v4.15.2
Fixed 10
- Always validate exp and iat claims of JWT IdPs
- Client_id verification during code exchange and refresh token flows
- Connection handling in setup after migration steps 40, 64 and 70
- Allow overwriting resource owner of events in eventstore
- Apply PKCE when building OAuth and OIDC providers
- Manage and validate audience in JWT IdP
- Accept IDP sessions on passkey registration in login
- Load custom font from branding settings and allow in CSP in login
- Remove unnecessary entry from default denylist
- Use protected http client for outgoing connections
4.15.2 (2026-06-17)
Bug Fixes
- always validate exp and iat claims of JWT IdPs (4925fab)
- client_id verification during code exchange and refresh token flows (5624030)
- connection handling in setup after migration steps 40, 64 and 70 (#12293) (c53d977)
- eventstore: allow overwriting resource owner of events (#12261) (a939b84)
- idp: apply PKCE when building OAuth and OIDC providers (#12247) (ab7c6c0), closes #12036 #12054
- jwt idp: manage and validate audience (999e2bb)
- login: accept IDP sessions on passkey registration (#12275) (add46e0)
- login: load custom font from branding settings and allow in CSP (#12279) (9f1561d), closes #11200
- remove unnecessary entry from default denylist (#12294) (1ca1fbd)
- use protected http client for outgoing connections (b6f7808)