Skip to main content

v26.3.4

v26.3.4​

hydra update oauth2-client no longer resets fields you did not pass​

The hydra update oauth2-client command now updates only the fields you provide as flags. Previously, the command replaced the entire client: any field not passed again on the command line was silently reset to its default value, which could drop redirect URIs, secrets-related settings, CORS origins, and other configuration.

The command now sends a partial update (PATCH /admin/clients/{id}) built from exactly the flags you set. For example, running hydra update oauth2-client <id> --name "new name" changes only the client name and leaves all other settings untouched.

Updating from a file (--file client.json or --file -) keeps the previous behavior and replaces the entire client, since a file represents a complete client configuration.

Breaking changes​

Scripts that relied on hydra update oauth2-client resetting unspecified fields to their defaults must now pass a complete client definition with --file to get replace semantics.

Ory CLI​

The equivalent change in the Ory CLI (ory update oauth2-client) will land in CLI v1.3.2.

Faster OAuth2 token issuance under database latency​

Ory Hydra no longer serializes JSON Web Key reads behind a global lock. Token issuance, the authorize flow, and the OpenID Connect discovery endpoint now read signing keys concurrently, so a slow database query no longer queues all other requests behind it.

Generating a missing key set is now deduplicated per network and key set: concurrent requests that race on a fresh installation trigger exactly one key generation per instance and share its result. A request that is canceled while waiting no longer aborts the generation for other waiting requests.

The Ory Hydra OEL key-set cache now scopes cache entries by network ID.

Fix OIDC session leak in the device authorization grant​

The OpenID Connect device grant now deletes its stored OIDC session after issuing an id_token. Previously the session was looked up by the device-code signature but deleted using the raw device_code, so the delete never matched and every successful device-flow id_token issuance left one OIDC session behind. On storage backends without a TTL this grew without bound.

This is an availability fix only. Device codes could still not be replayed, so there was no token-reuse or authorization impact.

Hydra CLI reports the key set name when getting JSON Web Keys​

hydra get jwks (and ory get jwk in the Ory CLI) now reports which key set each key belongs to. Previously the set attribute was missing from JSON and YAML output for single-key sets, and empty in every output format for sets with more than one key.

Each key in the output now carries its own set attribute. When keys from several sets are fetched in one command, the keys are attributed to their correct sets instead of an empty name.

The API reference for creating a JSON Web Key now documents that generating a key into an existing set keeps the existing keys, except on deployments using a Hardware Security Module (HSM), where the set is replaced and contains only the new key.

Metrics endpoints now support OpenMetrics and trace exemplars​

The Prometheus metrics endpoints of Kratos, Keto, Hydra, Oathkeeper, and Talos now additionally serve the OpenMetrics exposition format. The format is selected automatically through standard HTTP content negotiation: scrapers that ask for OpenMetrics receive it, and all other scrapers keep receiving the classic text format. No configuration or scraper change is necessary.

OpenMetrics enables exemplars, which attach a trace reference to a metric sample. Two sets of metrics use this:

  • The HTTP request duration histograms and request counters attach an exemplar when a request runs under a sampled trace, so latency dashboards can link slow-request outliers and error spikes to the traces that caused them.
  • The ory_x_popx_cockroach_transaction_retries_total counter attaches an exemplar whose value is the transaction's retry count when a transaction is retried during a traced request, and the trace records a db.transaction.retry span event. Dashboards can link retry spikes directly to the traces that caused them.

That counter's caller label now also more reliably attributes automatic CockroachDB transaction retries to the business operation that opened the transaction, for example the OAuth2 refresh token flow, instead of a generic persistence Transaction wrapper method. This makes it possible to see which operation is causing database contention. Dashboards or alerts that match specific caller label values may need updating, because existing label values change with this release.

OAuth2 client secret rotation​

Hydra now supports zero-downtime client secret rotation. See the documentation for details.

Thanks to @SamuelDev (https://github.com/SamuelDev) for the initial implementation!

YugabyteDB support for Kratos, Hydra, and Keto (OEL)​

Ory Enterprise License deployments can now run Ory Kratos, Ory Hydra, and Ory Keto against YugabyteDB.

Enabling YugabyteDB​

Point the dsn at your YugabyteDB cluster using the yugabyte:// scheme (the synonym yugabytedb:// also works):

yugabyte://user@host:5433/database?sslmode=disable

Recovering an interrupted migration​

YugabyteDB applies DDL with autocommit. Old PostgreSQL migrations inherited by YugabyteDB can contain multiple statements, so an interruption may leave the first statements applied without a row in schema_migration. Current versions of Ory no longer use multi-statement migrations and are safe.