ZITADEL

Developer Tools

An identity and access management platform with multi-tenancy built in.

Latest v4.16.3 · by ZITADELWebsitezitadel/zitadel

Release activity

Release activity — 10 releases across 7 days since Jun 10, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jun 10, 2026. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Jun 15, 20261 release on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
Wednesday1 release on Jun 10, 20262 releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 20262 releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 20261 release on Jul 10, 20262 releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 20261 release on Aug 7, 2026
SaturdayNo releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Jun 10, 2026, busiest day 2

Changelog

v3.4.14

Fixed 2
  • Prevent external-IDP account pre-hijack in Login V1
  • Require authentication before WebAuthn/U2F and TOTP/OTP enrollment
3.4.14 (2026-07-29)
Bug Fixes
  • login: prevent external-IDP account pre-hijack in Login V1 (da67750)
  • login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (dd975b8)
View originalPermalink
How v3.4.14 went

v4.16.2

Changed 1
  • speed up ListUsers login name equality filters
Fixed 2
  • improve random string generation
  • redirect to external IdP after domain discovery regardless of registration policy
Security 3
  • prevent external-IDP account pre-hijack in Login V1
  • require authentication before WebAuthn/U2F and TOTP/OTP enrollment
  • use protected http client for org domain HTTP verification
4.16.2 (2026-07-29)
Bug Fixes
  • improve random string generation (#12266) (34345ea)
  • login: prevent external-IDP account pre-hijack in Login V1 (917ade3)
  • login: redirect to external IdP after domain discovery regardless of registration policy (#12369) (c4ba5a1), closes #12021 #12023
  • login: require authentication before WebAuthn/U2F and TOTP/OTP enrollment (c20d613)
  • use protected http client for org domain HTTP verification (35122e4)
Performance Improvements
  • query: speed up ListUsers login name equality filters (#12460) (b3b8da0)
View originalPermalink
How v4.16.2 went

v3.4.13

Fixed 1
  • prevent disk access via require in actions
3.4.13 (2026-07-17)
Bug Fixes
  • actions: prevent disk access via require (e28d6bc)
View originalPermalink
How v3.4.13 went

v4.16.1

Fixed 3
  • Display minimum length in password complexity message
  • Keep submit button disabled/loading during password set
  • Prevent crash on a stale session cookie
Security 1
  • Prevent disk access via require in actions
4.16.1 (2026-07-17)
Bug Fixes
  • actions: prevent disk access via require (afe1086)
  • console: display minimum length in password complexity message (#12419) (cc3812a), closes #12390
  • login: keep submit button disabled/loading during password set r… (#12429) (0a355f7), closes #12416
  • login: prevent crash on a stale session cookie (#12423) (6030a43), closes #11130
View originalPermalink
How v4.16.1 went

v4.16.0

Added 2
  • Allow managing invite code in secret generators
  • FIPS 140-3 compliant build and runtime checks
Fixed 12
  • Correct scope validation in token exchange
  • Correctly remove adjacent roles on user grants
  • Increase performance of ListUser by login name ignore case
  • Allow custom protocols for native apps again
  • Improve contrast of IDP processing message
  • Improve error handling for user registration

4.16.0 (2026-07-10)

Bug Fixes
  • correct scope validation in token exchange (#12312) (02d07e9), closes #12319 #12322 #12319 #12322
  • Correctly remove adjacent roles on user grants (dc89900)
  • increase performance of ListUser by login name ignore case (#12350) (8fed358)
  • login: allow custom protocols for native apps again (#12332) (5b3c10e)
  • login: improve contrast of IDP processing message (#12309) (30ad9ab)
  • login: improve error handling for user registration (#12338) (fa916e7)
  • login: migrate legacy Tailwind v4 opacity utilities and fix checkbox contrast color (#12360) (70850db)
  • login: preserve org domain suffix through account chooser navigation (#12304) (3311fb9), closes #12024
  • login: Prevent IDP auto-creation failure when name fields are missing (#11070) (ab2e099)
  • login: redirect to loginname instead of empty accounts page when org scope filters all sessions (#12346) (f21f95c), closes #11914
  • login: use correct requestId with oidc_ prefix in Prompt.LOGIN + loginHint flow (#12376) (57eb145), closes #11946 #11946
  • prevent double triggering of verification emails (#11995) (9ae9bf3)
Features
  • allow managing invite code in secret generators (#12109) (915586a)
  • crypto: FIPS 140-3 compliant build and runtime checks (#12233) (c03d9f4)
View originalPermalink
How v4.16.0 went

v4.15.3

Fixed 4
  • Add client and scope validation for token exchange
  • Ensure external user's email is verified before auto-linking
  • Center text for generic IDP buttons without icons in login
  • Guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths
4.15.3 (2026-06-22)
Bug Fixes
  • added client and scope validation for token exchange (e2886a6)
  • ensure external user's email is verified before auto-linking (c97012f)
  • login: center text for generic IDP buttons without icons (#12211) (aadc664), closes #12182
  • login: guard defaultRedirectUri in OIDC/SAML FailedPrecondition paths (0382659)
View originalPermalink
How v4.15.3 went

v3.4.12

Fixed 3
  • Always validate exp and iat claims of JWT IdPs
  • Client_id verification during code exchange and refresh token flows
  • Manage and validate audience for JWT IdP
3.4.12 (2026-06-17)
Bug Fixes
  • always validate exp and iat claims of JWT IdPs (d1c3aa8)
  • client_id verification during code exchange and refresh token flows (5b1708e)
  • jwt idp: manage and validate audience (42f629d)
View originalPermalink
How v3.4.12 went

v4.15.2

Fixed 10
  • Always validate exp and iat claims of JWT IdPs
  • Client_id verification during code exchange and refresh token flows
  • Connection handling in setup after migration steps 40, 64 and 70
  • Allow overwriting resource owner of events in eventstore
  • Apply PKCE when building OAuth and OIDC providers
  • Manage and validate audience in JWT IdP
4.15.2 (2026-06-17)
Bug Fixes
  • always validate exp and iat claims of JWT IdPs (4925fab)
  • client_id verification during code exchange and refresh token flows (5624030)
  • connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
  • eventstore: allow overwriting resource owner of events (#12261) (a939b84)
  • idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
  • jwt idp: manage and validate audience (999e2bb)
  • login: accept IDP sessions on passkey registration (#12275) (add46e0)
  • login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
  • remove unnecessary entry from default denylist (#12294) (1ca1fbd)
  • use protected http client for outgoing connections (b6f7808)
View originalPermalink
How v4.15.2 went

v3.4.11

Fixed 1
  • Check permission based on provided data on user updates in the API
3.4.11 (2026-06-10)
Bug Fixes
  • api: check permission based on provided data on user updates (90f3102)
View originalPermalink
How v3.4.11 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
GitHub CLI

GitHub command-line tool

GitHub
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion