New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.3

v26.4.3​

OEL images are no longer published to Cloudsmith​

Ory no longer publishes OEL images, their signatures, or their attestations to Cloudsmith (docker.cloudsmith.io/ory-corp/oel). New releases are available only from the Ory enterprise registries. Images already on Cloudsmith stay there, but receive no further versions.

Breaking changes​

Pull OEL images from the enterprise registry​

If you pull OEL images from docker.cloudsmith.io/ory-corp/oel, switch to the Ory enterprise registry to receive new releases. Contact Ory if you need access.

Configure the length and characters of one-time codes​

Ory Kratos Identities has two new settings for the one-time codes it sends for login, registration, verification, and account recovery: selfservice.methods.code.config.length takes a value from 6 to 20, and selfservice.methods.code.config.alphabet takes digits or alphanumeric. Alphanumeric codes use lowercase letters and digits without easily confused characters, and users can enter them in any letter case. Codes stay six digits unless you change these settings.

The code input node now carries maxlength, pattern, and a new inputmode attribute that match the configured format. Render inputmode in custom UIs so mobile devices show a keyboard with letters for alphanumeric codes. Ory Elements reads it and shows a single text field for codes longer than eight characters. See One-time code format.

De-activating an identity revokes its sessions​

Setting an identity's state to inactive through the admin API now revokes all of its sessions. Before, the sessions stayed active and were only rejected while the identity was inactive, so activating the identity again restored them. Now an identity that is activated again must sign in again.