# Which Problems Are Solved
As part of going to a relation storage model, we need to implement the
repository for handling sessions and their events.
# How the Problems Are Solved
- Adds a migration step to create the necessary tables and types in the
database.
- Adds the repository implementation for sessions.
- Implements a projection handler for session events to handle the
events written by the old command handlers.
- Updates the `Session` type and `SessionRepository` interface:
- added `CreatorID`
- Adjusted `Delete` method to return amount of affected columns
- Removed sub-repository clumns from the main interface
- Added `CreatorIDCondition`, `ExpirationCondition`, `ExistsFactor` and
`ExistsMetadata`
- Removed `SetUserAgent`
- Methods of `SessionFactor` and `SessionChallenge` have been made
public
- fixed enumer on `SessionFactorType`
- Adds a `JSON` type to the repository package to easy can JSON columns,
resp. jsonb object inside a property of a `JSONArray` object.
- Adds a `NoChange` interface, which can be implemented to signal that a
`Change` interface implementation is not writing any changes to the
statement builder, e.g. `CTEChange`
# Additional Changes
- Fixes the operators enums. `TextOperations` had wrong comments and
`NumberOperations` additionally also had from comparisons.
- Fixes downgrade of migration step 008.
# Additional Context
- closes https://github.com/zitadel/zitadel/issues/10212
# Which Problems Are Solved
A customer noted that one some of their environments actions were never
executed at all.
During the investigation it was discovered, that these systems did not
have any features set.
# How the Problems Are Solved
Fix the `scanAuthzInstance` function to handle queries without features
returned correctly.
# Additional Changes
None
# Additional Context
- reported through support
- requires backport to v4.x and v3.x
Closes#11184
# Which Problems Are Solved
- loginName: This information is already retrievable from the URL
parameters during the authentication flow, so logging it presented no
additional exposure.
- idpIntent: This was being logged to the server console (server-side
logs), so it was never exposed to the client/browser.
These changes simply clean up the server logs to prevent unnecessary
data noise.
# How the Problems Are Solved
- Removed idpIntent logging from
`apps/login/src/lib/server/idp-intent.ts`
- Removed loginName logging from
`apps/login/src/lib/server/password.ts`
---------
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
The application automatically appends the x-zitadel-public-host header
when a public host is configured. In some deployment scenarios where the
host is determined by default or via other means, sending this header
allows for improper routing or is simply redundant. The existing
CUSTOM_REQUEST_HEADERS configuration only supported adding or
overwriting headers, offering no way to remove headers that were set by
default logic.
# How the Problems Are Solved
Extended the `CUSTOM_REQUEST_HEADERS` handling in `src/lib/zitadel.ts`.
The logic now checks for empty header values. If a header is defined in
`CUSTOM_REQUEST_HEADERS` with an empty value (e.g.,
x-zitadel-public-host:), the interceptor will delete that header from
the request instead of setting it to an empty string. This allows users
to opt-out of default headers via configuration.
Closes#11191
# Which Problems Are Solved
This PR fixes the IDP linking for accounts with no authentication
method.
We strictly validate session ownership and generate a hash of the
sessionId + the user's fingerprintId cookie. This hash is passed to the
IDP as linkFingerprint.
This PR addtionally addresses TypeScript errors regarding unknown types
in catch blocks within the IDP intent processing logic. It ensures that
errors occurring during IDP linking are safely handled, and that
meaningful error messages are propagated to the client-side redirect
URLs.
# How the Problems Are Solved
- Safely handle unknown errors: Updated catch blocks in
`processIDPCallback` to check if the caught object is an instance of
Error before accessing error.message.
- Fix "IDP Taken" check: Implemented a safe check for the gRPC error
code 6 (Already Exists) by casting the error, resolving the Property
'code' does not exist on type 'unknown' build error.
- Error Propagation: The specific error message is now passed to the
linking-failed page params, allowing for better user feedback instead of
generic errors.
# Which Problems Are Solved
The config `DefaultInstance.LoginPolicy.IgnoreUnknownUsernames` is
ignored during application start.
# How the Problems Are Solved
Fix the typo in the field name `IgnoreUnknownUsernames` associated with
the config used while unmarshaling.
Previously: `IgnoreUnknownUsername`
# Additional Changes
N/A
# Additional Context
- Closes https://github.com/zitadel/zitadel/issues/11007
# Which Problems Are Solved
Radio buttons in the User V2 creation form were unresponsive when
clicking directly on the radio button itself, only clicking on the label
text worked.
# How the Problems Are Solved
The app-auth-method-radio-theme mixin had a global input[type='radio']
selector that hid all radio inputs application-wide, breaking Angular
Material's mat-radio-button components. The selector is now scoped to
.auth-method-radio-button-wrapper so it only affects the intended
component.
# Additional Context
- Closes#11092
# Which Problems Are Solved
Some features moved from Beta to GA in V4, are still labeled as beta in
the docs and APIs refer to the now deprecated beta endpoints.
# How the Problems Are Solved
- remove the beta labels from webkeys, login v2, actions v2
- change example calls and API reference to v2 (instead of v2beta)
# Additional Changes
fixed typo in the web keys title (Oauth2 -> OAuth2)
# Additional Context
- Organization service v2(beta) is solved in
https://github.com/zitadel/zitadel/pull/11207
- relates to #10772
---------
Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Copilot <[email protected]>
# Which Problems Are Solved
The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.
# How the Problems Are Solved
- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
- added a `fingerprint` column
- dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies
# Additional Changes
None
# Additional Context
closes#11061
---------
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
# Which Problems Are Solved
Some SAML integration tests used a hardcoded certificate, which expired
on the 25th December 2025.
# How the Problems Are Solved
Added helper functions to the integration package to create and store a
private key and certificate for SAML, which can be used in SAML SP/IDP
integration tests.
# Additional Changes
none
# Additional Context
- noted on #11196
- requires backport to at least v4.x
The current document for private key JWT is misleading, as it currently
looks like a mechanism to secure an API, and it's not, this section only
shows how to use private key JWT to call the introspect endpoint
# Which Problems Are Solved
The current documentation on setting up a MockSAML IDP is
unclear/incomplete, and doesn't work with Login V2.
# How the Problems Are Solved
- Add a new section that explains mapping of MockSAML attributes to
Zitadel user fields (using Actions V2) in case of Login V2
- Update the Actions V1 script used to prefill user data in case of
Login V1
# Additional Changes
N/A
# Additional Context
- Related to https://github.com/zitadel/zitadel/issues/11078
Updated wording on the Actions V2 landing page and added a reference to
the sample scripts repository we have to deploy Actions for various use
cases to Cloudflare Workers.
Fixes#11028
# Which Problems Are Solved
* Missing Dutch (nl) translations in the login UI v2.
# How the Problems Are Solved
* Adds nl.json with Dutch translations.
* The same data is added to v2-default.json, because otherwise English
was overriding nl.json content.
* Adds Dutch to the language dropdown in somewhat alphabetical order.
# Additional Changes
None.
# Additional Context
None.
---------
Co-authored-by: thomas-swennenhuis <[email protected]>
# Which Problems Are Solved
Flaky integration tests related to authorizations RT.
# How the Problems Are Solved
By setting the `created_at` and `updated_at` timestamps based on event
timestamps while creating an authorization.
# Additional Changes
N/A
# Additional Context
https://cloud.nx.app/runs/ICj84SxEf0/task/%40zitadel%2Fapi%3Atest-integration
# Which Problems Are Solved
Comment out timestamp assertions to temporarily unblock CI pipeline
# How the Problems Are Solved
Comment out timestamp assertions to temporarily unblock CI pipeline
# Additional Changes
N/A
# Additional Context
# Which Problems Are Solved
Strings previously were:
- The user must **be member** of the {{.OrgName}} organization.
Fixed the grammar mistake / typo and it's now:
- The user must **be a member** of the {{.OrgName}} organization.
Co-authored-by: Wim Van Laer <[email protected]>
# Which Problems Are Solved
This PR implements relational table and repository interface for the
authorizations feature as described in
https://github.com/zitadel/zitadel/issues/10767
# How the Problems Are Solved
By
* adding new `zitadel.authorizations` and `zitadel.authorization_roles`
tables
* implementing the `AuthorizationRepository` interface to create,
update, query, and delete user authorizations and roles
* implementing `authorization_relational.go` projection to update
`zitadel.authorizations` and `zitadel.authorization_roles` tables based
on events
# Additional Changes
N/A
# Additional Context
- Closes#10767
---------
Co-authored-by: Livio Spring <[email protected]>
When this checkbox is enabled, the user profile information (not the
roles assigned) will be returned as claims in the ID token. The current
wording is not accurate.
# Which Problems Are Solved
ZITADEL is wrongly spelled like "ZITADLE" in the description of the GRPC
`zitadel.admin.v1.AdminService/Healthz` endpoint.
# How the Problems Are Solved
Fixed the spelling error.
# Additional Changes
None.
# Additional Context
None.
Co-authored-by: elinashoko <[email protected]>
# Which Problems Are Solved
add missing period and space before new sentence.
# How the Problems Are Solved
- add missing period and space before new sentence.
# Additional Changes
- no other changes
# Additional Context
- no related issues
Co-authored-by: Wim Van Laer <[email protected]>
# Which Problems Are Solved
- ID-token had no lifetime when a token was requested using the
`client_credentials` grant
# How the Problems Are Solved
- Take use the lifetime provided by the server.
# Additional Context
- Closes#11060
# Which Problems Are Solved
This PR implements the endpoints listed in
https://github.com/zitadel/zitadel/issues/10444 .
# How the Problems Are Solved
The implementation follows the same pattern as the Instance one. The
`Add` and `Remove` are implementing the `Commander` interface, while
`List` Domains endpoints are implementing the `Querier` interace.
The PR adds also some forgotten calls to the relational logic for the
Instance API. The commits are identifiable by the label `instance:`
prepended to them. This is the complete list: bafce01b0 , 6fe7257ab ,
e27bc9c34 , 8133ede73 , fde667953 , a3e1135ed , ee1a6f9c1
# Additional Context
- Closes#10444
---------
Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Lebogang Phoshoko <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>
# Which Problems Are Solved
Failed password attempts in login V1 potentially created new session
entries.
# How the Problems Are Solved
Correct handling to only update existing sessions.
# Additional Changes
None
# Additional Context
- reported through support
- requires backport to v4.x
# Which Problems Are Solved
We had to wrap reserved scopes like
`urn:zitadel:iam:org:id:178204173316174381` in a code block, because
Docusaurus was rendering 🆔 as emoji.
# How the Problems Are Solved
Update Docusaurus to 3.9.2. and disable the emoji rendering in markdown
files.
# Additional Changes
# Additional Context
Co-authored-by: Florian Forster <[email protected]>
# Which Problems Are Solved
Previous login app had french localization and the new app doesn't have
it anymore. It simply re-add this missing locale.
# How the Problems Are Solved
Simply add french localization.
# Additional Changes
None
# Additional Context
I don't know how to add it by default in backend, i will happily make
the changes for adding by default this langage.
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Wim Van Laer <[email protected]>
Closes#11192
# Which Problems Are Solved
Update pnpm, react and react-dom to the latest version
# How the Problems Are Solved
the version references are updated as part of the package.json files
# Which Problems Are Solved
- Broken links that the NextJs frontend quickstart guide uses to refer
to the files in the example application.
# How the Problems Are Solved
- Links are updated
- The mentioned file paths are adapted to match the existing file
structure
# Additional Changes
# Additional Context
- [NextJs Frontend Quickstart
Guide](https://zitadel.com/docs/examples/login/nextjs)
- [Example Application](https://github.com/zitadel/zitadel-nextjs)
Co-authored-by: Wim Van Laer <[email protected]>
# Which Problems Are Solved
Updates `next` to version `15.5.9` to address the following security
vulnerabilities:
- **CVE-2025-55184**
- **CVE-2025-55183**
# How the Problems Are Solved
- Bump `next` from `15.5.7` to `15.5.9` in `apps/login/package.json`
---------
Co-authored-by: PhenixH <[email protected]>
# Which Problems Are Solved
Temporary update of nextjs and react to fix major CVE (described #11140)
Build passing and force dependency for old deps, but we will need to
update packages (I update qrcode-react, minimal impact, not feasible for
react-hook-form which needs more work).
# How the Problems Are Solved
Upgrade dependencies to patched version of the same major and minor,
remove experimental flag dynamicIO and added flag useCache (used in
code)
# Additional Changes
# Additional Context
- https://nextjs.org/blog/CVE-2025-66478
-
https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
Co-authored-by: Max Peintner <[email protected]>
The change was introduced in
https://github.com/zitadel/zitadel/pull/11178.
The fix is to prevent wiping the memberships because the projection did
not init yet.
### Changes
- Introduces a check to determine if the member role synchronization
should be executed based on the existence of a specific database table
(`projections.instance_members4`).
- Ensures that the synchronization process only runs if the required
table is present in the database.
# Which Problems Are Solved
Zitadel v4.7.2 fixed a security issue by switching to the permission v2
framework for user APIs. It appears that systems that are running since
before v2.68 that were affected by a precision bug in the eventstore,
which was fixed in that version. The precision bug results in certain
events being "skipped" while being projected into the fields table, used
by the new permission system. This caused certain membership roles to be
missing, resulting in empty user lists when executed by the affected
member. The permission system basically finds no matching memberships
and therefore returns no users at all.
# How the Problems Are Solved
After research we concluded that the legacy membership projections are
projected correctly. This PR synchronizes the projected state into the
fields table. As the membership roles are not marked unique, all rows
are first deleted and then the correct membership roles are then
inserted. The operation happens in a single transaction, during which
the fields table will remain locked for modifications. This to prevent
possible concurrent modifications to membership states.
# Additional Changes
- none
# Additional Context
- Introduced in
https://github.com/zitadel/zitadel/commit/0e17d0005a98ccbf92139961ef702ef03208ffd3
- Released in
[v4.7.2](https://github.com/zitadel/zitadel/releases/tag/v4.7.2)
- Related: https://github.com/zitadel/zitadel/issues/8863
---------
Co-authored-by: Silvan <[email protected]>
# Which Problems Are Solved
Zitadel only accepted ASCII email addresses, while some users need to
enter internationalized addresses. For example `mö[email protected]`
# How the Problems Are Solved
- Use `net/mail` to validate email addresses, instead of a custom regex.
`net/mail` correctly accepts UTF-8 characters.
- In the management/v1 API email address validation is removed (only
string limits are applied)
# Additional Changes
- none
# Additional Context
Closes https://github.com/zitadel/zitadel/issues/9821
## Summary
- Add comprehensive Ukrainian language support to ZITADEL
- Complete translation of all user-facing interfaces
- Integration with existing language configuration system
## Changes Made
- ✅ **Console translations**: Complete Ukrainian translation for admin
console (2,861 translated strings)
- ✅ **Login interface**: Ukrainian translations for authentication flows
(535 strings)
- ✅ **Email notifications**: Ukrainian translations for system emails
(68 strings)
- ✅ **Common texts**: Ukrainian translations for success/error messages
(1,417 strings)
- ✅ **Language configuration**: Added Ukrainian to supported languages
and Angular locale registration
- ✅ **UI integration**: Added Ukrainian option to language selection
forms
## Translation Quality
- Professional translations using established Ukrainian IT terminology
- Formal language appropriate for business software
- Consistent terminology across all components (Users→Користувачі,
Organization→Організація, etc.)
- Preserved all technical placeholders, HTML tags, and formatting
## Contributing Guidelines Compliance
- ✅ Followed semantic commit message format
- ✅ Added Ukrainian to all required configuration files
- ✅ Maintained consistent file structure with existing languages
- ✅ Used formal Ukrainian appropriate for business software
The Ukrainian translation is now ready for review by the ZITADEL team! 🚀
---------
Co-authored-by: Marco A. <[email protected]>
# Which Problems Are Solved
The `SecretGenerators` setting is missing among the instance settings in
the new relational model.
# How the Problems Are Solved
This PR adds:
* `SettingTypeSecretGenerator` type to the settings model
* `SecretGeneratorSettingsRepository` and
`secretGeneratorSettingsJSONChanges` interfaces to set, retrieve, and
delete `secret_generator` settings, and corresponding unit tests.
* projection reducers to reduce the following events:
* `SecretGeneratorAddedEvent`
* `SecretGeneratorChangedEvent`
* `SecretGeneratorRemovedEvent`
* integration tests to test that the events get reduced correctly
# Additional Changes
N/A
# Additional Context
- Part of https://github.com/zitadel/zitadel/issues/10207
---------
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Marco A. <[email protected]>
* Force v2 permission checks on user listing
* Remove duplicated tests
* cleanup and fix tests
---------
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
As reported to support, the back button on the various 2FA pages in
login V1 opened the default redirect URI, which likely started a new
auth request (e.g. from Console).
# How the Problems Are Solved
Change the back buttons to navigate to the login screen again, where a
user can change the username.
Additionally, the back button has been added to the U2F verification
screen.
# Additional Changes
None
# Additional Context
- from support
- backport to v4
Livio SpringandGitHub
Matías RacedoandGitHub
RamonandGitHub
Federico CoppedeandGitHub
Mohamed TammamandGitHub
