Changelog

Release notes for every Pocket ID version, with the new features, fixes and breaking changes of each release.

v2.19.1 - 2026-10-22

Release

Bug Fixes

bump go to v1.27.3, alpine to 3.24.3 and distroless to debian13 (ec14aa2 by @kmendell)

Other

Bump vite-plus from 1.1.0 to 1.3.0 (274977c by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.19.0...v2.19.1

v2.19.0 - 2026-10-21

Release

Features

add configurable login notification modes (#1813 by @stonith404)
make my apps searchable and sortable (9c0c304 by @stonith404)
add ability to override SSRF protection with OUTBOUND_ALLOWED_HOSTS_* (3ffe013 by @stonith404)
use WebAuthn recommended passkey algorithms (#1841 by @michaelbeaumont)
add ability to force email verification (#1837 by @stonith404)
add ability to deselect scopes on authorization (f81d62c by @stonith404)

Bug Fixes

prevent DN collisions from assigning another user’s privileges (be45b1c by @stonith404)
remove distracting tab switch animation (69065e7 by @stonith404)
export from SQLite fails to import into Postgres because of mismatched schemas (8ab3dd4 by @stonith404)
limit upload size for profile pictures and application images (#1819 by @IonBazan)
prevent email enumeration via one-time access email request (ade5520 by @stonith404)
rate limit updating the own account to slow down user enumeration (226648c by @stonith404)
reject cross-origin state-changing requests (d31e3e1 by @stonith404)
limit LDAP profile picture downloads to 2 MB (d8ca4b6 by @stonith404)
remove unused oidc client /meta endpoint (a58ccea by @stonith404)
only return minimal client metadata for public interaction endpoint (03fc844 by @stonith404)
prefix audit log event translation keys to separate them from UI strings (c7a7bce by @stonith404)
push group removals made on the user page to SCIM (#1830 by @jayhemnani9910)
push group removals if user gets deleted to SCIM (d7f58e5 by @stonith404)
fallback to username if chars in name are not supported for avatars (e2cacac by @stonith404)
keep integer custom claim values exact in ID tokens and userinfo (#1829 by @jayhemnani9910)
push users disabled by the LDAP sync to SCIM (#1834 by @jayhemnani9910)
skip LDAP users without an email instead of failing the whole sync (#1835 by @jayhemnani9910)
send the API key expiration email again after a renewal (#1847 by @jayhemnani9910)
find user groups by their friendly name in the admin search (#1854 by @choksi2212)
keep login notification and email verification settings on upgrade (6b9aba1 by @stonith404)

Documentation

update README screenshots (ed45102 by @stonith404)

Other

update AAGUIDs (#1811 by @pocket-id-bot[bot])
Bump sharp from 0.35.4 to 0.35.5 (#1818 by @dependabot[bot])
Bump source-map-js from 1.2.1 to 1.2.2 (#1817 by @dependabot[bot])
Bump the “all-dependencies” group with 4 updates across multiple ecosystems (#1826 by @dependabot[bot])
resolve golangci-lint failures (1bd6f00 by @stonith404)
authorize API routes with per-endpoint scopes (#1823 by @stonith404)
use crowdin github actions to sync translations (4416b0c by @stonith404)
combine CI checks into a single workflow file (74e08f0 by @stonith404)
add missing cache-dependency-path to go setup (b0b09ce by @stonith404)
add gofmt to stage hook (54f28f8 by @stonith404)
update Fosite (fd7951f by @stonith404)
move shared files into .github repo (3355b65 by @stonith404)
update golangci-lint (#1833 by @ItalyPaleAle)
upgrade francis to 0.1.1 (#1838 by @ItalyPaleAle)
upgrade Fosite (a7f5d80 by @stonith404)
fix flaky unit test (5bf7e1d by @stonith404)
run CI checks on v* branches as well (80a504b by @stonith404)
remove unused issuer check from refresh token API validation (03cab69 by @stonith404)
upgrade Fosite (6b6ef9a by @stonith404)
Bump the “all-dependencies” group with 4 updates across multiple ecosystems (#1851 by @dependabot[bot])
update AAGUIDs (#1856 by @pocket-id-bot[bot])
restore the PR template in the repo so the PR quality check can read it (09d4da8 by @stonith404)
Bump follow-redirects from 1.16.0 to 1.16.1 (#1862 by @dependabot[bot])
bump Fosite (b352c81 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.18.0...v2.19.0

v2.18.0 - 2026-10-04

Release

If you are interested, checkout Umpteenth, a side project I just open-sourced. With Pocket ID for example we are using it to enrich the translation context in Crowdin automatically and very token efficiently.

Features

display passkey setup page for users coming from the login page (4d2a5e4 by @stonith404)
add ability to search and select icons from selfh.st (#1807 by @stonith404)
pin table row actions and add them to details pages (3e201b5 by @stonith404)

Other

Bump the “all-dependencies” group with 4 updates across multiple ecosystems (#1805 by @dependabot[bot])
add project_id to crowdin.yml (5560060 by @stonith404)
upgrade to SvelteKit 3 (10efd16 by @stonith404)
fix vulnerable dependency versions (c968123 by @stonith404)
add vite-plus as node toolchain (#1806 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.17.0...v2.18.0

v2.17.0 - 2026-10-01

Release

Discussion

We just opened a discussion about the current state of UI and UX of Pocket ID. We would love to get your feedback on it ❤️

Changelog

Features

add FRANCIS_HOST to connect to a standalone Francis runtime (#1768 by @ItalyPaleAle)
add OIDC back-channel logout (#1734 by @alecrubin)
restore old behavior of automatically creating client secret (d259a15 by @stonith404)
redesign OIDC client details page (e588e3f by @stonith404)
add support Cloudflare location headers (1a91eaa by @stonith404)
update authorization animation slightly (1f67bb7 by @stonith404)
make page transitions smoother and faster (9c926bd by @stonith404)

Bug Fixes

typo in fallback error message in interaction error page (#1776 by @samuelQUANSAH)
handle localStorage not enabled gracefully (#1786 by @ItalyPaleAle)
add 1min grace period to refresh token invalidation (b2d4fae by @stonith404)
use URI validation message for API resources (0235984 by @stonith404)

Documentation

add missing swaggertype (77a597d by @stonith404)

Other

use Pocket ID as identity for automated commits (5086ece by @stonith404)
update AAGUIDs (#1771 by @pocket-id-bot[bot])
pin all GH Actions to a specific SHA (#1772 by @ItalyPaleAle)
Bump the “all-dependencies” group with 1 update across multiple ecosystems (#1780 by @dependabot[bot])
update AAGUIDs (#1788 by @pocket-id-bot[bot])
upgrade Francis to 0.1.0 (#1787 by @ItalyPaleAle)
add Vercel OSS Program badge (fd478ff by @kmendell)
bring database.json up-to-date (642ccc8 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.16.0...v2.17.0

v2.16.0 - 2026-09-20

Release

Features

update the design of the email templates (3249b0d by @stonith404)

Bug Fixes

loading indicator not visible (4ba2899 by @stonith404)
login with Yubikey not working in some Safari browsers (4858db3 by @stonith404)

Other

upgrade git cliff version (98f9e39 by @stonith404)
update francis to rc7 (#1769 by @ItalyPaleAle)
include frontend dependencies in SBOM (5a1c6f0 by @stonith404)
include SBOMs for binaries (8fe53ed by @stonith404)
replace local release script with action (ba246e6 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.15.0...v2.16.0

v2.15.0 - 2026-09-19

Release

Features

show admin UI warning for SQLite on networked filesystem (#1713 by @ItalyPaleAle)
list allowed groups when hovering over allowed group count (#1671 by @kmendell)
add explicit public keys for federated client credentials (#1702 by @ItalyPaleAle)
use HS256 for Pocket ID’s own session tokens + fixes (#1733 by @ItalyPaleAle)
replace individual save buttons with single “unsaved changes bar” (#1757 by @stonith404)
include passkey icons based on AAGUID (#1756 by @michaelbeaumont)

Bug Fixes

Update de.json Translation (#1705 by @tw-)
show long login code button regardless where the user is coming from (059d45d by @stonith404)
make sorting of strings case insensitive (3657012 by @stonith404)
trim values loaded from _FILE env vars in AppConfig (#1741 by @ItalyPaleAle)
serve bundled logo if no custom logo is set (#1748 by @ItalyPaleAle)
add missing await to catch redirect invalid URL errors (fd99a6b by @stonith404)
limit JPG and PNG pixels to prevent decompression bomb (5cbacd8 by @stonith404)
show more user friendly error page for authorize interaction failures (81cb290 by @stonith404)
don’t auto submit OAuth device codes (43c0b79 by @stonith404)
prevent PAR requirement bypass via conflicting request parameters (2084dff by @stonith404)
German translations for client secrets (#1759 by @darioackermann)
preserve AAGUID icon hashes on Windows (b816360 by @stonith404)
default profile picture empty if username contains only one char (4edfaf6 by @stonith404)

Documentation

update AI Usage Policy (d9e9df9 by @stonith404)
update PR template (cad8b68 by @stonith404)

Other

Bump the “all-dependencies” group with 2 updates across multiple ecosystems (#1711 by @dependabot[bot])
add Hungarian language files (dd2fc67 by @stonith404)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1725 by @dependabot[bot])
update Go to v1.27.0 (f235104 by @stonith404)
update golangci-lint version (6ff9a5b by @stonith404)
update Francis to rc.2 (#1728 by @ItalyPaleAle)
upgrade jwx to v4 (#1730 by @ItalyPaleAle)
Bump google.golang.org/grpc from 1.83.0 to 1.83.1 in /backend (#1736 by @dependabot[bot])
update Francis to rc.5 (#1738 by @ItalyPaleAle)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1739 by @dependabot[bot])
update Francis to rc.6 (#1745 by @ItalyPaleAle)
Bump adm-zip from 0.6.0 to 0.6.1 (#1747 by @dependabot[bot])
update AAGUIDs (#1751 by @github-actions[bot])
Bump the “all-dependencies” group with 2 updates across multiple ecosystems (#1742 by @dependabot[bot])
update vulnerable packages (1ee34fd by @stonith404)
upgrade alpine packages on image build (d2c2cda by @stonith404)
Bump the “all-dependencies” group with 2 updates across multiple ecosystems (#1760 by @dependabot[bot])
fix type checks (c22003f by @stonith404)
Bump go.opentelemetry.io/otel/exporters/zipkin from 1.44.0 to 1.45.0 in /backend (#1765 by @dependabot[bot])
update backend dependencies (6060c6e by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.14.0...v2.15.0

v2.14.0 - 2026-08-18

Release

Features

add animated logo as default logo (0c9a03e by @stonith404)
hide apps without launch url on My Apps page (3ca9a55 by @stonith404)
support multiple client secrets per OIDC client (#1679 by @ItalyPaleAle)
serve RFC 8414 authorization server metadata (#1685 by @jfroy)
allow admins to auto grant APIs to CIMD clients (#1692 by @stonith404)
improve tooltip design (6a441b1 by @stonith404)
reduce one time access code length for better UX (a487c78 by @stonith404)

Bug Fixes

improve validation of app config variables (9e637d5 by @stonith404)
wrong loading indicator shown on device page (2f43ce4 by @stonith404)
ignore unsupported grant types in client ID metadata documents (#1682 by @ItalyPaleAle)
don’t show “show hidden apps” if none available (03498e2 by @stonith404)
ignore trailing slash in resources (9421d43 by @stonith404)
update de.json Translation (#1699 by @tw-)
remove unnecessary information from oidc client details (900346a by @stonith404)

Documentation

change logo image in README.md (76f6b24 by @stonith404)
add error responses to openapi spec (#1684 by @aclerici38)

Other

Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1668 by @dependabot[bot])
update francis to beta 21 (#1669 by @ItalyPaleAle)
migrate LDAP sync to an actor (#1651 by @ItalyPaleAle)
bump pnpm to v11.20.0 (#1670 by @kmendell)
remove unnecessary curl dependency from Dockerfile (987d1a8 by @stonith404)
update Francis to beta 22 (#1676 by @ItalyPaleAle)
update AAGUIDs (#1678 by @github-actions[bot])
move iss param handling to Fosite (1bb21c5 by @stonith404)
fix flaky update application image e2e test (#1690 by @ItalyPaleAle)
move API key cleanup job to actor (#1687 by @ItalyPaleAle)
Bump the “all-dependencies” group with 4 updates across multiple ecosystems (#1693 by @dependabot[bot])
use fix version for github.com/italypaleale/go-kit (07580d9 by @stonith404)
update AAGUIDs (#1696 by @github-actions[bot])
move remaining database cleanup jobs to actors (#1698 by @ItalyPaleAle)
migrate SCIM sync to actor + add tests (#1680 by @ItalyPaleAle)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.13.0...v2.14.0

v2.13.0 - 2026-08-07

Release

Bug Fixes

retry qr code login polling for known transient gateway responses (7039692 by @stonith404)
decrease QR code login session duration to 5 minutes (e35be30 by @stonith404)
show more user-friendly error message if QR code has expired (27199f6 by @stonith404)
one-time-access-token CLI fails with “RuntimePSKs is required” (#1637 by @salcatroppa)
session revoke fails if orphaned session tokens exist (598895e by @stonith404)
disable api key auth for webauthn register endpoints (db64b15 by @stonith404)
explicitly set SameSite to Lax for cookies (69d55ad by @stonith404)
explicitly require JSON for request bodies (1238bf0 by @stonith404)
don’t rely on content length header for optional json binding (2c7d1b6 by @stonith404)
respect log level in HTTP request logs (488c50e by @stonith404)
don’t skip rate limits for loopback addresses (140b5d3 by @stonith404)
make OIDC client token lifetimes optional (#1650 by @ItalyPaleAle)
in non-HA mode, increase AlarmLeaseDuration (#1660 by @ItalyPaleAle)
separate TLS inputs and preserve certificate reloads (#1653 by @stonith404)
brotli compression ignored (#1661 by @stonith404)
align last signed in text left (c87012a by @stonith404)

Features

make oauth access tokens RFC 9068 compliant (7c55bdf by @stonith404)
implement OAuth Client ID Metadata Document (#1526 by @jfroy)
add ability to customize session duration of clients (#1641 by @stonith404)
add observability to actors (#1646 by @ItalyPaleAle)
include Francis data in Pocket ID backups (#1645 by @ItalyPaleAle)
add settings for limiting what passkeys can be used (#1662 by @stonith404)

Other

preserve tab indentation for package.json in release script (a1ebf4e by @stonith404)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1639 by @dependabot[bot])
use paraglide markup instead of custom implementation (b08ac7b by @stonith404)
fix wrong database version in database.json (281bea5 by @stonith404)
standardize API error handling (#1635 by @stonith404)
add deepsec to gitignore (e3e0ddc by @stonith404)
upgrade vulnerable dependencies (9320144 by @stonith404)
remove unused curl dependency from Dockerfile (98160b2 by @stonith404)
remove invalid unit test (95809dd by @stonith404)
use smaller francis.bin (4fe6f06 by @stonith404)
move GeoLite to its own package (#1647 by @ItalyPaleAle)
fix formatting (#1666 by @Copilot)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.12.0...v2.13.0

v2.12.0 - 2026-07-29

Release

Features

add support for proxy protocol (807bd9e by @stonith404)
add declarative user id configuration (#1622 by @schnz)
migrate one-time and signup tokens to an actor (#1611 by @ItalyPaleAle)
add support for declarative client secret configuration (#1619 by @schnz)
add qr code alternative sign in method (#1594 by @stonith404)
migrate app locks to Francis (#1624 by @ItalyPaleAle)
drop user initiated one time access token login method (0c27f73 by @stonith404)
display country and city on qr code login approval screen (9e72bc1 by @stonith404)

Bug Fixes

sync group membership for users added at creation time (#1600 by @ItalyPaleAle)
relax Francis DB usage while HA is still WIP (#1602 by @ItalyPaleAle)
honor webauthn user verification setting (0983e91 by @stonith404)
horizontal shadow of cards in light mode cut off (599f7d1 by @stonith404)
datatype mismatch between postgres and sqlite causes import to fail (ad06ea6 by @stonith404)
show only accessible clients on “My Apps” page (e10f66c by @stonith404)
autofocus one time input fields (#1605 by @James18232)
enforce user verification for login assertions (4743d59 by @stonith404)
make oidc device code redemption atomic (6bd058a by @stonith404)
race condition in initial admin setup (ca28ddc by @stonith404)
fail early if webauthn session invalid (968f97f by @stonith404)

Other

Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1599 by @dependabot[bot])
update AAGUIDs (#1608 by @github-actions[bot])
use actors for db configuration (#1604 by @ItalyPaleAle)
remove not used permissions (942bb3b by @stonith404)
upgrade vulnerable dependencies (f6b02ef by @stonith404)
fix missing data in database.json (6e859de by @stonith404)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1621 by @dependabot[bot])
use NewTextHandler instead of NewHandler for tint (8563934 by @stonith404)
run unit tests on windows and linux (31d62c6 by @stonith404)
correctly close filesystems (6bd4679 by @stonith404)
modularize email module and use actor for email verification (#1625 by @stonith404)
pin version of fosite fork (91d3712 by @stonith404)
translations remove unused translation strings (d5eb3fe by @stonith404)
enforce eslint rules (9060291 by @stonith404)
upgrade vulnerable dependencies (0c5e014 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.11.0...v2.12.0

v2.11.0 - 2026-07-13

Release

Bug Fixes

postgres migration 20250822 remove public schema references (#1582 by @MarcoScabbiolo)
allow insecure callback URLs by default until next major release (d9ead47 by @stonith404)
sort signup tokens by creation date explicitly (77398a5 by @stonith404)
login code mobile ux (#1584 by @James18232)
INTERNAL_APP_URL not reflected in UI URLs (316cf47 by @stonith404)
ignore tab URL hashes in navigation history (a3f27ec by @stonith404)
block link-local addresses in SSRF protection (9714296 by @stonith404)

Features

add support for CIDR and IP address lists in TRUST_PROXY (187cd8d by @stonith404)

Other

manage instance ID in the KV table (#1579 by @ItalyPaleAle)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1578 by @dependabot[bot])
remove low demand issue closer (bb03660 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.10.0...v2.11.0

v2.10.0 - 2026-07-10

Release

Features

upgrade shadcn components (80509c8 by @stonith404)
add ability to skip consent for client (d467855 by @stonith404)
prompt admin with PKCE client support hint (#1499 by @James18232)
login code input boxes (#1545 by @James18232)
drop TOFU support for callback URL (931a6c2 by @stonith404)
add OAuth APIs with scoped permissions (#1542 by @stonith404)
add support for unencrypted OIDC request parameter (25dcad7 by @stonith404)
add description field to oidc clients (#1547 by @seanmckenzie428)
add tab bar navigation for crowded pages (28a553f by @stonith404)

Bug Fixes

login code null submission and login code length check (#1512 by @James18232)
various bugs in observability / OTel (#1564 by @ItalyPaleAle)
/authorize endpoint crashes when list of scopes is empty (#1575 by @ItalyPaleAle)
mobile layout improvements (2910c51 by @stonith404)

Documentation

add link to API docs (968d072 by @stonith404)
fix wrong OpenAPI documentation (da3677f by @stonith404)

Other

close low-demand feature requests (35987b9 by @stonith404)
Bump the “all-dependencies” group with 2 updates across multiple ecosystems (#1528 by @dependabot[bot])
fix locators after shadcn upgrade (dbbe2a4 by @stonith404)
use fosite for OAuth 2.0 logic (#1520 by @stonith404)
wrap last two migrations into transaction (cf9a319 by @stonith404)
remove dead code (519cda0 by @stonith404)
update vulnerable dependencies (e538ea0 by @stonith404)
fix flaky test (7eaaea7 by @stonith404)
add AGENTS.md (d0243fe by @stonith404)
use goreleaser for binaries and static image builds (#1478 by @kmendell)
add support for Docker Hub (99ab38d by @stonith404)
remove static next image tag (49305ed by @stonith404)
don’t build unnecessary binaries for next image (4b957a0 by @stonith404)
change Depot project (cdc2374 by @stonith404)
don’t tag next image with current version (cf54786 by @stonith404)
add exempt user to PR quality checks (254ae88 by @stonith404)
migrate API key functionality to single apikey module (9fce987 by @stonith404)
migrate Webauthn functionality to single webauthn module (58fcf7c by @stonith404)
migrate signup functionality to single usersignup module (ecad31c by @stonith404)
make API key renewal date picker navigation date-independent (#1560 by @ItalyPaleAle)
integrate Francis actor framework for background jobs, cron scheduling, and rate limiting (#1556 by @ItalyPaleAle)
Bump the “all-dependencies” group with 3 updates across multiple ecosystems (#1563 by @dependabot[bot])
use go-kit for sending emails (#1565 by @ItalyPaleAle)
update AAGUIDs (#1567 by @github-actions[bot])
move Pocket ID specific logic from Fosite into Pocket ID repo (9a94aa0 by @stonith404)
update Fosite version (337fc6f by @stonith404)
pass transaction to resolveResource (7667377 by @stonith404)
remove redundant dtos (fa2d08c by @stonith404)
rename migrations (c72da58 by @stonith404)
remove duplicate fosite config properties (190914f by @stonith404)
fix migration version in database.json (a5f2192 by @stonith404)
fix wrong migration name (ce7d3a7 by @stonith404)
run formatter (59a6868 by @stonith404)
upgrade go version (f62d476 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.9.0...v2.10.0

v2.9.0 - 2026-06-16

Release

Bug Fixes

issues with loading new font (#1496 by @MelvinSnijders)
PAR parameters not respected by authorize page (3d9d4de by @stonith404)
add responsive css for api/user/group/client page add buttons (#1508 by @James18232)
load Gloock font from static path instead of inline (89b4abb by @stonith404)
update terminology from public key code exchange to proof key co… (#1515 by @maxwassiljew)
callback URL validation not validated if prompt=none (8a75774 by @stonith404)
passkey card not rounded (84678c3 by @stonith404)

Documentation

add AI Usage Policy to CONTRIBUTING.md (fea933b by @stonith404)
add PR template (bf9f76b by @stonith404)
add “needs more upvotes” label as default (fc42f62 by @stonith404)
fix link to watchtower repo (#1500 by @wollew)

Features

add support for Pushed Authorization Requests (RFC9126) (#1404 by @Zenithar)

Other

fix linter issues (4f97cd4 by @stonith404)
update AAGUIDs (#1511 by @github-actions[bot])
run svelte check and unit tests in breaking branches (83b45f6 by @stonith404)
run formatter (2726ddd by @stonith404)
bump vite from 8.0.13 to 8.0.16 (#1521 by @dependabot[bot])
npm dependabot not run from root (c0d96a0 by @stonith404)
fix wrong assertion (effd2a1 by @stonith404)
Bump the “all-dependencies” group with 4 updates across multiple ecosystems (#1523 by @dependabot[bot])

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.8.0...v2.9.0

v2.8.0 - 2026-05-31

Release

Bug Fixes

delete refresh tokens on end-session to prevent reuse after logout (#1458 by @wucm667)
return 404 status code for .well-known routes if not found (714b5b3 by @stonith404)
add email_verified to reserved claims list (8b22fca by @stonith404)
reject unknown PKCE code challenge methods (ce6bdb9 by @stonith404)
make stream of downloaded logos seekable for S3 checksum calculation (cc9163f by @stonith404)
scope confirmation wasn’t shown if account selection was prompted (272d147 by @stonith404)
add support for unix socket mode in healthcheck (a712196 by @stonith404)
restore cross-platform binary builds (7027296 by @stonith404)

Documentation

update SECURITY.md (bb5a111 by @stonith404)

Features

delete OAuth refresh token on RP initiated logout (#1480 by @stonith404)
remove EXIF/XMP metadata from uploaded images (#1477 by @stonith404)
add support for response_mode=fragment (0c95b7c by @stonith404)
add support for systemd socket activation (#1479 by @deviant)
improve design trough the whole application (b3d40a4 by @stonith404)

Other

update AAGUIDs (#1476 by @github-actions[bot])
upgrade dependencies (91c2ea2 by @stonith404)
remove deprecated http2 package (e56dc12 by @stonith404)
apply go 1.26.0 syntax updated (8ad95b8 by @stonith404)
delete refresh tokens on end-session to prevent reuse after logout (b27a52a by @stonith404)
use dependabot for automatic dependency upgrades (b9fdd53 by @stonith404)
fix invalid schema (e8c398f by @stonith404)
update AAGUIDs (#1487 by @github-actions[bot])
use custom Playwright route for callback URL checks (f134247 by @stonith404)
fix linter issues (bc4f75c by @stonith404)
don’t compare hashes of profile pictures (9ad2bfc by @stonith404)
run formatter (0616aba by @stonith404)
use fixed minor version of Go (e046a03 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.7.0...v2.8.0

v2.7.0 - 2026-05-11

Release

Bug Fixes

add _FILE support for S3_SECRET_ACCESS_KEY_FILE env var (#1452 by @ItalyPaleAle)
invalidate cache when changing image (#1462 by @GameTec-live)
fall back to Basic auth when PKCE puts client_id in body (#1466 by @mgabor3141)

Documentation

add missing /api prefix to app config swagger routes (#1454 by @aclerici38)

Features

add support for response_mode=form_post (#1360 by @Johnwulp)
add support for “select_account” prompt (#1453 by @ItalyPaleAle)

Other

add script to update deps (f9f93f0 by @stonith404)
upgrade dependencies (20df033 by @stonith404)
post dependency upgrade fixes (e33a9b8 by @stonith404)
migrate github actions runners to depot runners (#1329 by @kmendell)
fix caching of ldap-cli e2e tests docker build (#1457 by @kmendell)
fix incorrect container name variable (5c7e5f6 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.6.2...v2.7.0

v2.6.2 - 2026-04-21

Release

Bug Fixes

return correct byte count in HEAD request writer (#1443 by @ahampal)
improve keyboard navigation and screen-reader labels (#1445 by @bjoernch)

Other

upgrade to vite 8.0 and pnpm 10.33.0 (#1446 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.6.1...v2.6.2

v2.6.1 - 2026-04-21

Release

Bug Fixes

restore login screen background from not showing up (975d3c7 by @kmendell)

Other

ignore webauthn type for swagger generation (ce4b89d by @kmendell)
update golangci-lint (#1440 by @ItalyPaleAle)
Add catalan language (#1436 by @mcasellas)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.6.0...v2.6.1

v2.6.0 - 2026-04-19

Release

Bug Fixes

disable callback URLs with protocols “javascript” and “data” (#1397 by @ItalyPaleAle)
strip Root prefix from S3 List() returned paths (#1413 by @vtmocanu)
use valid Tailwind v4 transition class for auth animation squares (#1415 by @CoolShades)
resolve posixGroup memberUid as bare usernames (#1422 by @gucong3000)
prevent flickering if no background image is set on login page (027e6f0 by @stonith404)
improve form input layout if description next to it is multi col (9ec4683 by @stonith404)
access token renewal bypasses important checks (978ac87 by @stonith404)

Features

add ability to revoke passkeys of users as admin (#1386 by @jose-d)
add auth method claim (amr) to tokens (#1433 by @stonith404)
add TLS support for HTTP/2 server (#1429 by @IngmarStein)
add OpenID Connect prompt Parameter Handling (#1299 by @rjaakke)
return not found. on /setup if already completed (444f7ff by @stonith404)

Other

update AAGUIDs (#1403 by @github-actions[bot])
upgrade dependencies (f8f7222 by @stonith404)
combobox not closed in e2e test (fbdb93f by @stonith404)
Security upgrade alpine from latest to 3.23.4 (#1431 by @stonith404)
security upgrade alpine from latest to 3.23.4 (#1432 by @stonith404)
add Catalan language files (4f09de2 by @stonith404)
reduce complexity of ValidateEnvConfig and initRouter (a0cb574 by @stonith404)
pass context to shutdownServer (ff26c42 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.5.0...v2.6.0

v2.5.0 - 2026-03-26

Release

Bug Fixes

better error messages when there’s another instance of Pocket ID running (#1370 by @ItalyPaleAle)
move tooltip inside of form input to prevent shifting (#1369 by @GameTec-live)
derive LDAP admin access from group membership (#1374 by @kmendell)
avoid fmt.Sprintf on custom GeoLiteDBUrl without %s placeholder (#1384 by @choyri)
show a warning when SQLite DB is stored on NFS/SMB/FUSE (#1381 by @ItalyPaleAle)
empty background restore after reboot (#1379 by @taoso)
allow one-char username on signup (#1378 by @taoso)
separate querying LDAP and updating DB during sync (#1371 by @ItalyPaleAle)

Features

allow use of svg, png, and ico images types for favicon (#1289 by @taoso)
allow clearing background image (#1290 by @taoso)
add token_endpoint_auth_methods_supported to .well-known (#1388 by @owenvoke)
add TRUSTED_PLATFORM environment variable for gin (#1372 by @choyri)

Other

add pr quality action (e3905cf by @stonith404)
bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /backend in the go_modules group across 1 directory (#1391 by @dependabot[bot])
Improve Latvian translations in lv.json (#1382 by @Raito00)
ignore linter on app image bootstrap (5251cd9 by @kmendell)
upgrade dependencies (e7e0176 by @kmendell)
upgrade dependencies (3c42a71 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.4.0...v2.5.0

v2.4.0 - 2026-03-07

Release

Bug Fixes

improve wildcard matching by using go-urlpattern (#1332 by @stonith404)
federated client credentials not working if sub ≠ client_id (#1342 by @ItalyPaleAle)
handle IPv6 addresses in callback URLs (#1355 by @ItalyPaleAle)
wildcard callback URLs blocked by browser-native URL validation (#1359 by @Copilot)
one-time-access-token route should get user ID from URL only (#1358 by @ItalyPaleAle)
various fixes in background jobs (#1362 by @ItalyPaleAle)
use URL keyboard type for callback URL inputs (a675d07 by @stonith404)

Features

allow first name and display name to be optional (#1288 by @taoso)

Other

bump svelte from 5.53.2 to 5.53.5 in the npm_and_yarn group across 1 directory (#1348 by @dependabot[bot])
bump @sveltejs/kit from 2.53.0 to 2.53.3 in the npm_and_yarn group across 1 directory (#1349 by @dependabot[bot])
update AAGUIDs (#1354 by @github-actions[bot])
add Português files (01141b8 by @kmendell)
add Latvian files (e0fc4cc by @kmendell)
fix wrong seed data (e7bd66d by @stonith404)
fix wrong seed data in database.json (f4eb8db by @stonith404)

Performance Improvements

frontend performance optimizations (#1344 by @ItalyPaleAle)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.3.0...v2.4.0

v2.3.0 - 2026-02-23

Release

Bug Fixes

ENCRYPTION_KEY needed for version and help commands (#1256 by @kmendell)
prevent deletion of OIDC provider logo for non admin/anonymous users (#1267 by @HiMoritz)
add type="url" to url inputs (bb7b0d5 by @stonith404)
increase rate limit for frontend and api requests (aab7e36 by @stonith404)
decode URL-encoded client ID and secret in Basic auth (#1263 by @ypomortsev)
token endpoint must not accept params as query string args (#1321 by @ItalyPaleAle)
left align input error messages (b3fe143 by @stonith404)
disallow API key renewal and creation with API key authentication (#1334 by @stonith404)

Features

add VERSION_CHECK_DISABLED environment variable (#1254 by @dihmandrake)
add support for HTTP/2 (56afebc by @stonith404)
manageability of uncompressed geolite db file (#1234 by @gucheen)
add JWT ID for generated tokens (#1322 by @imnotjames)
current version api endpoint (#1310 by @kmendell)

Other

bump @sveltejs/kit from 2.49.2 to 2.49.5 in the npm_and_yarn group across 1 directory (#1240 by @dependabot[bot])
bump svelte from 5.46.1 to 5.46.4 in the npm_and_yarn group across 1 directory (#1242 by @dependabot[bot])
bump devalue to 5.6.2 (9dbc02e by @kmendell)
upgrade deps (4811625 by @kmendell)
add Estonian files (53ef61a by @kmendell)
update AAGUIDs (#1257 by @github-actions[bot])
add Norwegian language files (80558c5 by @stonith404)
run formatter (60825c5 by @kmendell)
bump axios from 1.13.2 to 1.13.5 in the npm_and_yarn group across 1 directory (#1309 by @dependabot[bot])
update dependenicies (94a4897 by @kmendell)
update AAGUIDs (#1316 by @github-actions[bot])
bump svelte from 5.46.4 to 5.51.5 in the npm_and_yarn group across 1 directory (#1324 by @dependabot[bot])
bump @sveltejs/kit from 2.49.5 to 2.52.2 in the npm_and_yarn group across 1 directory (#1327 by @dependabot[bot])
upgrade dependencies (0678699 by @stonith404)
upgrade to node 24 and go 1.26.0 (#1328 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.2.0...v2.3.0

v2.2.0 - 2026-01-11

Release

Bug Fixes

allow changing “require email address” if no SMTP credentials present (8c68b08 by @stonith404)
data import from sqlite to postgres fails because of wrong datatype (1a032a8 by @stonith404)
user can’t update account if email is empty (5828fa5 by @stonith404)
login codes sent by an admin incorrectly requires a device token (03f9be0 by @stonith404)
allow exchanging logic code if already authenticated (0e2cdc3 by @stonith404)
db version downgrades don’t downgrade db schema (4df4bcb by @stonith404)

Features

add CLI command for encryption key rotation (#1209 by @stonith404)
improve passkey error messages (2f25861 by @stonith404)
make home page URL configurable (#1215 by @stonith404)
add option to renew API key (#1214 by @stonith404)
add support for email verification (#1223 by @stonith404)
add environment variable to disable built-in rate limiting (9ca3d33 by @stonith404)
add static api key env variable (#1229 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.1.0...v2.2.0

v2.1.0 - 2026-01-04

Release

Bug Fixes

invalid cookie name for email login code device token (d6a7b50 by @stonith404)

Features

add issuer url to oidc client details list (#1197 by @kmendell)
process nonce within device authorization flow (#1185 by @justincmoy)

Other

run SCIM jobs in context of gocron instead of custom implementation (4881130 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.0.2...v2.1.0

v2.0.2 - 2026-01-03

Release

Bug Fixes

migration fails if users exist with no email address (2f651ad by @stonith404)
allow version downgrade if database is dirty (ba00f40 by @stonith404)
localhost callback URLs with port don’t match correctly (7c34501 by @stonith404)

Other

add no-op migration to postgres (a24b2af by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.0.1...v2.0.2

v2.0.1 - 2026-01-02

Release

Bug Fixes

admins imported from LDAP lose admin privileges (2cce200 by @stonith404)
restore old input input field size (2341da9 by @stonith404)

Other

bump image tag to v2 (cd2e9f3 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.0.0...v2.0.1

v2.0.0 - 2026-01-02

Release

Features

add support for SCIM provisioning (#1182 by @stonith404)
add CLI command for importing and exporting Pocket ID data (3420a00 by @stonith404)
add HTTP HEAD method support (#1135 by @stonith404)
add email logo customization (#1150 by @MelvinSnijders)
add ability define user groups for sign up tokens (#1155 by @stonith404)
minor redesign of auth pages (08e4ffe by @stonith404)
allow audit log retention to be controlled by env variable (#1158 by @jenic)
restrict oidc clients by user groups per default (#1164 by @stonith404)
add “restricted” column to oidc client table (1bc9f5f by @stonith404)
drop support for storing JWK on the filesystem (f014458 by @stonith404)
remove DbProvider env variable and calculate it dynamically (ba2f0f1 by @kmendell)

Bug Fixes

update image format message to include WEBP (#1133 by @sebdanielsson)
add Japanese locale to inlang settings (#1142 by @tai-ga)
restrict email one time sign in token to same browser (#1144 by @stonith404)
rename LDAP_ATTRIBUTE_ADMIN_GROUP env variable to LDAP_ADMIN_GROUP_NAME (e1c5021 by @stonith404)
make wildcard matching in callback URLs more stricter (078152d by @stonith404)
remove ambiguous characters from login code (d9e7bf9 by @stonith404)
add missing translations to date picker (894eaf3 by @stonith404)

Other

update AAGUIDs (#1128 by @github-actions[bot])
fix api key e2e test (25f67bd by @stonith404)
update AAGUIDs (#1140 by @github-actions[bot])
upgrade dependencies (90f555f by @stonith404)
fix type error after version bump (edb32d8 by @stonith404)
remove breaking/** push trigger from actions (461293b by @stonith404)
update AAGUIDs (#1177 by @github-actions[bot])
preparation for merge into main branch (#1113 by @stonith404)
bump pnpm to version 10.27.0 (#1183 by @kmendell)
update forms and other areas to use new shadcn components (#1115 by @kmendell)
run formatter (e4a8ca4 by @stonith404)
upgrade dependencies (4776b70 by @stonith404)
change translation string in e2e tests (ffb2ef9 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.16.0...v2.0.0

v1.16.0 - 2025-11-30

Release

Bug Fixes

use quoted-printable encoding for mails to prevent line limitation (5cf73e9 by @stonith404)
automatically create parent directory of Sqlite db (cfc9e46 by @stonith404)
global audit log user filter not working (d98c0a3 by @stonith404)
theme mode not correctly applied if selected manually (a1cd325 by @stonith404)
hide theme switcher on auth pages because of dynamic background (5d6a7fd by @stonith404)

Documentation

add ENCRYPTION_KEY to .env.example for breaking change preparation (4eeb06f by @stonith404)

Features

light/dark/system mode switcher (#1081 by @kmendell)
add support for S3 storage backend (#1080 by @stonith404)
add support for WEBP profile pictures (#1090 by @stonith404)
add database storage backend (#1091 by @ItalyPaleAle)
adding/removing passkeys creates an entry in audit logs (#1099 by @ItalyPaleAle)
add option to disable S3 integrity check (a3c9687 by @stonith404)
add Cache-Control: private, no-store to all API routes per default (#1126 by @stonith404)

Other

update pnpm to 10.20 (#1082 by @kmendell)
run checks on PR to breaking/** branches (ab9c0f9 by @stonith404)
use constants for AppEnv values (#1098 by @ItalyPaleAle)
bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /backend in the go_modules group across 1 directory (#1107 by @dependabot[bot])
add Finish files (ca888b3 by @stonith404)
upgrade dependencies (4bde271 by @stonith404)
fix Dutch validation message (f523f39 by @stonith404)
fix package vulnerabilities (3d46bad by @stonith404)
update vscode launch.json (#1117 by @mnestor)
rename file backend value fs to filesystem (8d30346 by @stonith404)
fix wrong storage value (b2c718d by @stonith404)
run formatter (14c7471 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.15.0...v1.16.0

v1.15.0 - 2025-11-06

Release

Bug Fixes

sorting by PKCE and re-auth of OIDC clients (e03270e by @stonith404)
replace %lang% placeholder in html lang (#1071 by @daimond113)
disabled property gets ignored when creating an user (76e0192 by @stonith404)
remove redundant indexes in Postgres (6a038fc by @stonith404)

Features

open edit page on table row click (f184120 by @stonith404)
add ability to set default profile picture (#1061 by @stonith404)

Other

add support for OpenBSD binaries (d683d18 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.14.2...v1.15.0

v1.14.2 - 2025-10-29

Release

Bug Fixes

dark oidc client icons not saved on client creation (#1057 by @mufeedali)

Other

add Turkish language files (a190529 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.14.1...v1.14.2

v1.14.1 - 2025-10-27

Release

Bug Fixes

Prevent blinding FOUC in dark mode (#1054 by @mufeedali)
use credProps to save passkey on firefox android (#1055 by @lhoursquentin)
ignore trailing slashes in APP_URL (65616f6 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.14.0...v1.14.1

v1.14.0 - 2025-10-24

Release

Bug Fixes

ignore trailing slash in URL (9f0aa55 by @stonith404)
use constant time comparisons when validating PKCE challenges (#1047 by @ItalyPaleAle)
only animate login background on initial page load (b356cef by @stonith404)
make pkce requirement visible in the oidc form if client is public (47927d1 by @stonith404)
prevent page flickering on redirection based on auth state (10d6403 by @stonith404)

Features

add various improvements to the table component (#961 by @stonith404)
add support for dark mode oidc client icons (#1039 by @kmendell)

Other

add Japanese files (068fcc6 by @kmendell)
bump sveltekit-superforms from 2.27.1 to 2.27.4 in the npm_and_yarn group across 1 directory (#1031 by @dependabot[bot])
update AAGUIDs (#1041 by @github-actions[bot])
bump vite from 7.0.7 to 7.0.8 in the npm_and_yarn group across 1 directory (#1042 by @dependabot[bot])
upgrade dependencies (6362ff9 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.13.1...v1.14.0

v1.13.1 - 2025-10-07

Release

Bug Fixes

uploading a client logo with an URL fails (#1008 by @CzBiX)
mark any callback url as valid if they contain a wildcard (#1006 by @stonith404)

Other

cleanup root of repo, update workflow actions (#1003 by @kmendell)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.13.0...v1.13.1

v1.13.0 - 2025-10-05

Release

Bug Fixes

uploading a client logo with an URL fails if folder doesn’t exist (ad8a90c by @stonith404)

Features

add link to API docs on API key page (2c74865 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.12.0...v1.13.0

v1.12.0 - 2025-10-03

Release

Bug Fixes

do not use cache=shared for in-memory SQLite (#971 by @ItalyPaleAle)
show only country in audit log location if no city instead of Unknown (#977 by @vilisseranen)
display login location correctly if country or city is not present (79989fb by @stonith404)
remove previous socket file to prevent bind error (#979 by @Caian)
tokens issued with refresh token flow don’t contain groups (#989 by @ItalyPaleAle)
make logo and oidc client images sizes consistent (01db8c0 by @stonith404)
include port in OIDC client details (2c1c67b by @stonith404)
prevent endless effect loop in login wrapper (fc9939d by @stonith404)
improve back button handling on auth pages (d47b203 by @stonith404)
allow any image source but disallow base64 (22f4254 by @stonith404)
date locale can’t be loaded if locale is en (b81de45 by @stonith404)

Features

support for url based icons (#840 by @kmendell)
hide alternative sign in methods page if email login disabled (d010be4 by @stonith404)
add required indicator for required inputs (#993 by @stonith404)
add the ability to make email optional (#994 by @stonith404)

Other

fix whitespace after commit message (e8b172f by @stonith404)
update AAGUIDs (#972 by @github-actions[bot])
remove unnecessary logo fallback (b746ac0 by @stonith404)

v1.11.2 - 2025-09-20

Release

Bug Fixes

embedded paths not found on windows (c55143d by @stonith404)
do not treat certain failures in app images bootstrap as fatal (#966 by @ItalyPaleAle)
decouple images from app config service (#965 by @stonith404)

Other

use git cliff for release notes (fde4e9b by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v1.11.1...v1.11.2

v1.11.1 - 2025-09-18

Release

Bug Fixes

add missing translations (8c9cac2)

v1.11.0 - 2025-09-18

Release

Features

add CSP header (#908) (6215e1a)
add INTERNAL_APP_URL env variable (#858 by @DerSteph)
add info box to app settings if UI config is disabled (a1d8538)
add PWA support (#938) (5367463)
add support for LOG_LEVEL env variable (#942) (2d6d5df)
add user display name field (#898) (6837360)
allow uppercase usernames (#958) (0224949)
client_credentials flow support (#901 by @savely-krasovsky)
return new id_token when using refresh token (#925) (307caaa)

Bug Fixes

add validation for callback URLs (#929) (6c91474)
disable sign up options in UI if UI_CONFIG_DISABLED (1d7cbc2)
ensure users imported from LDAP have fields validated (#923) (4215523)
key-rotate doesn’t work with database storage (#940) (c018f29)
list items on previous page get unselected if other items selected on next page (6c696b4)
make environment variables case insensitive where necessary (#954) (99f31a7)
my apps card shouldn’t take full width if only one item exists (e7e53a8)
update localized name and description of ldap group name attribute (#892) (e88be7e)

v1.10.0 - 2025-08-27

Release

Features

redesigned sidebar with administrative dropdown (#881) (096d214)

Bug Fixes

apps showed multiple times if user is in multiple groups (641bbc9)

v1.9.1 - 2025-08-24

Release

Bug Fixes

sqlite migration drops allowed user groups (d6d1a4c)

v1.9.0 - 2025-08-24

Release

Features

support automatic db migration rollbacks (#874) (c114a2e)

Bug Fixes

don’t force uuid for client id in postgres (2ffc6ba)
ensure SQLite has a writable temporary directory (#876) (1f3550c)
sort order incorrect for apps when using postgres (d0392d2)

v1.8.1 - 2025-08-24

Release

Bug Fixes

migration clears allowed users groups (5971bfb)
wrong column type for reauthentication tokens in Postgres (#869) (1283314)

v1.8.0 - 2025-08-23

Release

Features

add option to OIDC client to require re-authentication (#747 by @MorrisMorrison) (0cb039d)
allow custom client IDs (#864 thanks to @James18232) (a5efb95)
display all accessible oidc clients in the dashboard (#832) (3188e92)
login code font change (#851 by @James18232) (d28bfac)
signup: add default user groups and claims for new users (#812 by @zeedif) (182d809)

Bug Fixes

authorization can’t be revoked (0aab3f3)
delete webauthn session after login to prevent replay attacks (fe003b9)
deps: bump rollup from 4.45.3 to 4.46.3 (#845 by @gepbird) (b5e6371)
enable foreign key check for sqlite (#863) (625f235)
ferated identities can’t be cleared (24e2742)
for one-time access tokens and signup tokens, pass TTLs instead of absolute expiration date (#855) (7ab0fd3)
ignore client secret if client is public (#836 by @James18232) (7b1f6b8)
move audit log call before TX is committed (#854) (9339e88)
non admin users can’t revoke oidc client but see edit link (0e44f24)
oidc client advanced options color (fc0c99a)

v1.7.0 - 2025-08-10

Release

Features

add robots.txt to block indexing (#806 by @Etienne-bdt) (06e1656)
add support for code_challenge_methods_supported (#794) (d479817)
Support OTel and JSON for logs (via log/slog) (#760) (78266e3)
support reading secret env vars from _FILE (#799) (0a3b1c6)
user application dashboard (#727) (484c2f6)

Bug Fixes

admins can not delete or disable their own account (f0c144c)
authorization animation not working (9ac5d51)
custom claims input suggestions instantly close after opening (4d59e72)
delete WebAuthn registration session after use (#783) (c8478d7)
set input type ‘email’ for email-based login (#776) (d541c9a)

v1.6.4 - 2025-07-21

Release

Bug Fixes

migration fails on postgres (#762) (35d5f88)

v1.6.3 - 2025-07-21

Release

Bug Fixes

allow passkey names up to 50 characters (b03e91b)
ensure user inputs are normalized (#724) (7b4ccd1)
show rename and delete buttons for passkeys without hovering over the row (2952b15)
use object-contain for images on oidc-client list (d3bc179)
use user-agent for identifying known device signins (ef1d599)

v1.6.2 - 2025-07-09

Release

Bug Fixes

ensure confirmation dialog shows on top of other components (f103a54)
login failures on Postgres when IP is null (#737) (e1de593)

v1.6.1 - 2025-07-06

Release

v1.6.0 - 2025-07-06

Release

Features

add support for OAuth 2.0 Authorization Server Issuer Identification (bf04256)
add distroless container additional variant + healthcheck command (#716)
encrypt private keys saved on disk and in database (#682)
enhance language selection message and add translation contribution link (be52660)
add “key-rotate” command (#709)

Bug Fixes

allow profile picture update even if “allow own account edit” enabled (9872608)
app config forms not updating with latest values (#696)
auth fails when client IP is empty on Postgres (#695)
custom claims input suggestions flickering (49f1ab2)
keep sidebar in settings sticky (e46f60a)
show friendly name in user group selection (5c9e504)
support non UTF-8 LDAP IDs (#714)
token introspection authentication not handled correctly (#704)

v1.5.0 - 2025-06-27

Release

Features

add self-service signup with token and open registration modes (#672)
improve initial admin creation workflow (287314f)
redact sensitive app config variables if set with env variable (ba61cdb)

Bug Fixes

error page flickering after sign out (1a77bd9)
improve accent color picker disabled state (d976bf5)
less noisy logging for certain GET requests (#681 by @11notes)
margin of user sign up description (052ac00)
remove duplicate request logging (#678 by @ryankask)
users can’t be updated by admin if self account editing is disabled (29cb551)

v1.4.1 - 2025-06-22

Release

Bug Fixes

app not starting if UI config is disabled and Postgres is used (7d36bda)

v1.4.0 - 2025-06-19

Release

Features

allow setting unix socket mode (#661 by @CnTeng) (7677a3d)
auto-focus on the login buttons (#647 By @ItalyPaleAle) (d679530)
configurable local ipv6 ranges for audit log (#657) (d548523)
location filter for global audit log (#662) (ac5a121)
ui accent colors (#643) (883877a)
use icon instead of text on application image update hover state (215531d)

Bug Fixes

allow images with uppercase file extension (1bcb50e)
center oidc client images if they are smaller than the box (946c534)
explicitly cache images to prevent unexpected behavior (2e5d268)
reduce duration of animations on login and signin page (#648 By @ItalyPaleAle) (d770448)

v1.3.1 - 2025-06-09

Release

Bug Fixes

change timestamp of client_credentials.sql migration (2935236)

v1.3.0 - 2025-06-09

Release

Features

add API endpoint for user authorized clients (d217083)
add unix socket support (#615 by @CnTeng)
JWT bearer assertions for client authentication (#566 by @ItalyPaleAle)
new color theme for the UI (97f7326)
oidc client data preview (#624)

Bug Fixes

don’t load app config and user on every route change (bdcef60)
misleading text for disable animations option (657a51f)
OIDC client image can’t be deleted (61b62d4)
UI config overridden by env variables don’t apply on first start (5e9096e)

v1.2.0 - 2025-06-03

Release

Features

auto detect callback url (#583)

Bug Fixes

allow users to update their locale even when own account update disabled (6c00aaa)
clear default app config variables from database (decf8ec)
fallback to primary language if no translation available for specific country (2440379)
improve spacing on auth screens (04fcf11)
page scrolls up on form submission (31ad904)
run jobs at interval instead of specific time (#585 by @ItalyPaleAle)
show LAN for auditlog location for internal networks (b874681)
small fixes in analytics_job (#582 by @ItalyPaleAle)
whitelist authorization header for CORS (b9489b5)

v1.1.0 - 2025-05-28

Release

Features

add daily heartbeat request for counting Pocket ID instances (#578)
require user verification for passkey sign in (68e4b67)
show allowed group count on oidc client list (#567) (38d7ee4)

Bug Fixes

use ldapAttributeUserUsername for finding group members (#565)

v1.0.0 - 2025-05-24

Release

→ Please follow the migration guide.

Features

serve the static frontend trough the backend (#520)

Bug Fixes

animation speed set to max of 300ms (c726c16)
custom logo not correctly loaded if UI configuration is disabled (bf710ae)
show correct app name on sign out page (131f470)
trim whitespaces from string inputs (059073d)

v0.53.0 - 2025-05-08

Release

Features

add support for TZ environment variable (5e2e947)

Bug Fixes

handle CORS correctly for endpoints that SPAs need (#513)

v0.52.0 - 2025-05-06

Release

Features

add healthz endpoint (#494 by @ItalyPaleAle)
add OpenTelemetry tracing and metrics (#495 by @daenney)

Bug Fixes

correctly set script permissions inside Docker container (c55fef0)

v0.51.1 - 2025-05-03

Release

Bug Fixes

allow LDAP users to update their locale (0b9cbf4)
last name still showing as required on account form (#492)
non admin users weren’t able to call the end session endpoint (6bd6cef)

v0.51.0 - 2025-04-28

Release

Features

new login code card position for mobile devices (#452 by @James18232)

Bug Fixes

do not require PKCE for public clients (ce24372)
hide global audit log switch for non admin users (1efd1d1)
return correct error message if user isn’t authorized (86d2b5f)
updating scopes of an authorized client fails with Postgres (0a24ab8)

v0.50.0 - 2025-04-27

Release

Features

device authorization endpoint (#270)
make family name optional (#476)

Bug Fixes

incorrectly swapped refreshToken and accessToken (#490 by @j-baker)
do not override XDG_DATA_HOME/XDG_CONFIG_HOME if they are already set (#472 by @it)
pass context to methods that were missing it (#487 by @ItalyPaleAle)
prevent deadlock when trying to delete LDAP users (#471 by @ItalyPaleAle)
rootless Caddy data and configuration (#470 by @eiqnepm)