Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/self-hosted/oel/keto/changelog/v26.2.7.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
No changelog entries found for keto/oel in versions v26.2.7
Comment thread
adamwalach marked this conversation as resolved.
24 changes: 24 additions & 0 deletions docs/self-hosted/oel/kratos/changelog/v26.2.7.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
## v26.2.7

### Add `security.disallow_ref_in_identity_schemas` to lock down schema loading

Introduces an opt-in config flag, `security.disallow_ref_in_identity_schemas` (default `false`), intended for multi-tenant
deployments where identity-schema URLs come from untrusted operators.

When enabled, `$ref` URLs inside identity schemas may no longer resolve to `file://`, `http://`, or `https://`. This blocks
server-side file reads and request forgery attempts via malicious identity schemas. Internal JSON-pointer refs
(`#/definitions/...`) and self-contained `base64://` refs remain allowed. Operator-configured top-level schema URLs are
unaffected.

Ory Network forces the flag on. Existing self-hosted deployments keep their current behavior unless they explicitly opt in.

### Support for required traits during OIDC on native applications

On native applications, Kratos now supports asking the user to supply additional traits during the registration flow, if the
traits are required by the identity schema, but not supplied by the OIDC mapper.

Additionally, you can use the
[`updateRegistrationFlow`](https://www.ory.com/docs/reference/api#tag/frontend/operation/updateRegistrationFlow) to supply traits
to be merged with the OIDC mapper data.

This aligns the functionality with the browser version of the registration flow.
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oathkeeper/changelog/v26.2.7.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
No changelog entries found for oathkeeper/oel in versions v26.2.7
Comment thread
adamwalach marked this conversation as resolved.
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oauth2/changelog/v26.2.7.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
No changelog entries found for hydra/oel in versions v26.2.7
Comment thread
adamwalach marked this conversation as resolved.
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oel-hydra-image-tags.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| Image Tag | Release Date |
| ---------------------------------------- | ------------ |
| 26.2.7 | 2026-04-24 |
| 26.2.6 | 2026-04-22 |
| 26.2.5 | 2026-04-20 |
| 26.2.4 | 2026-04-14 |
Expand Down
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oel-keto-image-tags.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| Image Tag | Release Date |
| ---------------------------------------- | ------------ |
| 26.2.7 | 2026-04-24 |
| 26.2.6 | 2026-04-22 |
| 26.2.5 | 2026-04-20 |
| 26.2.4 | 2026-04-14 |
Expand Down
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oel-kratos-image-tags.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| Image Tag | Release Date |
| ---------------------------------------- | ------------ |
| 26.2.7 | 2026-04-24 |
| 26.2.6 | 2026-04-22 |
| 26.2.5 | 2026-04-20 |
| 26.2.4 | 2026-04-14 |
Expand Down
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oel-oathkeeper-image-tags.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| Image Tag | Release Date |
| ---------------------------------------- | ------------ |
| 26.2.7 | 2026-04-24 |
| 26.2.6 | 2026-04-22 |
| 26.2.5 | 2026-04-20 |
| 26.2.4 | 2026-04-14 |
Expand Down
1 change: 1 addition & 0 deletions docs/self-hosted/oel/oel-polis-image-tags.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
| Image Tag | Release Date |
| ---------------------------------------- | ------------ |
| 26.2.7 | 2026-04-24 |
| 26.2.6 | 2026-04-22 |
| 26.2.5 | 2026-04-20 |
| 26.2.4 | 2026-04-14 |
Expand Down
1 change: 1 addition & 0 deletions docs/self-hosted/oel/polis/changelog/v26.2.7.md
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
No changelog entries found for polis/oel in versions v26.2.7
Comment thread
adamwalach marked this conversation as resolved.
Loading