v26.3.16
v26.3.16
Phone number validation now uses current numbering-plan data
Ory validates phone numbers against the current libphonenumber dataset. Numbers in ranges assigned since the previous dataset now
validate on format: tel identity traits and on SMS identifiers, where they were previously rejected.
Phone numbers typed with any Unicode decimal digits, such as Devanagari or Bengali, now normalize to E.164. Previously only Arabic-Indic and fullwidth digits did.
Breaking changes
The same refresh removes ranges that national regulators have withdrawn:
| Country | Withdrawn range |
|---|---|
| Syria | +963 91x, +963 92x, +963 97x |
| Slovenia | +386 49x |
| Monaco | +377 49x, +377 049x |
| Faroe Islands | +298 88x |
| Vietnam | +84 80xx |
| Norway / Svalbard | +47 4536x |
| Georgia | +995 5441x |
Syria also gains the +963 90x range.
For identities that already hold a number in a withdrawn range:
- Sign-in, account recovery, and verification work only when the number is entered without spaces or dashes:
+38649xxxxxx, not+386 49x xxx. Formatted input fails with the generic invalid-credentials error, so the cause is not visible to the user. - New registrations with such a number are rejected.
- Password changes and other settings updates are rejected while the stored number remains in a withdrawn range, because the identity is validated against the schema on every settings write.
Check your identities for the prefixes above and ask affected users to update to a currently assigned number. The withdrawn ranges are no longer assignable, so those numbers may stop receiving SMS regardless of Ory.