New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.3

v26.4.3​

OEL images are no longer published to Cloudsmith​

Ory no longer publishes OEL images, their signatures, or their attestations to Cloudsmith (docker.cloudsmith.io/ory-corp/oel). New releases are available only from the Ory enterprise registries. Images already on Cloudsmith stay there, but receive no further versions.

Breaking changes​

Pull OEL images from the enterprise registry​

If you pull OEL images from docker.cloudsmith.io/ory-corp/oel, switch to the Ory enterprise registry to receive new releases. Contact Ory if you need access.

Client assertion JWT IDs work with non-UTC database time zones​

Ory Hydra now tracks the jti of client assertion JWTs correctly when the PostgreSQL or CockroachDB session time zone is not UTC. Before, Hydra removed jti values too early or too late, depending on the time zone offset. As a result, Hydra could accept a jti that was still in use, or reject a jti whose earlier use had already expired. See ory/hydra#3740.

Scopes and audiences containing a pipe character are preserved​

A scope or audience value that contains |, such as the SMART App Launch scope patient/Observation.rs?code=http://loinc.org|1234-5, used to come back split into several values in the issued access token and the introspection response, and refreshing such a token failed. Tokens and codes issued after the upgrade keep these values intact and refresh normally. Tokens issued before the upgrade still carry the split values until they expire. To restore a refresh token issued before the upgrade, send the user through the authorization flow again.