Commit Graph
6 Commits
Author SHA1 Message Date
Max PeintnerandGitHub b27fdfc28c chore: update dependencies (#12242)
# Which Problems Are Solved

Fixes multiple high-severity Dependabot alerts for transitive
dependencies (axios, protobufjs, systeminformation, tmp, fast-uri,
@babel/plugin-transform-modules-systemjs).
 
# How the Problems Are Solved

**Direct dependency updates:**
- `@opentelemetry/*` 0.217 → 0.218 in login (new otlp-transformer
dropped protobufjs as direct dep)
- `posthog-js` 1.374 → 1.380 in console (dropped the
OpenTelemetry/protobufjs chain entirely)

**pnpm overrides** for remaining transitive deps that can't be updated
via their parents (all pulled by the gRPC stack, Cypress, karma, nx, or
ajv):
- `axios` → ≥1.17.0 (prototype pollution, proxy bypass)
- `protobufjs` → ≥7.5.7 / ≥8.0.2 (code injection, prototype pollution,
DoS)
- `systeminformation` → ≥5.31.6 (command injection)
- `tmp` → ≥0.2.6 (path traversal)
- `fast-uri` → ≥3.1.2 (path traversal, host confusion)

**Benchmark:** refreshed `package-lock.json` to resolve @babel and
fast-uri alerts.
2026-06-09 16:27:12 +02:00
96130b720c fix(benchmark): set proper audience to introspect token (#11586)
# Which Problems Are Solved

Benchmark appears to run correctly, however the token used isn't valid.
The backend (Zitadel 4.11-pre) prints a constant stream of info logs
that the token isn't valid for the client.

# How the Problems Are Solved

Pass the generated project IDs as a scope for a new login.

# Additional Changes

- ensure keys for introspection and add session recipes.

# Additional Context

- Closes #11585

---------

Co-authored-by: Silvan <[email protected]>
2026-02-16 20:07:59 +01:00
Marco A.andGitHub 382aec2d61 chore: Service Account Naming Consistency (#11557)
# Which Problems Are Solved

Inconsistent naming of service account, found in the following
variations:

  - Machine User
  - machine user
  - Service User
  - Machine Account
  - Technical Account
  - User: Type Machine

# How the Problems Are Solved

Attentive search and replace.

Localizations have been translated using Copilot

# Additional Changes

Some unused methods have been removed from the Go code.

# Additional Context

- Closes #11285
2026-02-13 12:31:43 +01:00
b99271755b chore: renamed one time password to OTP (#11447)
# Which Problems Are Solved

naming consistency for TOTP/OTP

# How the Problems Are Solved


# Additional Changes


# Additional Context

- Closes #11299 
- Closes #11302 
- Closes #11304

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Copilot <[email protected]>
2026-02-04 10:20:47 +01:00
Marco A.andGitHub 96bbd6a65c chore: management console naming inconsistency (#11390)
# Which Problems Are Solved

The following terms have all been renamed to management console:

- Customer Portal (when used to mean the console)
- Console
- Admin Console

# How the Problems Are Solved

- Search & Replace smartly
- Use Copilot for translation files

Changes done to: backend + frontend codebase, docs, translations and
protobufs (descriptions only)

# Additional Context

- Partially Closes #11279
2026-01-26 14:52:15 +00:00
f69a6ed4f3 chore: rehaul DevX (#10571)
# Which Problems Are Solved

Replaces Turbo by Nx and lays the foundation for the next CI
improvements. It enables using Nx Cloud to speed the up the pipelines
that affect any node package.
It streamlines the dev experience for frontend and backend developers by
providing the following commands:

| Task | Command | Notes |
|------|---------|--------|
| **Production** | `nx run PROJECT:prod` | Production server |
| **Develop** | `nx run PROJECT:dev` | Hot reloading development server
|
| **Test** | `nx run PROJECT:test` | Run all tests |
| **Lint** | `nx run PROJECT:lint` | Check code style |
| **Lint Fix** | `nx run PROJECT:lint-fix` | Auto-fix style issues |

The following values can be used for PROJECT:

- @zitadel/zitadel (root commands)
- @zitadel/api,
- @zitadel/login,
- @zitadel/console,
- @zitadel/docs,
- @zitadel/client
- @zitadel/proto

The project names and folders are streamlined:

| Old Folder | New Folder |
| --- | --- |
| ./e2e | ./tests/functional-ui |
| ./load-test | ./benchmark |
| ./build/zitadel | ./apps/api |
| ./console | ./apps/console (postponed so the PR is reviewable) |  

Also, all references to the TypeScript repo are removed so we can
archive it.

# How the Problems Are Solved

- Ran `npx nx@latest init`
- Replaced all turbo.json by project.json and fixed the target configs
- Removed Turbo dependency
- All JavaScript related code affected by a PRs changes is
quality-checked using the `nx affected` command
- We move PR checks that are runnable using Nx into the `check`
workflow. For workflows where we don't use Nx, yet, we restore
previously built dependency artifacts from Nx.
- We only use a single and easy to understand dev container
- The CONTRIBUTING.md is streamlined
- The setup with a generated client pat is orchestrated with Nx
- Everything related to the TypeScript repo is updated or removed. A
**Deploy with Vercel** button is added to the docs and the
CONTRIBUTING.md.

# Additional Changes

- NPM package names have a consistent pattern.
- Docker bake is removed. The login container is built and released like
the core container.
- The integration tests build the login container before running, so
they don't rely on the login container action anymore. This fixes
consistently failing checks on PRs from forks.
- The docs build in GitHub actions is removed, as we already build on
Vercel.

# Additional Context

- Internal discussion:
https://zitadel.slack.com/archives/C087ADF8LRX/p1756277884928169
- Workflow dispatch test:
https://github.com/zitadel/zitadel/actions/runs/17760122959

---------

Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-10-08 10:27:02 +02:00