v1.3.2-pre.0

autogen: pin v1.3.2-pre.0 release commit

Bug Fixes

• Bring back dummy post-release Make target (f9247ab)

• Broken stdin during ory dev release publish (7f4be1f)

• Git flag (45f61c3)

• Make --yes skip the sign-in confirmation prompt (#452) (266f34c)

• Ory dev release (228c2c9)

• Publish npm binaries as per-platform optionalDependencies (#447) (3e534d2):

  The @ory/cli npm package used binwrap to download the CLI binary at
  install time. binwrap is unmaintained and depends on the deprecated
  request package, whose transitive dependencies trigger unfixable
  critical npm audit findings in every consuming project.

  The npm package now follows the esbuild pattern: the release pipeline
  publishes one package per platform (e.g. @ory/cli-linux-x64) containing
  just the prebuilt binary, and @ory/cli itself ships a dependency-free
  launcher plus exact-version optionalDependencies on those packages.
  npm's os/cpu fields ensure only the binary matching the consumer's
  platform is downloaded. Install scripts and all runtime npm
  dependencies are gone, and npm audit reports zero vulnerabilities.

  Prereleases are now published under the "next" dist-tag instead of
  "latest", and Windows arm64 binaries are now published to npm.

• Raise the proxy and tunnel read and write timeouts to 120s (#450) (95d2e58), closes #302:

  graceful.WithDefaults applies a 5s read and 10s write timeout, which cut
  slower exchanges off mid-flight and left the client with an empty reply
  rather than an error. The upstream is the developer's own application
  and may legitimately take longer.

• Scope Ory-Base-URL-Rewrite* headers to Ory-bound requests (#446) (5d23615):

  • fix: scope Ory-Base-URL-Rewrite* headers to Ory-bound requests

  The ory proxy/tunnel reverse proxy attached the Ory-No-Custom-Domain-Redirect,
  Ory-Base-URL-Rewrite, and Ory-Base-URL-Rewrite-Token headers to every outbound
  request, including those forwarded to the developer's own upstream app. The
  last header carries a temporary project API key, which is only consumed by Ory
  and has no reason to reach the upstream. Scope these headers to Ory-bound
  requests only as a defense-in-depth hardening, and add a regression test.

  • fix: strip client-supplied Ory-* headers before re-applying

  Prevents clients from spoofing Ory-Base-URL-Rewrite*, Ory-Base-URL-Rewrite-Token,
  and Ory-No-Custom-Domain-Redirect headers. Spoofed headers would otherwise be
  forwarded unchanged to the developer's upstream app, or — when no API key is
  configured — passed through to Ory.

• Send the rate-limit header from the test browser (#457) (9082af5)

• Shrink the CLI binary by 36% (#449) (6b55b72):

  The CLI imported Hydra, Kratos and Keto command packages that mixed
  API-only commands with server commands. Go resolves dependencies per
  package, so importing a single API command linked the whole server -
  database drivers, migrations and every social sign-in SDK - into the
  binary.

  Those packages were split upstream. Bumping to the split versions drops
  the binary from 57.6 MB to 37.0 MB and removes 115 modules from the
  dependency tree, with no change to any command.

  Also stop registering Kratos' --endpoint flag on the Hydra-backed
  OAuth2 commands. It was only there to declare a flag named endpoint,
  which put "The URL of Ory Kratos' Admin API" in the help text of
  ory get jwk and friends, and it linked the Kratos server. The wrapped
  Hydra commands read the flag through cmdx.NewClient, so register it via
  cmdx instead. The flag itself is unchanged.

• Strip upstream CORS headers in proxy and tunnel (#454) (1e8656a)

• Update CI badge (0a233ad)

Code Generation

• Pin v1.3.2-pre.0 release commit (aa98c12)

Features

• Add ory get opl (#451) (0c9bdfe)

• Add ory use workspace (#453) (539898a)

• Add perform device-code, make update oauth2-client non-destructive, report key set in get jwk (#448) (107a5e9):

  • chore: update hydra and ory/x dependencies

  Bumps github.com/ory/hydra/v2 to 20260727152228-962ddb5de40a.

  Two user-visible changes come along with this:

  • ory update oauth2-client now PATCHes only the flags that were
    actually set instead of PUTing the whole client, so fields you did not
    pass are no longer reset to their defaults. Passing --file keeps the
    previous replace-everything semantics.
  • ory get jwk now emits a per-key set field, and the collection-level
    set is omitted when results span multiple sets.
  • feat: add ory perform device-code

  Wires hydra's device code flow command into ory perform, alongside
  authorization-code and client-credentials.

  • fix: bump kin-openapi to v0.144.0 to clear critical CVE

  The Docker Image Scan gates on severity-cutoff: critical and started
  failing on GHSA-r277-6w6q-xmqw, a fail-open authentication bypass in
  kin-openapi's ValidationHandler.Load() via the NoopAuthenticationFunc
  default, affecting <= 0.143.0.

  This repo only uses openapi2/openapi2conv to convert Swagger 2.0 specs to
  OpenAPI 3.0 in ory dev openapi migrate, so the vulnerable validation
  middleware is never reached, but the scanner gates on the resolved
  version regardless.

  Converting a Swagger 2.0 fixture covering path/query/body parameters,
  $ref'd definitions and an accessCode security definition produces
  byte-identical output before and after the bump.

• Send the rate-limit exemption header on tunnel and proxy requests (#459) (c386e0b)

Tests

• Stop config-mutating project tests from sharing a project (#455) (d34a356)

Changelog

• aa98c12 autogen: pin v1.3.2-pre.0 release commit
• 3930afc autogen: update license overview
• 308746a autogen: update license overview
• 4071546 chore: deflake
• 451db2c chore: upgrade dependencies (#460)
• 0c9bdfe feat: add ory get opl (#451)
• 539898a feat: add ory use workspace (#453)
• 107a5e9 feat: add perform device-code, make update oauth2-client non-destructive, report key set in get jwk (#448)
• c386e0b feat: send the rate-limit exemption header on tunnel and proxy requests (#459)
• f9247ab fix: bring back dummy post-release Make target
• 7f4be1f fix: broken stdin during ory dev release publish
• 45f61c3 fix: git flag
• 266f34c fix: make --yes skip the sign-in confirmation prompt (#452)
• 228c2c9 fix: ory dev release
• 3e534d2 fix: publish npm binaries as per-platform optionalDependencies (#447)
• 95d2e58 fix: raise the proxy and tunnel read and write timeouts to 120s (#450)
• 5d23615 fix: scope Ory-Base-URL-Rewrite* headers to Ory-bound requests (#446)
• 9082af5 fix: send the rate-limit header from the test browser (#457)
• 6b55b72 fix: shrink the CLI binary by 36% (#449)
• 1e8656a fix: strip upstream CORS headers in proxy and tunnel (#454)
• 0a233ad fix: update CI badge
• d34a356 test: stop config-mutating project tests from sharing a project (#455)

Artifacts can be verified with cosign using this public key.