# Which Problems Are Solved
Inconsistent naming of passkeys
# How the Problems Are Solved
translations are done using gemini
# Additional Changes
# Additional Context
- Closes#11298
---------
Co-authored-by: Gayathri Vijayan <[email protected]>
# Which Problems Are Solved
As part of the naming inconsistencies (#5888) we want to ensure action
v1 flow name are always correct and mapping to enum values line up:
#11309
# How the Problems Are Solved
Rename last "Customize SAML Response" occurrences to "Complement SAML
Response" where it's referring to the flow type. There are some titles
left with "customize SAML / OIDC response", which refer to the intent of
customizing the outcome and not directly to the flow type.
# Additional Changes
None
# Additional Context
- closes 11309
# Which Problems Are Solved
Fix failing compliance alert because of old depedencies.
# How the Problems Are Solved
Updated our npm dependencies
# Additional Changes
- Updated Docusaurus to React 19 to unify our react versions
- Fixed flaky e2e test
# Which Problems Are Solved
Some features moved from Beta to GA in V4, are still labeled as beta in
the docs and APIs refer to the now deprecated beta endpoints.
# How the Problems Are Solved
- remove the beta labels from webkeys, login v2, actions v2
- change example calls and API reference to v2 (instead of v2beta)
# Additional Changes
fixed typo in the web keys title (Oauth2 -> OAuth2)
# Additional Context
- Organization service v2(beta) is solved in
https://github.com/zitadel/zitadel/pull/11207
- relates to #10772
---------
Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Copilot <[email protected]>
# Which Problems Are Solved
The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.
# How the Problems Are Solved
- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
- added a `fingerprint` column
- dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies
# Additional Changes
None
# Additional Context
closes#11061
---------
Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
The current document for private key JWT is misleading, as it currently
looks like a mechanism to secure an API, and it's not, this section only
shows how to use private key JWT to call the introspect endpoint
# Which Problems Are Solved
The current documentation on setting up a MockSAML IDP is
unclear/incomplete, and doesn't work with Login V2.
# How the Problems Are Solved
- Add a new section that explains mapping of MockSAML attributes to
Zitadel user fields (using Actions V2) in case of Login V2
- Update the Actions V1 script used to prefill user data in case of
Login V1
# Additional Changes
N/A
# Additional Context
- Related to https://github.com/zitadel/zitadel/issues/11078
Updated wording on the Actions V2 landing page and added a reference to
the sample scripts repository we have to deploy Actions for various use
cases to Cloudflare Workers.
Fixes#11028
# Which Problems Are Solved
add missing period and space before new sentence.
# How the Problems Are Solved
- add missing period and space before new sentence.
# Additional Changes
- no other changes
# Additional Context
- no related issues
Co-authored-by: Wim Van Laer <[email protected]>
# Which Problems Are Solved
We had to wrap reserved scopes like
`urn:zitadel:iam:org:id:178204173316174381` in a code block, because
Docusaurus was rendering 🆔 as emoji.
# How the Problems Are Solved
Update Docusaurus to 3.9.2. and disable the emoji rendering in markdown
files.
# Additional Changes
# Additional Context
Co-authored-by: Florian Forster <[email protected]>
# Which Problems Are Solved
- Broken links that the NextJs frontend quickstart guide uses to refer
to the files in the example application.
# How the Problems Are Solved
- Links are updated
- The mentioned file paths are adapted to match the existing file
structure
# Additional Changes
# Additional Context
- [NextJs Frontend Quickstart
Guide](https://zitadel.com/docs/examples/login/nextjs)
- [Example Application](https://github.com/zitadel/zitadel-nextjs)
Co-authored-by: Wim Van Laer <[email protected]>
## Summary
- Add comprehensive Ukrainian language support to ZITADEL
- Complete translation of all user-facing interfaces
- Integration with existing language configuration system
## Changes Made
- ✅ **Console translations**: Complete Ukrainian translation for admin
console (2,861 translated strings)
- ✅ **Login interface**: Ukrainian translations for authentication flows
(535 strings)
- ✅ **Email notifications**: Ukrainian translations for system emails
(68 strings)
- ✅ **Common texts**: Ukrainian translations for success/error messages
(1,417 strings)
- ✅ **Language configuration**: Added Ukrainian to supported languages
and Angular locale registration
- ✅ **UI integration**: Added Ukrainian option to language selection
forms
## Translation Quality
- Professional translations using established Ukrainian IT terminology
- Formal language appropriate for business software
- Consistent terminology across all components (Users→Користувачі,
Organization→Організація, etc.)
- Preserved all technical placeholders, HTML tags, and formatting
## Contributing Guidelines Compliance
- ✅ Followed semantic commit message format
- ✅ Added Ukrainian to all required configuration files
- ✅ Maintained consistent file structure with existing languages
- ✅ Used formal Ukrainian appropriate for business software
The Ukrainian translation is now ready for review by the ZITADEL team! 🚀
---------
Co-authored-by: Marco A. <[email protected]>
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->
# Which Problems Are Solved
Permissions for each manager role are stored in a .yaml file and can't
be easily searched in our docs.
# How the Problems Are Solved
We reference anyways the defaults.yaml file in our docs.
The script parses the yaml and produces a markdown table containing all
manager roles by manager permissions.
# Additional Changes
* Updated README with correct production build command
# Additional Context
---------
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
# Which Problems Are Solved
The React example needed updates to align with current best practices
and improve documentation clarity for developers integrating Zitadel
authentication.
# How the Problems Are Solved
Updated the React example codebase with improved authentication flow
using react-oidc-context, enhanced error handling and TypeScript type
safety, and refined component structure for better maintainability.
# Additional Changes
Updated documentation to reflect implementation details, added
comprehensive environment variable configuration examples with exact
variable names from the codebase, improved inline code comments, and
updated dependencies to latest stable versions.
# Additional Context
- Related to React integration example improvements
- Enhances developer experience when implementing Zitadel PKCE
authentication in React applications
This pull request addresses an issue where ZITADEL's initialization
process could fail in environments with restricted database permissions,
such as managed database services (e.g., Google Cloud SQL, Amazon RDS,
Azure PostgreSQL).
## Which problem is solved
Previously, `zitadel init` (and its sub commands) and `zitadel
start-from-init` commands would attempt to execute `CREATE DATABASE`,
`CREATE USER`, and `GRANT` statements. These commands often fail if the
provided database user lacks superuser privileges, which is a common
security practice in hosted database environments.
## How the problem is solved
With this change, Zitadel is now smarter during initialization. It
checks if the database and user specified in your configuration already
exist and are accessible. If they are, ZITADEL will skip the creation
and grant commands, allowing for a seamless setup even with a
less-privileged database user.
## Additional information
closes#10730
closes https://github.com/zitadel/zitadel/issues/8198
### How to leverage this feature (skip admin commands)
To have ZITADEL skip the database administration commands, you need to
configure it so that the initialization process can use the
already-existing database and user. This is achieved by pointing the
admin access in your ZITADEL configuration to the user and database that
ZITADEL will use for its operations.
In your ZITADEL configuration file (e.g., zitadel.yaml), configure the
Database section as follows:
```yaml
Database:
Postgres:
Database: existing_database
# Admin credentials should be the same as the application user credentials
Admin:
User: zitadel-user
ExistingDatabase: existing_database # this is used to connect the admin to the previously created database
# Application user credentials
User:
User: zitadel-user
```
---------
Co-authored-by: Marco A. <[email protected]>
# Which Problems Are Solved
This PR fixes the examples used in the actions v2 docs.
# How the Problems Are Solved
* By fixing the actions v2 import path used in the example
# Additional Changes
* Use actions v2 instead of actions v2beta in the examples
* Use v2 `CreateUser` instead of v2beta `AddHumanUser` in
`request-manipulation` example
# Additional Context
- Follow up for https://github.com/zitadel/zitadel-go/issues/523
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->
# Which Problems Are Solved
Replace this example text with a concise list of problems that this PR
solves.
For example:
- If the property XY is not given, the system crashes with a nil pointer
exception.
# How the Problems Are Solved
Replace this example text with a concise list of changes that this PR
introduces.
For example:
- Validates if property XY is given and throws an error if not
# Additional Changes
Replace this example text with a concise list of additional changes that
this PR introduces, that are not directly solving the initial problem
but are related.
For example:
- The docs explicitly describe that the property XY is mandatory
- Adds missing translations for validations.
# Additional Context
Replace this example with links to related issues, discussions, discord
threads, or other sources with more context.
Use the Closing #issue syntax for issues that are resolved with this PR.
- Closes #xxx
- Discussion #xxx
- Follow-up for PR #xxx
- https://discord.com/channels/xxx/xxx
# Which Problems Are Solved
- Integrates the Drupal 7 hash verifier from passwap
# Additional Changes
- The docs inform about the option to use the Drupal 7 hash verifier
- Updates passwap to version v0.10.0
# Additional Context
- Follow-up for PR
[#passwap/pull/70](https://github.com/zitadel/passwap/pull/70)
Co-authored-by: Marco A. <[email protected]>
# Which Problems Are Solved
As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.
# How the Problems Are Solved
- This PR moves instance v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing
- `Domain` has been renamed to `CustomDomain` to align with naming
conventions
- `..Query` has been renamed to `..Filter` to align with other services
- The `instance_id` parameter can now passed on all endpoints and is
properly used, but requires `system` permissions. It can be omitted to
use the own instance (identified by context as any other service).
- The following endpoints are affected:
- GetInstance
- UpdateInstance
- ListCustomDomains
- AddTrustedDomain
- RemoveTrustedDomain
- ListTrustedDomains
- InstanceService has been added the InstanceInterceptor's
`explicitInstanceIdServices` to allow passing the id
- If the instance is not found by id, the error is not directly returned
to prevent enumeration.
- Permissions are checked in the API instead of the interceptor for
these calls.
- Setting the same instance name in the update no longer returns an
error, but the previous change date.
# Additional Changes
none
# Additional Context
- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x
# Which Problems Are Solved
As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.
# How the Problems Are Solved
- This PR moves project v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with `(google.api.field_behavior)
= REQUIRED` and validation rules have been added where missing.
- Name ID of the project always `project_id`
- `UpdateProjectRequest` has been updated to align with the creation and
retrieval of a project:
- `project_role_check` has been renamed to `authorization_required`
- `has_project_check` has been renamed to `project_access_required`
- `ListProjectRequest` has been changed:
- `project_grant_resource_owner_filter`,
`project_grant_resource_owner_filter` and
`project_organization_id_filter` have been removed and merged into a
single `organization_id_filter` where a `type` can optionally be
specified to select `owned`, `granted` or both project types within a
specified organization.
- `ListProjectGrantReques` has been changed:
- `project_resource_owner_filter` has been renamed to
`project_organization_id_filter`
- `grant_resource_owner_filter` has been renamed to
`granted_organization_id_filter`
# Additional Changes
Replaced deprecated `intergration.WithAuthorization` with
`integration.WithAuthorizationToken` in integration tests.
# Additional Context
- part of #10772
- requires backport to v4.x
# Which Problems Are Solved
As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.
# How the Problems Are Solved
- This PR moves the authorization v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- The `organization_id` to create an authorization is now required to be
always passed. There's no implicit fallback to the project's
organization anymore.
- The `user_id` filter has been removed in favor of the recently added
`in_user_ids` filter.
- The returned `Authorization` object has been reworked to return
`project`, `organization` and `roles` as objects like the granted `user`
already was.
- Additionally the `roles` now not only contain the granted `role_keys`,
but also the `display_name` and `group`. To implement this the query has
been updated internally. Existing APIs are unchanged and still return
just the keys.
# Additional Changes
None
# Additional Context
- part of https://github.com/zitadel/zitadel/issues/10772
- closes#10746
- requires backport to v4.x
Added a warning to mention that the built in SMTP provider is for
testing only, not production.
**Context:** Customers often complain about email delivery delays while
using the built in SMTP provider, and they should configure their own.
# Which Problems Are Solved
This document is draft for applying to the DPF it provides a privacy
policy compliant to DPF principles.
Privacy Policy according to [DPF
principles](https://www.dataprivacyframework.gov/). This draft was
approved by the U.S. Department of Commerce.
# How the Problems Are Solved
* Add DPF Adherence Statement
* Add Recourse, Enforcement, and Liability: Including IDR and
Arbitration
* Self-certification completed
* Registered for independent recourse mechanism (JAMS)
* Approval by U.S. Department of Commerce
# Additional Changes
* Update HQ address
* Removed the analytics providers and provided a link to the
sub-processor list. All analytics providers are marked as such and have
a link to their privacy policy.
* Added a note that future notices will be published on our trust center
* Smaller changes such as updating headings
---------
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Copilot <[email protected]>
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->
# Which Problems Are Solved
- The Zitadel configuration example in the documentation is incomplete,
causing applications to fail even when redirect URIs are properly
configured in the Zitadel console.
- Missing required configuration fields (redirect_uri and
post_logout_redirect_uri) in the code example lead to authentication
flow failures.
# How the Problems Are Solved
- Added the required redirect_uri field to the ZitadelConfig example.
- Added the required post_logout_redirect_uri field to the ZitadelConfig
example.
Co-authored-by: Tim Möhlmann <[email protected]>
# Which Problems Are Solved
As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.
# How the Problems Are Solved
- This PR moves app v2beta service and its endpoints to a corresponding
to application v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- Name ID of the application always `application_id`, previously was
also `id` and `app_id`.
- Get rid of all `app` abbreviations and name it `application` including
the service name, `AppState` -> `ApplicationState` and `AppSorting` ->
`ApplicationSorting`
- Updated `CreateApplicationRequest`:
- renamed `creation_request_type` to `application_type` and all its
options to `XY_configuration` instead of `XY_request`
- `RegenerateClientSecret`
- renamed method to `GenerateClientSecret`
- removed `app_type` from request
- `ListApplicationRequest`:
- removed required `project_id` and provided it as a filter
- Type `ApplicationNameQuery` has been renamed to
`ApplicationNameFilter` as its usage in the request
- Renamed all fields and types from `config` to `configuration`
- Updated `DeleteApplicationKeyRequest`
- removed `organization_id`
- Updated `GetApplicationKeyRequest`:
- removed `project_id`, `application_id` and `organization_id``
- Updated `ListApplicationKeysRequest`:
- removed oneOf `resource_id` and moved the options into filters
- Name ID of the application key always `key_id`.
- removed unnecessary package prefixed (`zitadel.application.v2`)
- formatted using `buf`
# Additional Changes
None
# Additional Context
- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x
Federico CoppedeandGitHub
Mridang AgarwallaandGitHub
Wim Van LaerandGitHub
Livio SpringandGitHub
RamonandGitHub
Matías RacedoandGitHub
Mohamed TammamandGitHub
