New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.9

v26.4.9​

Cleaner SBOM and CBOM attestations for OEL images​

The SBOM attestations of OEL images now list the license of each Go module. They no longer list the timezone database, shell profile and license text files of the base image, the source repository metadata of the scanner, or secret-pattern matches that are not cryptographic assets. Each document is validated against its schema before it is signed. Tools that ingest the attestations need no changes.

Compromised eMudhra roots removed from the trust store and container images​

The root certificates compiled into Ory Hydra, Ory Kratos, Ory Keto, and Ory Talos no longer include "emSign ECC Root CA - G3" and "Comodo AAA Services root", the roots distrusted after the eMudhra intermediate CA compromise. The binaries verify outbound TLS connections against this compiled-in root set, so this is the change that removes trust in those roots.

The Ory Enterprise License and open source container images are now also built on gcr.io/distroless/static-debian13, whose ca-certificates 20250419+deb13u1 package no longer ships either root (Debian advisory DSA-6572-1).