodeBlock` globally in `apps/docs/mdx-components.tsx`, matching how every other shared component (`APIPage`, `Callout`, `Tab/Tabs`, `Step/Steps`, `Admonition`, `TerminologyUpdate`) is exposed. MDX files no longer need a local `import`. # Additional Changes - Normalized the two MDX files that were already using the JSX form (`examples/secure-api/python-django.mdx`, `examples/secure-api/java-spring.mdx`): removed their now-redundant local `import { GithubCodeBlock }` and rewrote 9 long-form `<GithubCodeBlock url="..."></GithubCodeBlock>` tags to self-closing for consistency. # Additional Context Verified locally with `pnpm --filter @zitadel/docs dev`: - `/docs/apis/actions/code-examples` — 20 shiki-highlighted code blocks rendered inside the `<details>` collapsibles (was 0). - `/docs/apis/openidoauth/claims` — line-range hashes (`#L9-L11`) honored. - `/docs/examples/login/flutter` — mixed languages (xml/dart/html) detected and highlighted. - `/docs/guides/integrate/external-audit-log` — edge case of fenced reference indented inside a numbered list also converted and rendered. Greps: - `^[ \t]*\`\`\`[a-zA-Z0-9]+ reference` in `apps/docs/content/**/*.mdx` → 0 matches. - `<GithubCodeBlock url="` in `apps/docs/content/**/*.mdx` → 55 matches. - `from '@/components/github-code-block'` in `apps/docs/content/**/*.mdx` → 0 matches. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>	2026-05-28 11:02:44 -07:00
Marco A.andGitHub	c73e58489b	chore(deps): Update go-ntlmssp (#12193) ... # Which Problems Are Solved Dependabot signalling that go-ntlmssp requires an update # How the Problems Are Solved `go get -u`	2026-05-26 09:32:11 +02:00
4 people	349451b028	chore(deps): bump the console group across 1 directory with 31 updates (#12183) ... Bumps the console group with 31 updates in the /console directory: | Package | From | To | | --- | --- | --- | | [@angular/animations](https://github.com/angular/angular/tree/HEAD/packages/animations) | `21.2.10` | `21.2.13` | | [@angular/cdk](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common) | `21.2.10` | `21.2.13` | | [@angular/compiler](https://github.com/angular/angular/tree/HEAD/packages/compiler) | `21.2.10` | `21.2.13` | | [@angular/core](https://github.com/angular/angular/tree/HEAD/packages/core) | `21.2.10` | `21.2.13` | | [@angular/forms](https://github.com/angular/angular/tree/HEAD/packages/forms) | `21.2.10` | `21.2.13` | | [@angular/material](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/material-moment-adapter](https://github.com/angular/components) | `21.2.8` | `21.2.11` | | [@angular/platform-browser](https://github.com/angular/angular/tree/HEAD/packages/platform-browser) | `21.2.10` | `21.2.13` | | [@angular/platform-browser-dynamic](https://github.com/angular/angular/tree/HEAD/packages/platform-browser-dynamic) | `21.2.10` | `21.2.13` | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `21.2.10` | `21.2.13` | | [@angular/service-worker](https://github.com/angular/angular/tree/HEAD/packages/service-worker) | `21.2.10` | `21.2.13` | | [@tanstack/angular-query-experimental](https://github.com/TanStack/query/tree/HEAD/packages/angular-query-experimental) | `5.100.5` | `5.100.11` | | [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) | `1.12.42` | `1.13.2` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.372.3` | `1.374.2` | | [zone.js](https://github.com/angular/angular/tree/HEAD/packages/zone.js) | `0.16.1` | `0.16.2` | | [@angular-eslint/eslint-plugin](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin) | `21.3.1` | `21.4.0` | | [@angular-eslint/eslint-plugin-template](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/eslint-plugin-template) | `21.3.1` | `21.4.0` | | [@angular-eslint/template-parser](https://github.com/angular-eslint/angular-eslint/tree/HEAD/packages/template-parser) | `21.3.1` | `21.4.0` | | [@angular/build](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/cli](https://github.com/angular/angular-cli) | `21.2.8` | `21.2.11` | | [@angular/compiler-cli](https://github.com/angular/angular/tree/HEAD/packages/compiler-cli) | `21.2.10` | `21.2.13` | | [@angular/language-service](https://github.com/angular/angular/tree/HEAD/packages/language-service) | `21.2.10` | `21.2.13` | | [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.2.4` | `4.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.1` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.59.1` | `8.59.4` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.59.1` | `8.59.4` | | [eslint](https://github.com/eslint/eslint) | `10.2.1` | `10.4.0` | | [globals](https://github.com/sindresorhus/globals) | `17.5.0` | `17.6.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.12` | `8.5.15` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.2.4` | `4.3.0` | Updates `@angular/animations` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/animations's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/animations's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/animations">compare view</a></li> </ul> </details> <br /> Updates `@angular/cdk` from 21.2.8 to 21.2.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/components/releases">@​angular/cdk's releases</a>.</em></p> <blockquote> <h2>21.2.11</h2> <p>No user facing changes in this release</p> <h2>21.2.10</h2> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><img src="https://img.shields.io/badge/48973661e-fix-green" alt="fix - 48973661e" /></a></td> <td><strong>menu:</strong> do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</td> </tr> </tbody> </table> <h2>21.2.9</h2> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/51271c6194a9b55ee847c566a8960c9be5ec7cce"><img src="https://img.shields.io/badge/51271c619-fix-green" alt="fix - 51271c619" /></a></td> <td><strong>stepper:</strong> allow stepper to be labelled (<a href="https://redirect.github.com/angular/components/issues/33137">#33137</a>)</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/3a3852d45a4bbcfb23b46ca00e0eba1d70081ba3"><img src="https://img.shields.io/badge/3a3852d45-fix-green" alt="fix - 3a3852d45" /></a></td> <td><strong>tree:</strong> enter/space key on child node should not toggle parent node expansion (<a href="https://redirect.github.com/angular/components/issues/33125">#33125</a>)</td> </tr> </tbody> </table> <h3>aria</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/bf14cc9d9fd349974cba853d4747b6859b3aae5b"><img src="https://img.shields.io/badge/bf14cc9d9-fix-green" alt="fix - bf14cc9d9" /></a></td> <td><strong>menu:</strong> use computed for menu item patterns, with trigger on visible (<a href="https://redirect.github.com/angular/components/issues/33118">#33118</a>)</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/components/blob/main/CHANGELOG.md">@​angular/cdk's changelog</a>.</em></p> <blockquote> <h1>21.2.11 &quot;crystal ball&quot; (2026-05-13)</h1> <p>No user facing changes in this release</p> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.8 &quot;plastic-wallaby&quot; (2026-05-06)</h1> <h2>Breaking Changes</h2> <h3>aria</h3> <ul> <li> <p>The legacy combobox and autocomplete implementations have been removed. Use the new standalone combobox instead.</p> <ul> <li>feat(aria/combobox): promote simple-combobox to stable un-prefixed combobox</li> </ul> <ul> <li>Relocates public, private, and example directories to clean <code>combobox</code> entry points.</li> <li>Renames internal layout symbols, selectors, and uppercase tokens (<code>SIMPLE_COMBOBOX_POPUP</code> -&gt; <code>COMBOBOX_POPUP</code>).</li> <li>Establishes full documentation extraction parity with the <code>json_api</code> Bazel rule target.</li> <li>Standardizes the accompanying toolbar component showcase into the clean <code>aria-toolbar</code> path.</li> <li>Re-routes dev-app navigation links and migrates public API golden records.</li> </ul> </li> <li> <p><code>SimpleCombobox</code> has been promoted to <code>Combobox</code>. All <code>simple-combobox</code> prefixed symbols, selectors, and tokens have been renamed to use the <code>combobox</code> prefix.</p> <ul> <li>refactor(aria/combobox): relocate and restructure autocomplete and toolbar examples Relocate the autocomplete examples to <code>src/components-examples/aria/autocomplete</code> and toolbar examples to <code>src/components-examples/aria/toolbar</code>.</li> </ul> <ul> <li>Restore naming continuity with the historical codebase by stripping redundant prefixes from example filenames and component selectors.</li> <li>Sync dev-app preview routing layout paths and strict Bazel target dependency links.</li> </ul> </li> </ul> <h3>cdk</h3> <ul> <li> <ul> <li><code>CDK_DESCRIBEDBY_HOST_ATTRIBUTE</code> has been removed.</li> <li><code>CDK_DESCRIBEDBY_ID_PREFIX</code> has been removed.</li> <li>The <code>injector</code> parameter of the <code>ConfigurableFocusTrap</code> and <code>FocusTrap</code> constructors is now required.</li> <li>The boolean parameter of <code>ConfigurableFocusTrapFactory.create</code> has been replaced with a config object.</li> <li><code>MESSAGES_CONTAINER_ID</code> has been removed.</li> </ul> </li> <li> <ul> <li>The <code>event</code> parameter of <code>DropListRef.drop</code> is now required.</li> </ul> </li> <li> <ul> <li><code>ContextMenuTracker</code> has been renamed to <code>MenuTracker</code>.</li> </ul> </li> </ul> <h3>material</h3> <ul> <li> <ul> <li><code>MatListOption.checkboxPosition</code> has been removed. use <code>togglePosition</code> instead.</li> <li><code>MatListOptionCheckboxPosition</code> has been renamed to <code>MatListOptionTogglePosition</code>.</li> </ul> </li> <li> <ul> <li><code>ArrowViewState</code> has been removed.</li> <li><code>ArrowViewStateTransition</code> has been removed.</li> </ul> </li> </ul> <h3>google-maps</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/b8201edeef62258c3d1e1ebeaf8ee14766918c22">b8201edee</a></td> <td>fix</td> <td>deprecate heatmap layer (<a href="https://redirect.github.com/angular/components/pull/33208">#33208</a>)</td> </tr> </tbody> </table> <h3>material</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/components/commit/add8f16c01ad683b9e2ab9e1bf5ad3a984dd9921">add8f16c0</a></td> <td>fix</td> <td><strong>list:</strong> breaking changes for v22</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/9d73c98b57d46454d51344bbd59055bc06dabc6b">9d73c98b5</a></td> <td>fix</td> <td><strong>menu:</strong> missing panelClass getter (<a href="https://redirect.github.com/angular/components/pull/33191">#33191</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/components/commit/75718e4fbebce2a7f8aa30550a12d58a5a6f9b93">75718e4fb</a></td> <td>fix</td> <td><strong>sort:</strong> breaking changes for v22</td> </tr> </tbody> </table> <h3>cdk</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/components/commit/1238d1573e706cbf0a2cabcc97e59d28a9499ecb"><code>1238d15</code></a> release: cut the v21.2.11 release</li> <li><a href="https://github.com/angular/components/commit/583da8a564dcb667cb8928e79d286eadee0a5013"><code>583da8a</code></a> release: cut the v21.2.10 release</li> <li><a href="https://github.com/angular/components/commit/babfbb7430547d5f4558174aec1a07ce6c67a26f"><code>babfbb7</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33205">#33205</a>)</li> <li><a href="https://github.com/angular/components/commit/e08fdf2a6a120078b512043bf5804bc3c7f9716a"><code>e08fdf2</code></a> build: fix failing test (<a href="https://redirect.github.com/angular/components/issues/33212">#33212</a>)</li> <li><a href="https://github.com/angular/components/commit/09e89fa188f157c0892019a461459cd9a252a673"><code>09e89fa</code></a> build: lock file maintenance (<a href="https://redirect.github.com/angular/components/issues/33201">#33201</a>)</li> <li><a href="https://github.com/angular/components/commit/48973661ec50649918e3dcafc096d340219135da"><code>4897366</code></a> fix(aria/menu): do not set default aria-label (<a href="https://redirect.github.com/angular/components/issues/33202">#33202</a>)</li> <li><a href="https://github.com/angular/components/commit/a6c5b72562b9d46ea3c10a2ecb668e013b46a103"><code>a6c5b72</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33181">#33181</a>)</li> <li><a href="https://github.com/angular/components/commit/b7c34e306539716a1222468907ad4af5fb6b1aee"><code>b7c34e3</code></a> build: update cross-repo angular dependencies (<a href="https://redirect.github.com/angular/components/issues/33160">#33160</a>)</li> <li><a href="https://github.com/angular/components/commit/58e29cf1aa8265d6041350c716c5fbfa9e25b738"><code>58e29cf</code></a> build: update dependency bazel_lib to v3.3.1 (<a href="https://redirect.github.com/angular/components/issues/33177">#33177</a>)</li> <li><a href="https://github.com/angular/components/commit/e2f16ac34e93e69b1ef960ba70c517de799d05cc"><code>e2f16ac</code></a> build: update pnpm to v10.33.2 (<a href="https://redirect.github.com/angular/components/issues/33165">#33165</a>)</li> <li>Additional commits viewable in <a href="https://github.com/angular/components/compare/v21.2.8...v21.2.11">compare view</a></li> </ul> </details> <br /> Updates `@angular/common` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/common's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/common's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/30cf85f71c52683016200ecf6d68b4418084ee6e"><code>30cf85f</code></a> refactor(common): update deprecation message</li> <li><a href="https://github.com/angular/angular/commit/42d57c35781fb65fc4d44df59b6a85287664216a"><code>42d57c3</code></a> refactor(common): fix viewport tests</li> <li><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><code>10ad3c0</code></a> fix(common): prevent focus from scrollToAnchor</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/common">compare view</a></li> </ul> </details> <br /> Updates `@angular/compiler` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/compiler's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/compiler's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/baf92da96ed73a0f4748edf05d3c0702cab219da"><code>baf92da</code></a> test: remove invalid css that was causing issues with the postcss parser</li> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><code>4f5d8a2</code></a> fix(compiler): let declaration span not including end character</li> <li>See full diff in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/compiler">compare view</a></li> </ul> </details> <br /> Updates `@angular/core` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/core's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/core's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/0f2160c4105a53ef6488d2c799dda9c0959ce7dc">0f2160c410</a></td> <td>fix</td> <td>remove compiler import from safe optional chaining migration</td> </tr> </tbody> </table> <h3>platform-server</h3> <p>| Commit | Type | Description |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><code>1c6553e</code></a> fix(core): disallow event attribute bindings in host bindings unconditionally</li> <li><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><code>9e38ed7</code></a> fix(core): sanitizer typings</li> <li><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><code>3430251</code></a> fix(core): i18n flags leaking on errors</li> <li><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><code>c37f6ca</code></a> fix(core): visit ng-let expression value in signal migration schematics</li> <li><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><code>fe13bb6</code></a> fix(core): allow explicit read generic with signal input transforms</li> <li><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><code>7a05a9a</code></a> fix(core): validate security-sensitive attributes in i18n bindings</li> <li><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><code>1aeebbe</code></a> fix(core): respect ngSkipHydration on components with projectable nodes in LC...</li> <li><a href="https://github.com/angular/angular/commit/4900e453e1a2e9351ad2672a804d876ff5a62968"><code>4900e45</code></a> build: update cross-repo angular dependencies</li> <li><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><code>a40e2ce</code></a> fix(core): fix ordering of view queries metadata in JIT mode</li> <li><a href="https://github.com/angular/angular/commit/9bcbf376413632590ef1fb1cebe68d049d9bd45b"><code>9bcbf37</code></a> refactor(core): fix bundling symbol test</li> <li>Additional commits viewable in <a href="https://github.com/angular/angular/commits/v21.2.13/packages/core">compare view</a></li> </ul> </details> <br /> Updates `@angular/forms` from 21.2.10 to 21.2.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/releases">@​angular/forms's releases</a>.</em></p> <blockquote> <h2>21.2.13</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947"><img src="https://img.shields.io/badge/1c6553e97d-fix-green" alt="fix - 1c6553e97d" /></a></td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215"><img src="https://img.shields.io/badge/629905d537-fix-green" alt="fix - 629905d537" /></a></td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f"><img src="https://img.shields.io/badge/0b7192f441-fix-green" alt="fix - 0b7192f441" /></a></td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <h2>21.2.12</h2> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/fe13bb669d2bfab4713623d17b41c430aa0a61d8"><img src="https://img.shields.io/badge/fe13bb669d-fix-green" alt="fix - fe13bb669d" /></a></td> <td>allow explicit read generic with signal input transforms</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/3430251fef93f6aec1fa9c7867e85df23f67c9a0"><img src="https://img.shields.io/badge/3430251fef-fix-green" alt="fix - 3430251fef" /></a></td> <td>i18n flags leaking on errors</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/1aeebbe3048b5aa612dd0a5448de9883ed51e7e8"><img src="https://img.shields.io/badge/1aeebbe304-fix-green" alt="fix - 1aeebbe304" /></a></td> <td>respect ngSkipHydration on components with projectable nodes in LContainers</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/9e38ed7d5773a9193ba07afdba3f7a9f2fe02d18"><img src="https://img.shields.io/badge/9e38ed7d57-fix-green" alt="fix - 9e38ed7d57" /></a></td> <td>sanitizer typings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a05a9a71a5ab75042ec5560c01526de6e61e062"><img src="https://img.shields.io/badge/7a05a9a71a-fix-green" alt="fix - 7a05a9a71a" /></a></td> <td>validate security-sensitive attributes in i18n bindings</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/c37f6ca42f263353cb9563fa90d7b31d3c7837ca"><img src="https://img.shields.io/badge/c37f6ca42f-fix-green" alt="fix - c37f6ca42f" /></a></td> <td>visit ng-let expression value in signal migration schematics</td> </tr> </tbody> </table> <h3>forms</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/03ad53863bf3c368f0f02a4322d4141e8f70f674"><img src="https://img.shields.io/badge/03ad53863b-fix-green" alt="fix - 03ad53863b" /></a></td> <td>prohibit concurrent submits in signal forms</td> </tr> </tbody> </table> <h2>21.2.11</h2> <h3>common</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/10ad3c06923453ae0ec06b06e664ce05900a4ff6"><img src="https://img.shields.io/badge/10ad3c0692-fix-green" alt="fix - 10ad3c0692" /></a></td> <td>prevent focus from scrollToAnchor</td> </tr> </tbody> </table> <h3>compiler</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/4f5d8a2c0b5e38d4debc4293945270cea4a9590d"><img src="https://img.shields.io/badge/4f5d8a2c0b-fix-green" alt="fix - 4f5d8a2c0b" /></a></td> <td>let declaration span not including end character</td> </tr> </tbody> </table> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/a40e2cebc878965c3e21bfb61658f3f80cbd2ebf"><img src="https://img.shields.io/badge/a40e2cebc8-fix-green" alt="fix - a40e2cebc8" /></a></td> <td>fix ordering of view queries metadata in JIT mode</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/885a1a1d9757adfa8766d9b369c848a277438c31"><img src="https://img.shields.io/badge/885a1a1d97-fix-green" alt="fix - 885a1a1d97" /></a></td> <td>guard against non-object events and avoid listener wrapper identity mismatch</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/7a64aff9b59999077ea915486a7fa0b97a286659"><img src="https://img.shields.io/badge/7a64aff9b5-fix-green" alt="fix - 7a64aff9b5" /></a></td> <td>prevent event replay double-invocation when element hydrates before app stability</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/be1f80a253b8ee27ed7d8de2287d6895c4821909"><img src="https://img.shields.io/badge/be1f80a253-fix-green" alt="fix - be1f80a253" /></a></td> <td>ensure origin has a trailing slash when parsing url</td> </tr> </tbody> </table> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/angular/angular/blob/main/CHANGELOG.md">@​angular/forms's changelog</a>.</em></p> <blockquote> <h1>21.2.13 (2026-05-13)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/1c6553e97d9655d8c48fbf625987fae86f9cd947">1c6553e97d</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/629905d537f59dc3c264c49f6347e3599dea0215">629905d537</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/0b7192f4410d055191ac9b15bff57d1d0b9a644f">0b7192f441</a></td> <td>fix</td> <td>forward BEFORE_APP_SERIALIZED errors to ErrorHandler</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>19.2.22 (2026-05-12)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/83a640516f7b1fff4dfb0fd0ed8b19876bdb00c4">83a640516f</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/24a0103a9898b1547f5d1f57314e2bb6545a2c7a">24a0103a98</a></td> <td>fix</td> <td>validate security-sensitive attributes in i18n bindings (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8569db88758d189544b03ec4474fd5334ff29346">8569db8875</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/837a7102172502dd3d92793ec15b2d4e533a573d">837a710217</a></td> <td>fix</td> <td>ensure origin has a trailing slash when parsing url (<a href="https://redirect.github.com/angular/angular/pull/68469">#68469</a>)</td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>20.3.21 (2026-05-12)</h1> <h3>platform-server</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/f584840e2e50f751397cf3fad5258e18e857427e">f584840e2e</a></td> <td>fix</td> <td>add <code>allowedHosts</code> option to <code>renderModule</code> and <code>renderApplication</code></td> </tr> </tbody> </table> <!-- raw HTML omitted --> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h1>22.0.0-next.12 (2026-05-08)</h1> <h3>core</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/angular/angular/commit/8ebae1de330729f945391283e25661aada11b4ed">8ebae1de33</a></td> <td>fix</td> <td>allow service with factory on abstract classes</td> </tr> <tr> <td><a href="https://github.com/angular/angular/commit/6f525245cd97a934b2b5ea888ee9d52c26c58cb5">6f525245cd</a></td> <td>fix</td> <td>disallow event attribute bindings in host bindings unconditionally</td> </tr> </tbody> </table> <h3>migrations</h3> <table> <thead> <tr> <th>Commit</th> <th>Type</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><a href="https:... _Description has been truncated_ --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco A. <[email protected]>	2026-05-25 11:14:11 +02:00
3 people	404c23834a	fix(login): redirect to email verification when forced MFA has no visible factors (#12060) ... # Which Problems Are Solved When MFA is enforced with only Email OTP as a second factor, new users hit a dead end on the MFA setup screen. The `ChooseSecondFactorToSetup` component hides Email OTP when `emailVerified` is `false`, and if email verification was skipped earlier in the flow (e.g. `EMAIL_VERIFICATION` env not set to `"true"`), no MFA options are visible and the user cannot proceed. # How the Problems Are Solved In the MFA setup server component (`mfa/set/page.tsx`), before rendering, detect when forced MFA has no visible second factors because all configured factors require verification the user hasn't completed. When Email OTP is configured but the user's email is unverified, redirect to `/verify` with `send=true` so a verification code is sent immediately. After the user verifies their email, the existing flow in `verify.ts` calls `checkMFAFactors` which redirects back to `/mfa/set` — where Email OTP is now visible since `emailVerified` is `true`. The redirect pattern follows the existing precedent in `authenticator/set/page.tsx`. # Additional Changes None # Additional Context - Closes #11536 --------- Co-authored-by: Max Peintner <[email protected]>	2026-05-22 11:40:40 +00:00
Federico CoppedeandGitHub	b4f2da2171	docs: Add Gateway API routing to Kubernetes deployment guide (#12168) ... ## Description This PR updates the Kubernetes deployment documentation to address user feedback regarding our routing instructions. A user noted that standard `Ingress` is becoming outdated and requested configuration examples for the modern Gateway API. To support both existing and modern clusters, I have updated the guide to provide two clear pathways for exposing ZITADEL. ## Changes Included * **Prerequisites updated:** Mentioned Gateway API controllers alongside standard Ingress controllers. * **Refactored Stage 2 (Production):** Split the routing configuration into "Option A: Standard Ingress" and "Option B: Gateway API". * **Added YAML example:** Provided a sample `HTTPRoute` resource to route traffic to the `zitadel` and `zitadel-login` backend services. * **Terminology updates:** Broadened terms like "Ingress" to "Routing" or "Routing controller" where applicable.	2026-05-18 20:03:27 +05:30
Federico CoppedeandGitHub	ecfe72b509	docs: update vue repo url (#12160) ... fix broken vue repo url	2026-05-12 11:51:05 +00:00
3 people	96b3f3dd35	fix(login): apply custom request headers from environment variable in proxy (#12144) ... Closes #12125 # Which Problems Are Solved The proxy middleware (proxy.ts) did not apply `CUSTOM_REQUEST_HEADERS` to rewritten requests (/.well-known/*, /oauth/*, /oidc/*, etc.). When `ZITADEL_API_URL` points to an internal service name, the Host header on proxied requests remained the internal name instead of the configured public domain, causing Errors.Instance.NotFound. # How the Problems Are Solved The other two outgoing request paths — the connectRPC transport and the security-settings fetch — already applied these headers. This adds the same applyCustomHeaders() call to the proxy path. Co-authored-by: Ramon <[email protected]>	2026-05-12 08:34:39 +02:00
Federico CoppedeandGitHub	1b8b0ac410	docs: move customer portal docs to knowledge base (#12147) ... Moved the Customer Portal Documentation to the knowledge base (help.zitadel.com)	2026-05-10 21:42:08 -03:00
Livio SpringandGitHub	08007da70e	Merge commit from fork	2026-05-04 07:05:54 +02:00
4 people	64737bfedf	chore: deps update (#12114) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved Outdated depdencies # How the Problems Are Solved This PR mostly just updates our NPM depdencies to the newest feature releases. The UUID package was update to version 14, the changelog only includes changes to the supported node version. # Additional Changes Replace tsx for some scripts in the docs. --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: Max Peintner <[email protected]>	2026-04-30 14:02:28 +00:00
5 people	942c959d09	fix(login): resolve localized legal links in signup (#11913) ... # Which Problems Are Solved - Login V2 signup does not resolve the `{{.Lang}}` placeholder in ToS, Privacy Policy, and help links. - Clicking those links on the registration page can open URL-encoded placeholders like `%7B%7B.Lang%7D%7D` instead of the active language-specific page. # How the Problems Are Solved - Adds a small login utility to resolve `{{.Lang}}` placeholders against the active Login V2 locale. - Updates the signup legal acceptance component to use the resolved links before rendering them. - Applies the same resolution to the optional help link shown alongside the legal acceptance text. # Additional Changes - Adds unit tests for the link placeholder resolver. - Adds a component test covering localized ToS, Privacy Policy, and help links on the signup page. # Additional Context - Closes #11907 --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Max Peintner <[email protected]> Co-authored-by: Max Peintner <[email protected]>	2026-04-30 13:45:03 +00:00
4 people	b1c8781516	fix(login): lru-cache compatibility, improve session error handling (#12099) ... # Which Problems Are Solved - Logo and heading overlap on login pages due to a -mb-4 negative margin on the logo container - The /login route returns a 500 when `listSessions` fails (e.g. stale session cookies), because loadSessions has no error handling. - The proxy logs `"fetch() returned undefined"` because `fetchIframeOrigins` returns undefined, which lru-cache's forceFetch treats as a fetch failure. # How the Problems Are Solved - Remove `-mb-4` from the logo container in DynamicTheme. - Wrap `loadSessions` in a try/catch — failures fall through as empty sessions instead of crashing. - Return `null` instead of `undefined` from `fetchIframeOrigins` so lru-cache caches it normally. --------- Co-authored-by: Livio Spring <[email protected]> Co-authored-by: conblem <[email protected]>	2026-04-30 15:27:44 +02:00
4 people	13f8ba4215	fix(console): delete role assignment in admin profile #10376 (#11867) ... # Which Problems Are Solved Currently it's not possible to delete role assignments in the user profile. <img width="1026" height="516" alt="CleanShot 2026-03-18 at 10 50 01" src="https://github.com/user-attachments/assets/7b8eb316-852b-4c16-9f4b-4c041215e410" /> # How the Problems Are Solved Switched the removal of role assignments to the newer [Delete Authorization call](https://zitadel.com/docs/reference/api/authorization/zitadel.authorization.v2.AuthorizationService.DeleteAuthorization). # Additional Changes Correctly pass the role assignment id based on the context of the call. # Additional Context - Closes: #10376 --------- Co-authored-by: Max Peintner <[email protected]> Co-authored-by: Max Peintner <[email protected]>	2026-04-29 10:32:49 +02:00
3 people	2c8d63bb71	feat(console): improve client details dialog ux #11834 (#11836) ... # Which Problems Are Solved The console provided conflicting warnings when creating a pkce based project. # How the Problems Are Solved <img width="1026" height="432" alt="grafik" src="https://github.com/user-attachments/assets/d6609d2d-1438-42bd-9bc4-2e896c3e47d9" /> Removed the `keep your client secret at a safe place...` warning when a auth-method without a client secret is used. Changed the dialog title to `Client Details` instead of `Client Secret` # Additional Changes - Improves type safety for data passed to the `AppSecretDialogComponent`. - Updates the `AppSecretDialogComponent` to use modern Angular features, improving readability and maintainability. # Additional Context - Closes #11834 --------- Co-authored-by: Max Peintner <[email protected]>	2026-04-29 08:46:49 +02:00
RamonandGitHub	83919d82b4	fix(console): display actions v1 with correct permissions #12001 (#12068) ... # Which Problems Are Solved - Users needed broader IAM read permissions to access the Actions V1 page in the console. # How the Problems Are Solved - Updates the console route configuration for `/actions` to require `org.action.read`. # Additional Context - Closes #12001	2026-04-28 17:25:21 +02:00
Florian ForsterandGitHub	24d0f34f39	perf: optimize docs static generation cost (#12108) ... ## Summary - Switch the docs catch-all route to full static generation and prebuild both latest and versioned docs paths. - Prebuild OG images for all docs pages, make sitemap and LLM export static, and remove nondeterministic sitemap timestamps. - Reduce build-time overhead by memoizing docs sidebar trees and skipping processed markdown generation for versioned docs. ## Testing - `pnpm nx run @zitadel/docs:build` - `pnpm nx run @zitadel/docs:lint` - `pnpm nx run @zitadel/docs:check-types` - Verified the prerender manifest contains 8,816 prerendered routes, 3,293 versioned docs routes, 4,406 OG routes, and zero revalidating docs routes.	2026-04-27 15:34:00 +00:00
Federico CoppedeandGitHub	f96a9c54ac	docs: clarify exp and iat claim precedence for private key JWTs (#12110) ... This PR updates the "Private Key JWT Auth for Service Accounts" documentation to explicitly clarify the relationship between the exp (expiration) and iat (issued at) claims. Previously, the documentation didn't make it clear what happens if a developer sets an exp claim far into the future. This update clarifies that while the exp value is strictly enforced, the iat claim takes precedence if the exp is set to more than 1 hour in the future (i.e., ZITADEL will reject the JWT once the iat is older than 1 hour, regardless of the exp time). **Changes included:** Updated the description of the exp claim in the JWT payload section to highlight the 1-hour iat limit enforcement.	2026-04-27 14:58:50 +02:00
3 people	314b1b50dd	docs: eliminate runtime ISR writes via full SSG (#12103) ... # Which Problems Are Solved The Vercel `docs` project generated ~64M ISR writes over 30 days (99.5% of ISR writes across all projects, ~\$258/month). Root causes in the Next.js 16 docs app: - `apps/docs/app/[[...slug]]/page.tsx` had `dynamicParams = true` + `revalidate = 3600`. Bot traffic hitting unknown URLs (`/docs/wp-admin`, `/docs/.env`, fuzzed paths) got rendered via \`notFound()\`, and the 404 response was cached as an ISR entry — 1 write per unique bad URL. Known pages were also rewritten hourly for no reason since content only changes on deploy. - `apps/docs/app/og/docs/[...slug]/route.tsx` had `revalidate = false` + empty `generateStaticParams()` + implicit `dynamicParams = true`. Every unique OG URL (including bot probes) was cached forever — writes accumulated permanently. # How the Problems Are Solved Switch the docs routes to pure SSG (content is static and only changes on deploy, so ISR provides no value): - `app/[[...slug]]/page.tsx`: `dynamicParams = false`, `revalidate = false`, `dynamic = 'force-static'`. Unknown URLs now return a static 404 at the CDN — no function invocation, no ISR write. All 390 pages from `source.generateParams()` are still pre-rendered. - `app/og/docs/[...slug]/route.tsx`: `generateStaticParams()` now returns all 390 pages via the existing `getPageImage(page).segments` helper, so every OG image is pre-built as a static asset. `dynamicParams = false` + `dynamic = 'force-static'` locks it down. - `app/llms-full.txt/route.ts`: added `dynamic = 'force-static'` as a safety net (already `revalidate = false`, single URL). The tradeoff is longer CI builds (~40s–2min for 390 OG image generations, paid on every preview deploy) in exchange for eliminating ~\$258/month in ISR writes plus associated function invocations and CPU time. # Additional Changes None. # Additional Context - No changes to `next.config.mjs`, `vercel.json`, or redirects. - Existing `apps/docs/redirects.json` (3,261 entries) covers legacy URLs so `dynamicParams = false` won't 404 moved pages linked from elsewhere. - Versioned routes: `content/versions.json` and `v*/` folders don't exist yet. When versioning is activated, `generateStaticParams()` in both files must also include `versionSource.generateParams()` — otherwise versioned URLs will 404 under `dynamicParams = false`. ## Test plan - [ ] CI build succeeds (expect modest build-time increase for OG pre-generation) - [ ] Inspect `apps/docs/.next/prerender-manifest.json` — all 390 doc routes + 390 OG routes listed with `initialRevalidateSeconds: false` - [ ] Local smoke: `/docs` → 200, `/docs/wp-admin` → 404 (static, no function), `/docs/og/docs/guides/start/image.png` → PNG, `/docs/og/docs/bogus/image.png` → 404 - [ ] Post-deploy: Vercel **ISR Writes** metric drops to near-zero within 24h - [ ] Post-deploy: Vercel **Function Invocations** for `/og/docs/*` drop to zero - [ ] Verify no legitimate docs pages 404 (cross-check logs against `apps/docs/app/sitemap.ts`) --------- Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>	2026-04-24 12:34:57 -03:00
Livio SpringandGitHub	cc74a36b65	chore(deps): update go dependencies (#12094) ... This PR updates all (possible) go dependencies and requires a backport to v4.x	2026-04-23 14:04:10 +02:00
Max PeintnerandGitHub	de98c6edb8	fix(login): ClassifiedConnectError breaking ConnectError instanceof checks (#12022) ... # Which Problems Are Solved 1. SSL/TLS handshake failures on Cloud Run (middleware self-loopback) PR #11903 changed the middleware (proxy.ts) to fetch security settings via fetch(origin + "/security") on every request, including non-proxy routes like /login. On Cloud Run, this self-loopback goes through the Google Front End (GFE) load balancer, causing intermittent SSL routines::record layer failure errors that were tenant-consistent. 2. The ClassifiedConnectError introduced in #11926 set this.name = "ClassifiedConnectError", which broke ConnectError's custom Symbol.hasInstance duck-typing check (v.name === "ConnectError"). This caused ConnectError.from() inside the connectRPC transport's abort handler to re-wrap classified errors as new ConnectError instances with Code.Unknown — losing the original gRPC error code and all classification metadata. # How the Problems Are Solved Middleware: eliminate self-loopback fetch: - Replaced the fetch(origin + "/security") self-loopback with a direct fetch to ZITADEL_API_URL using the Connect protocol (POST + JSON), bypassing the load balancer entirely - Security settings are cached in-memory with a 1-hour TTL per instance host - Extracted the fetching/caching logic into src/lib/server/security-settings.ts Removed the now-unused /security API route (src/app/security/route.ts) - CSP headers with iframe origins are now applied to all routes without any loopback Error classification interceptor: fixed - Keep this.name = "ConnectError" in ClassifiedConnectError so the duck-typing Symbol.hasInstance check passes - The branded Symbol.for check via isClassifiedError() still correctly distinguishes the subclass - Remove redundant Object.setPrototypeOf call (the super constructor already handles it via new.target) - Replace remaining instanceof ConnectError checks with isClassifiedError() in setUserPassword and checkSessionAndSetPassword	2026-04-23 09:11:13 +02:00
3 people	dd9dcf9f72	feat(console): improve org search performance in create project grant page #11121 (#12057) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved When creating a new Project Grant in the Zitadel console, the UI becomes extremely sluggish/unusable. The issue appears tied to the organization search dropdown attempting to load a very large dataset. # How the Problems Are Solved The refactored `SearchOrgAutocompleteComponent` uses server side filtering and ondemand loading using infinite scrolling. This makes sure on a subset of organizations is ever loaded on the client. # Additional Changes - Added tailwindcss for easier styling - Removed build warnings - Removed some of the SCSS syntax warnings # Additional Context - Closes #11121 --------- Co-authored-by: Max Peintner <[email protected]>	2026-04-22 11:46:27 +02:00
RamonandGitHub	bfffd69d60	fix(console): normalize empty OIDC redirect uri updates #12053 (#12067) ... # Which Problems Are Solved - Clearing OIDC redirect URI lists in the console does not persist correctly resulting in no changes error. # How the Problems Are Solved - Normalizes empty OIDC URI list updates to [""] before sending the save request. - Uses the application v2 update call for the affected OIDC config save path. # References - Closes #12053	2026-04-22 09:23:50 +02:00
4 people	c0f7bfffdb	docs(api): remove incorrect note on CreateInviteCode endpoint (#12073) ... # Which Problems Are Solved The CreateInviteCode endpoint wrongly stated that a new code can only be issued if the old had expired or was invalidated due to too many attempts, which is not true. # How the Problems Are Solved Removed the note from the proto / API documentation. # Additional Changes None # Additional Context - noticed by a customer - requires backport to v4.x --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Matías Racedo <[email protected]>	2026-04-16 17:04:47 -03:00
Marco A.andGitHub	14acc60edd	feat: ListSessions to relational (#11987) ... # Which Problems Are Solved This PR introduces the possibility of using the relational DB when calling the ListSession gRPC endpoint. # How the Problems Are Solved - Implement the Querier interface for ListSession: - Create a `domain` model for the Session object to be able to map the gRPC session into it. - Match the permission filters on ES side to be sure the same sessions are returned - Implement converter methods to go from `gRPC` to `domain` models (both ways) - Fix the session sql relational migration: rework the trigger to update the `expiration` field to perform the update only when the input `lifetime` has a non-zero value. - Link the Querier implementation with the gRPC endpoint - Run the same integration tests against the relational DB, making sure the outcome is the same. ⚠️ Due to missing permission checks, some divergence is expected. Hence, specific code to circumvent the differences has been put in place # Additional Context - Closes #11039	2026-04-16 10:58:17 +02:00
Tim MöhlmannandGitHub	177589a0a8	fix(grpc): increase MaxSendMsgSize (#12066) ... # Which Problems Are Solved Users exporting larger orgsanizations were facing grpc message size limits of 4 MiB, while trying to export 6.3 MiB of data. Other export methods like S3 aren't implemented. # How the Problems Are Solved Set MaxSendMsgSize to 10 MiB (allow some overhead). This is not a long-term solution and we should investigate better ways of export. # Additional Changes - none # Additional Context - Support ticket	2026-04-15 13:04:22 +00:00
Gayathri VijayanandGitHub	e19bb7a173	feat: implement AddZitadelProvider in ManagementService (#12056) ... # Which Problems Are Solved This PR adds implementation to add a Zitadel IdP at the organization-level. # How the Problems Are Solved - Added handling/converters for the `AddZitadelProvider` endpoint in `ManagementService` in the server layer - Registered a new `org.idp.zitadel.added` event for org-level Zitadel providers - Added `AddOrgZitadelProvider` command to validate the request and push `org.idp.zitadel.added` event to the eventstore - Added the `org.idp.zitadel.added` event to the projection reducer - Added unit and integration tests # Additional Changes added more tests for the ZitadelProvider in AdminService # Additional Context - Closes https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PRs https://github.com/zitadel/zitadel/pull/12018, https://github.com/zitadel/zitadel/pull/12020, https://github.com/zitadel/zitadel/pull/12055	2026-04-15 14:22:45 +02:00
Gayathri VijayanandGitHub	55a9acf3bf	feat: projection layer implementation to add Zitadel provider (#12055) ... # Which Problems Are Solved Persisting instance-level Zitadel provider in the projections. # How the Problems Are Solved - Defining a new projection table `projections.idp_templates6_zitadel` and columns for the Zitadel provider - Adding a reducer `reduceZitadelIDPAdded` to process instance-level `ZitadelIDPAddedEvent` - Unit tests # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PRs https://github.com/zitadel/zitadel/pull/12018, https://github.com/zitadel/zitadel/pull/12020	2026-04-15 07:59:52 +02:00
3 people	7b9d2b7d17	feat: add administrator role permission table (#11817) ... This update introduces a new table for managing administrator role permissions, along with the necessary repository and projection logic to handle adding and removing permissions. It also includes tests to ensure the correct functionality of the permission management system. closes https://github.com/zitadel/zitadel/issues/10219 --------- Co-authored-by: Marco Ardizzone <[email protected]>	2026-04-14 06:01:52 +00:00
3 people	bb3b52dda3	feat: command layer implementation for AddZitadelProvider (#12020) ... # Which Problems Are Solved This PR contains the command-layer implementation to add an instance IDP of the type `ZitadelProvider` # How the Problems Are Solved - Implementing `AddZitadelProvider` in AdminService - Adding the command-layer to create a `ZitadelProvider` and push `ZitadelIDPAddedEvent` # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11823 - Follow-up for PR https://github.com/zitadel/zitadel/pull/12018 --------- Co-authored-by: Copilot <[email protected]>	2026-04-13 15:05:36 +00:00
4 people	01fe34a526	fix(oidc): use authenticated encryption for opaque tokens (#12017) ... # Which Problems Are Solved Opaque tokens now use authenticated encryption. # How the Problems Are Solved - Upgrade zitadel/oidc to v3.47 - Copy crypto implementation for refresh and session tokens (internal to zitadel) - Added config that allows validating old tokens for gradual roll-out # Additional Changes - Set NX cache for `integration-test-build` to `false`, working on a seperate fix. # Additional Context - closes #11315 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: muhlemmer <[email protected]>	2026-04-13 10:59:50 +00:00
Mridang AgarwallaandGitHub	a28ee63b02	feat(login): add ZITADEL_API_AWAITINITIALCONN support (#12032)	2026-04-13 09:41:31 +00:00
3 people	7d231b43d4	fix(login): replace custom SWR cache with lru-cache (#11945) ... # Which Problems Are Solved The in-memory SWR promiseCache in zitadel.ts used keys like getBrandingSettings-${org} that had no instance identifier. In multi-tenant mode, where a single Next.js process serves multiple instances, an instance A's cached settings without org context (branding, languages, settings, etc.) could be served to Instance B request without org context. The cache now additionally is bound to 100 entries by default (configurable via maxSize in `API_CACHE_CONFIG`). When capacity is exceeded, expired entries are swept first It additionally replaces the hand-rolled PromiseCache (Map-based, FIFO eviction) with lru-cache, leveraging its built-in fetchMethod for stale-while-revalidate, request deduplication, and true LRU eviction. # How the Problems Are Solved Added an instanceCacheKey() helpe that prefixes every cache key with serviceConfig.instanceHost in addition to the org context if available. --------- Co-authored-by: Ramon <[email protected]>	2026-04-13 11:19:50 +02:00
3 people	551883dcab	fix(console): update protoc-gen-js (#12046) ... <!-- Please inform yourself about the contribution guidelines on submitting a PR here: https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr. Take note of how PR/commit titles should be written and replace the template texts in the sections below. Don't remove any of the sections. It is important that the commit history clearly shows what is changed and why. Important: By submitting a contribution you agree to the terms from our Licensing Policy as described here: https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions. --> # Which Problems Are Solved While updating our dependencies the protoc-gen-js library got out of sync with the google-protobuf npm dependency. This caused problems with certain grpc code relying on the old `reader.readPackedEnum`. # How the Problems Are Solved Updated protoc-gen-js to v4.0.2. # Additional Changes Increased the angular build size budget. # Additional Context --------- Co-authored-by: Copilot <[email protected]>	2026-04-13 10:59:04 +02:00
3 people	a2bf528ca0	feat(domain): introduce error slugs (#12030) ... # Which Problems Are Solved As part of https://github.com/zitadel/zitadel/issues/11917 we want to introduce error slugs so (API) clients can rely on stable, machine-readable errors and act accordingly. # How the Problems Are Solved - Added a `NewSlug` helper function in the domain package. - Added `ErrorDetails` to the `ZitadelError` - Added an `zitadel.error.v2.ErrorDetail` proto message - Updated the connectRPC error interceptor to map new slug based errors to the new `ErrorDetail` - Defined some common slugs and error functions like internal errors - Defined (session) specific slugs used in the `DeleteSession` and `CheckUser` functions and replaced old implementations - Updated integration tests to check specific errors if the relation database feature is enabled - Updated doc and guideline to reflect the latest changes and decisions - Updated DeleteSession endpoint API to list possible slugs # Additional Changes None # Additional Context - closes #11957 --------- Co-authored-by: Wim Van Laer <[email protected]>	2026-04-13 09:47:04 +02:00
3 people	5c9361f6c7	docs: updated zitadel version in docker compose .env example (#11947) ... # Which Problems Are Solved - Zitadel-api failed to reach PostgreSQL with connection refused, Zitadel v4.11 does not implement a DSN field. # How the Problems Are Solved - Updated ZITADEL_VERSION variable in env.example to v4.13.0 Co-authored-by: Livio Spring <[email protected]>	2026-04-13 05:59:28 +00:00
3 people	fbd43ced6e	fix(grpc): return 401 for unauthenticated v1 gateway errors (#11786) ... Fixes #11730 The v1 gRPC middleware can return native gRPC status errors such as `codes.Unauthenticated` when the auth header is missing. Those errors were being passed through the generic gRPC error converter, which only handled ZITADEL errors and downgraded raw gRPC statuses to `codes.Unknown`. Through grpc-gateway that caused `/auth/v1/users/me` to return HTTP 500 instead of HTTP 401. So this change preserves native gRPC status errors in `ZITADELToGRPCError`, keeps `ExtractZITADELError` aligned with those transport codes for activity reporting, and adds regression coverage for the converter, middleware, and gateway HTTP behavior. --------- Co-authored-by: Gayathri Vijayan <[email protected]>	2026-04-10 12:22:40 +00:00
Vitor Bari BucciantiandGitHub	035ac4b9a2	fix(api): Add dummy implementation of new LinksSettings APIs to satisfy SettingsServiceHandler interface (#12034) ... # Which Problems Are Solved #11975 introduces new APIs to `SettingsService`, however, `settingsconnect.SettingsServiceHandler` wasn't updated to satisfy the interface containing the new APIs. # How the Problems Are Solved By adding a dummy implementation of new RPC methods to the SettingsService Server. # Additional Changes n/a # Additional Context n/a	2026-04-10 13:57:32 +02:00
3 people	e65cc3007d	feat: added contracts for link-settings (#11975) ... # Which Problems Are Solved A new model is needed for links in settings. # How the Problems Are Solved Created the new contracts for `LinkSettings` # Additional Changes # Additional Context Replace this example with links to related issues, discussions, discord threads, or other sources with more context. Use the Closing #issue syntax for issues that are resolved with this PR. - Closes #11959 - Discussion #xxx - Follow-up for PR #xxx - https://discord.com/channels/xxx/xxx --------- Co-authored-by: Copilot <[email protected]>	2026-04-10 09:24:49 +00:00
Mridang AgarwallaandGitHub	ce31ee2272	fix: propagate non-NotFound errors from instance interceptor (#12019)	2026-04-10 08:22:56 +00:00
Wim Van LaerandGitHub	4fdc3d6d3b	docs: fixed login v1 jwt idp callback (#11989) ... # Which Problems Are Solved The example callback url for JWT idP was wrong	2026-04-10 07:51:01 +00:00
3 people	61b40975f7	feat: API definition to add new Zitadel providers (#12018) ... # Which Problems Are Solved In the Zitadel API, provide an IdP template which allows connecting to other Zitadel instances. # How the Problems Are Solved This PR adds API definitions to add Zitadel provider at instance and organization levels. - Add `AddZitadelProvider` to ManagementService and AdminService - Add `InstanceRolesInfo` message to help determine instance admin role assignments # Additional Changes N/A # Additional Context - Related to https://github.com/zitadel/zitadel/issues/11823 --------- Co-authored-by: Copilot <[email protected]>	2026-04-10 07:40:05 +00:00
Mridang AgarwallaandGitHub	ecea44329a	fix(login): load SSL_CERT_DIR certificates without requiring hashed filenames (#12029)	2026-04-10 10:28:17 +03:00
RamonandGitHub	8b5d7a751a	fix(console): jwt provider callback urls #11589 (#11966) ... # Which Problems Are Solved The console didn't specify any callback url's for the JWT idp provider. # How the Problems Are Solved Added callback url's to the JWT idp provider screen in the management console. # Additional Changes # Additional Context - Closes #11589	2026-04-09 21:24:57 +00:00
4 people	b558a1f79f	feat: allow ECDSA and ED25519 public keys (#11819) ... # Which Problems Are Solved Currently ZITADEL only allows the use of RSA public keys for machine user authentication (jwt-bearer grant), including for system API users. Attempting to use ECDSA (e.g. P-256) or ED25519 keys results in `Errors.Internal` because `BytesToPublicKey` performs an `ifc.(*rsa.PublicKey)` type assertion that returns `(nil, nil)` for non-RSA keys, which then causes a nil key panic in go-jose during JWT verification. This is the same fix as #8433 (by @livio-a), rebased onto current `main`. # How the Problems Are Solved - `BytesToPublicKey` now returns `crypto.PublicKey` (the standard library interface) instead of `*rsa.PublicKey` - A type switch validates the parsed key is one of `*rsa.PublicKey`, `*ecdsa.PublicKey`, or `ed25519.PublicKey` - A new `ErrNoPublicKey` sentinel error is returned for unsupported key types instead of silently returning nil - Callers in `system_token.go` and `query/key.go` are updated to use the generic `crypto.PublicKey` interface # Additional Changes None # Additional Context Duplicate of #8433 which has been open since August 2024. We hit this bug while implementing OIDC bootstrap for an SGX enclave that generates ECDSA P-256 keys at runtime -- the `AddKey` API accepts the ECDSA SPKI PEM fine, but the subsequent `jwt-bearer` token exchange fails with `Errors.Internal` due to the nil key. --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Wim Van Laer <[email protected]>	2026-04-09 11:30:23 +02:00
3 people	9135ff4b36	chore(deps): bump the go_modules group across 2 directories with 1 update (#11982) ... Bumps the go_modules group with 1 update in the /apps/login/acceptance/idp/oidc directory: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose). Bumps the go_modules group with 1 update in the /apps/login/acceptance/oidcrp directory: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose). Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's releases</a>.</em></p> <blockquote> <h2>v4.1.3</h2> <p>This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop <code>x/crypto</code> and no longer have any external dependencies in go-jose outside of the standard library!</p> <p>This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.</p> <h2>What's Changed</h2> <ul> <li>Remove Go 1.23 support by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/205">go-jose/go-jose#205</a></li> <li>Reject JWS with an unprotected critical b64 header by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/210">go-jose/go-jose#210</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.2...v4.1.3">https://github.com/go-jose/go-jose/compare/v4.1.2...v4.1.3</a></p> <h2>v4.1.2</h2> <h2>What's Changed</h2> <p>go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.</p> <ul> <li>Update go-jose documentation by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/198">go-jose/go-jose#198</a></li> <li>Remove dependency on testify by <a href="https://github.com/wardviaene"><code>@​wardviaene</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/197">go-jose/go-jose#197</a></li> <li>Improve error message for invalid private keys by <a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/195">go-jose/go-jose#195</a></li> <li>JWK unsupported error when unmarshalling by <a href="https://github.com/fprojetto"><code>@​fprojetto</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/191">go-jose/go-jose#191</a></li> <li>Add JSONWebKey type to makeJWERecipient by <a href="https://github.com/alvarolivie"><code>@​alvarolivie</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/200">go-jose/go-jose#200</a></li> <li>testutils/assert: remove True, Nil, NotNil by <a href="https://github.com/jsha"><code>@​jsha</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/202">go-jose/go-jose#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/wardviaene"><code>@​wardviaene</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/197">go-jose/go-jose#197</a></li> <li><a href="https://github.com/fprojetto"><code>@​fprojetto</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/191">go-jose/go-jose#191</a></li> <li><a href="https://github.com/alvarolivie"><code>@​alvarolivie</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/200">go-jose/go-jose#200</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.1...v4.1.2">https://github.com/go-jose/go-jose/compare/v4.1.1...v4.1.2</a></p> <h2>v4.1.1</h2> <h2>What's Changed</h2> <ul> <li>Drop go-cmp dependency by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/186">go-jose/go-jose#186</a></li> <li>jws: improve performance and allocations for ParseSignedCompact by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/188">go-jose/go-jose#188</a></li> <li>Add missing quote to unknown curve message <a href="https://redirect.github.com/go-jose/go-jose/issues/170">#170</a> by <a href="https://github.com/sudhanvaghebbale"><code>@​sudhanvaghebbale</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/189">go-jose/go-jose#189</a></li> <li>Fix incorrect validation by <a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/192">go-jose/go-jose#192</a></li> <li>Restore Go 1.23 compatibility by <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/193">go-jose/go-jose#193</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/drakkan"><code>@​drakkan</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/188">go-jose/go-jose#188</a></li> <li><a href="https://github.com/sudhanvaghebbale"><code>@​sudhanvaghebbale</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/189">go-jose/go-jose#189</a></li> <li><a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/192">go-jose/go-jose#192</a></li> <li><a href="https://github.com/anuraaga"><code>@​anuraaga</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/193">go-jose/go-jose#193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.0...v4.1.1">https://github.com/go-jose/go-jose/compare/v4.1.0...v4.1.1</a></p> <h2>v4.1.0</h2> <h2>What's Changed</h2> <ul> <li>Document <code>signatureAlgorithms</code> argument by <a href="https://github.com/tgeoghegan"><code>@​tgeoghegan</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/163">go-jose/go-jose#163</a></li> <li>Add custom error for unsupported JWS signature algorithms by <a href="https://github.com/beautifulentropy"><code>@​beautifulentropy</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/181">go-jose/go-jose#181</a></li> <li>use stdlib pbkdf2 package on go 1.24 by <a href="https://github.com/kruskall"><code>@​kruskall</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/180">go-jose/go-jose#180</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9"><code>0e59876</code></a> Merge commit from fork</li> <li><a href="https://github.com/go-jose/go-jose/commit/ddffdbcec8bdadea8e02a20bdf19239878228215"><code>ddffdbc</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/213">#213</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/5348b9a4ba4559d2266b5af89fb5353cd1a5360a"><code>5348b9a</code></a> Reject JWS with an unprotected critical b64 header (<a href="https://redirect.github.com/go-jose/go-jose/issues/210">#210</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/9153a5e4549c95e97a84e41e6375dc90eac54241"><code>9153a5e</code></a> Bump actions/setup-python from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/208">#208</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/2126e17f8791f6a234e63b2e4e8cb9fac8605c3a"><code>2126e17</code></a> Bump actions/setup-go from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/209">#209</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/9860c65054c4821d1e7c22200422b04181f58ebc"><code>9860c65</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/go-jose/go-jose/issues/206">#206</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/14239fdb15b88e1c42e41621ef24f1112cf31b5a"><code>14239fd</code></a> Remove Go 1.23 support (<a href="https://redirect.github.com/go-jose/go-jose/issues/205">#205</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/a16e15813482ca5e9a679b7f5bb42ddfae616d43"><code>a16e158</code></a> Update CI to run on Go 1.24 and 1.25 (<a href="https://redirect.github.com/go-jose/go-jose/issues/204">#204</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/a1565a41aa008ae6545e0f50a636d254de5b4596"><code>a1565a4</code></a> testutils/assert: remove True, Nil, NotNil (<a href="https://redirect.github.com/go-jose/go-jose/issues/202">#202</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/3a80e136a96e747bf44049414eadc02828df4d33"><code>3a80e13</code></a> jwe: accept non-pointer JSONWebKey in Recipient (<a href="https://redirect.github.com/go-jose/go-jose/issues/200">#200</a>)</li> <li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v4.0.5...v4.1.4">compare view</a></li> </ul> </details> <br /> Updates `github.com/go-jose/go-jose/v4` from 4.0.5 to 4.1.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v4's releases</a>.</em></p> <blockquote> <h2>v4.1.3</h2> <p>This release drops Go 1.23 support as that Go release is no longer supported. With that, we can drop <code>x/crypto</code> and no longer have any external dependencies in go-jose outside of the standard library!</p> <p>This release fixes a bug where a critical b64 header was ignored if in an unprotected header. It is now rejected instead of ignored.</p> <h2>What's Changed</h2> <ul> <li>Remove Go 1.23 support by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/205">go-jose/go-jose#205</a></li> <li>Reject JWS with an unprotected critical b64 header by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/210">go-jose/go-jose#210</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.2...v4.1.3">https://github.com/go-jose/go-jose/compare/v4.1.2...v4.1.3</a></p> <h2>v4.1.2</h2> <h2>What's Changed</h2> <p>go-jose v4.1.2 improves some documentation, errors, and removes the only 3rd-party dependency.</p> <ul> <li>Update go-jose documentation by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/198">go-jose/go-jose#198</a></li> <li>Remove dependency on testify by <a href="https://github.com/wardviaene"><code>@​wardviaene</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/197">go-jose/go-jose#197</a></li> <li>Improve error message for invalid private keys by <a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/195">go-jose/go-jose#195</a></li> <li>JWK unsupported error when unmarshalling by <a href="https://github.com/fprojetto"><code>@​fprojetto</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/191">go-jose/go-jose#191</a></li> <li>Add JSONWebKey type to makeJWERecipient by <a href="https://github.com/alvarolivie"><code>@​alvarolivie</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/200">go-jose/go-jose#200</a></li> <li>testutils/assert: remove True, Nil, NotNil by <a href="https://github.com/jsha"><code>@​jsha</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/202">go-jose/go-jose#202</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/wardviaene"><code>@​wardviaene</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/197">go-jose/go-jose#197</a></li> <li><a href="https://github.com/fprojetto"><code>@​fprojetto</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/191">go-jose/go-jose#191</a></li> <li><a href="https://github.com/alvarolivie"><code>@​alvarolivie</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/200">go-jose/go-jose#200</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.1...v4.1.2">https://github.com/go-jose/go-jose/compare/v4.1.1...v4.1.2</a></p> <h2>v4.1.1</h2> <h2>What's Changed</h2> <ul> <li>Drop go-cmp dependency by <a href="https://github.com/mcpherrinm"><code>@​mcpherrinm</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/186">go-jose/go-jose#186</a></li> <li>jws: improve performance and allocations for ParseSignedCompact by <a href="https://github.com/drakkan"><code>@​drakkan</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/188">go-jose/go-jose#188</a></li> <li>Add missing quote to unknown curve message <a href="https://redirect.github.com/go-jose/go-jose/issues/170">#170</a> by <a href="https://github.com/sudhanvaghebbale"><code>@​sudhanvaghebbale</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/189">go-jose/go-jose#189</a></li> <li>Fix incorrect validation by <a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/192">go-jose/go-jose#192</a></li> <li>Restore Go 1.23 compatibility by <a href="https://github.com/anuraaga"><code>@​anuraaga</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/193">go-jose/go-jose#193</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/drakkan"><code>@​drakkan</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/188">go-jose/go-jose#188</a></li> <li><a href="https://github.com/sudhanvaghebbale"><code>@​sudhanvaghebbale</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/189">go-jose/go-jose#189</a></li> <li><a href="https://github.com/ProjectMutilation"><code>@​ProjectMutilation</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/192">go-jose/go-jose#192</a></li> <li><a href="https://github.com/anuraaga"><code>@​anuraaga</code></a> made their first contribution in <a href="https://redirect.github.com/go-jose/go-jose/pull/193">go-jose/go-jose#193</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/go-jose/go-jose/compare/v4.1.0...v4.1.1">https://github.com/go-jose/go-jose/compare/v4.1.0...v4.1.1</a></p> <h2>v4.1.0</h2> <h2>What's Changed</h2> <ul> <li>Document <code>signatureAlgorithms</code> argument by <a href="https://github.com/tgeoghegan"><code>@​tgeoghegan</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/163">go-jose/go-jose#163</a></li> <li>Add custom error for unsupported JWS signature algorithms by <a href="https://github.com/beautifulentropy"><code>@​beautifulentropy</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/181">go-jose/go-jose#181</a></li> <li>use stdlib pbkdf2 package on go 1.24 by <a href="https://github.com/kruskall"><code>@​kruskall</code></a> in <a href="https://redirect.github.com/go-jose/go-jose/pull/180">go-jose/go-jose#180</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/go-jose/go-jose/commit/0e59876635f3dbf46d7b5e97b52bb75a3f96e7d9"><code>0e59876</code></a> Merge commit from fork</li> <li><a href="https://github.com/go-jose/go-jose/commit/ddffdbcec8bdadea8e02a20bdf19239878228215"><code>ddffdbc</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/213">#213</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/5348b9a4ba4559d2266b5af89fb5353cd1a5360a"><code>5348b9a</code></a> Reject JWS with an unprotected critical b64 header (<a href="https://redirect.github.com/go-jose/go-jose/issues/210">#210</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/9153a5e4549c95e97a84e41e6375dc90eac54241"><code>9153a5e</code></a> Bump actions/setup-python from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/208">#208</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/2126e17f8791f6a234e63b2e4e8cb9fac8605c3a"><code>2126e17</code></a> Bump actions/setup-go from 5 to 6 (<a href="https://redirect.github.com/go-jose/go-jose/issues/209">#209</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/9860c65054c4821d1e7c22200422b04181f58ebc"><code>9860c65</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/go-jose/go-jose/issues/206">#206</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/14239fdb15b88e1c42e41621ef24f1112cf31b5a"><code>14239fd</code></a> Remove Go 1.23 support (<a href="https://redirect.github.com/go-jose/go-jose/issues/205">#205</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/a16e15813482ca5e9a679b7f5bb42ddfae616d43"><code>a16e158</code></a> Update CI to run on Go 1.24 and 1.25 (<a href="https://redirect.github.com/go-jose/go-jose/issues/204">#204</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/a1565a41aa008ae6545e0f50a636d254de5b4596"><code>a1565a4</code></a> testutils/assert: remove True, Nil, NotNil (<a href="https://redirect.github.com/go-jose/go-jose/issues/202">#202</a>)</li> <li><a href="https://github.com/go-jose/go-jose/commit/3a80e136a96e747bf44049414eadc02828df4d33"><code>3a80e13</code></a> jwe: accept non-pointer JSONWebKey in Recipient (<a href="https://redirect.github.com/go-jose/go-jose/issues/200">#200</a>)</li> <li>Additional commits viewable in <a href="https://github.com/go-jose/go-jose/compare/v4.0.5...v4.1.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/zitadel/zitadel/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-08 10:24:03 +00:00
3 people	0bf3045142	fix(console): always show settings page to admin (#11779) ... # Which Problems Are Solved The settings tab is hidden when there's only 1 organization. This was very confusing when I created an IdP using terraform and then could not find it. I eventually found the `gs` shortcut which brought me to the org settings. This was last touched here #10912 # How the Problems Are Solved Always show the settings tab, even if there's just 1 org. Co-authored-by: Ramon <[email protected]>	2026-04-08 09:02:56 +00:00