Zitadel NextGen v0.2.0

Generated Release Facts

This section is maintained by release automation. Edit product notes outside this block.

Release commit: c5557cdbed6d

Container Images

Image	Reference
container	ghcr.io/zitadel/nextgen:0.2.0
container	ghcr.io/zitadel/nextgen:latest

npm Packages

Package	Version
@zitadel/cli	0.2.0
@zitadel/server	0.2.0
@zitadel/server-linux-x64	0.2.0
@zitadel/server-linux-arm64	0.2.0
@zitadel/server-darwin-x64	0.2.0
@zitadel/server-darwin-arm64	0.2.0
@zitadel/server-win32-x64	0.2.0
@zitadel/api	0.2.0
@zitadel/config	0.2.0
@zitadel/components	0.2.0
@zitadel/sdk-core	0.2.0
@zitadel/sdk-next	0.2.0
@zitadel/sdk-nuxt	0.2.0
@zitadel/sdk-react	0.2.0
@zitadel/sdk-vue	0.2.0
@zitadel/sdk-angular	0.2.0
@zitadel/sdk-solid	0.2.0
@zitadel/sdk-svelte	0.2.0
@zitadel/sdk-qwik	0.2.0
@zitadel/sdk-sveltekit	0.2.0
@zitadel/sdk-solid-start	0.2.0
@zitadel/sdk-qwik-router	0.2.0
@zitadel/sdk-tanstack-start	0.2.0
@zitadel/testing	0.2.0

Package Changes

Minor Changes

• @zitadel/cli: #2292 6392fe2 - The CLI's usage analytics events now carry surface: cli, which names the Zitadel component that sent them, so they can be read beside the events of other Zitadel components. Nothing else they carry changes.

• @zitadel/cli: #2402 a7f9216 - zitadel claim --no-wait prints the claim link and exits, with claim_url, challenge_id and expires_at under --json, so a script or coding agent can hand the link to a person; zitadel claim --challenge-id <id> then waits for that link to be used and records the claim.

• @zitadel/cli: #2348 89bcfca - Running zitadel alone now lists the commands under six headings named for what you are doing, one row per family such as users or release. zitadel users --help lists its operations, every command's help ends by pointing at the overview, and zitadel commands still prints the flat list.

• @zitadel/cli: #2367 e7b7d61 - zitadel auth-method sso enable --provider custom now asks at a terminal for the connection's name, its sign-in button's name, the issuer URL and the scopes you leave out, instead of failing with a list of flags; scripts still need the flags (docs). A new custom connection also prints its claim mappings and the file to edit them in.

• @zitadel/cli: #2323 5f49e7d - The CLI's onboarding output now says what to do next: zitadel start points to zitadel setup instead of a console link, setup spells out every choice and shows the sign-in configuration before writing it, and auth-method sso enable says to deploy the provider, then test sign-in. The note about Zitadel's agent skills shows once per machine.

  Breaking: zitadel start --json no longer has data.console, and its next_actions and next_commands no longer mention the console; a script that reads them gets nothing there. Run zitadel console --json for data.sign_in_url.

• @zitadel/cli, @zitadel/server, @zitadel/api: #1650 2d78353 - zitadel origin add <pattern> --kind primary|preview, origin list and origin rm manage the origins a project serves, with the project secret (docs). A primary origin is an exact URL, and a preview wildcard on a shared host needs a literal label of your own.

• @zitadel/cli, @zitadel/config: #2270 08a369b - zitadel deploy now carries operation policies from .zitadel/policies/, one file per operation, checked against the new .zitadel/meta/policy.json schema before anything is sent; zitadel policies list and policies get read them back (docs). Sign-ins and sign-ups use the policy the deployed release carries, so deploying without a file switches that policy off.

• @zitadel/cli: #1652 3494326 - Preview a branch's release on its pull-request URLs with zitadel preview. Run inside a preview build, it reads the preview URLs from the hosting platform (Vercel or Netlify; pass Cloudflare Pages URLs with --origin) or from --origin, builds the same release deploy does, validates it without touching your live sign-in providers, and makes it live on those URLs for a time-to-live (--ttl, between 60s and 365d; omitted, the project's default applies). Its last line is NEXT_PUBLIC_ZITADEL_RELEASE=sha256:... for the build to pin. Outside a preview or development build it does nothing — even with an explicit --origin — because production is deployed by zitadel deploy after merge, and --origin primary or a primary origin's own URL is refused. On a CI platform other than Vercel or Netlify, set ZITADEL_ENV=preview in the pull-request build: a CI build that names no environment is skipped too.

  zitadel preview list shows the project's live previews, and zitadel preview rm <url> ends one early. All three authenticate with ZITADEL_PROJECT_SECRET for now, because the server does not accept the narrower preview token yet (#1575); they never fall back to the other credential. preview list and preview rm fail, naming the variable, when it is not set; zitadel preview instead warns and still exits successfully unless --strict is passed.

• @zitadel/cli: #1407 5ab100f - zitadel pull rebuilds .zitadel/ from what a release pins — the live release by default, a release id (rel_…) or a deployment id (dep_…) — so the next deploy builds the same release (docs). It restores schemas and flow definitions, and warns for branding and identity provider connections, which it cannot read back yet.

• @zitadel/cli: #2307 44029c8 - zitadel start no longer reports a login URL, because the server no longer serves a login page: sign in through the login page zitadel setup adds to your app.

  Breaking: zitadel start --json no longer has data.urls.login; a script that reads it gets nothing there.

• @zitadel/cli: #2253 0529137 - The CLI now sends its anonymous usage events to Vercel Web Analytics on the Zitadel cloud (preview.zitadel.com), with at most eight of their properties, and sends nothing to Mixpanel for now. The existing opt-outs (--no-telemetry, DO_NOT_TRACK=1, ZITADEL_TELEMETRY=0) turn them off, and runs in CI send nothing.

• @zitadel/cli: #2245 ad626b9 - zitadel logs now shows the local server's warnings in yellow and errors in red, and --level warn shows only those, so the reason a sign-in failed is easy to find. zitadel start and zitadel doctor say to keep zitadel logs --follow open, and zitadel logs works from an app inside the directory zitadel start ran in.

• @zitadel/cli, @zitadel/server, @zitadel/api: #1651 c21caeb - zitadel deploy replaces plan and apply: it builds .zitadel/, identity provider connections included, into one immutable release, shows its git diff against the live one, and makes it live on the project's primary origins (guide). New release and deployment commands, and their @zitadel/api operations, create, list, deploy, roll back and revoke releases directly; a rollback lists the revisions it restores.

  Breaking: plan and apply are removed. Use deploy --dry-run where you ran plan, and deploy where you ran apply. The generated releases list and releases get are now release list and release get, beside release create and release revoke. Add the origins your project serves with origin add before the first deploy — deploy needs at least one primary origin. A server refusal because of the state it holds (an HTTP 409) now fails every command with E_CONFLICT (exit 5) rather than E_VALIDATION (exit 3), and a target the project does not hold as an origin fails with E_VALIDATION rather than E_AUTH.

  Upgrading a project set up with 0.1.0: its app URL is registered as a preview origin only, so its first deploy fails with "The project has no primary origin to deploy to". Run zitadel doctor --fix once to make that URL primary, as zitadel setup now does; zitadel doctor warns about such a project, and deploy suggests the fix. To do it by hand, find the URL with zitadel origin list, remove it with zitadel origin rm <url>, add it back with zitadel origin add <url> --kind primary, then deploy. Adding it again without removing it fails, because the URL is already stored as a preview origin.

• @zitadel/cli: #1649 bd0905d - Commands that talk to a project now resolve its server, project and credential per environment, so one checkout can serve development, staging and production; zitadel env shows what resolved and from where, env list lists the environments and env add binds one (docs). Values come from flags, the process environment, .env.<name>.local, .env.local, .env.<name> and .env; only development reads .env.local.

  Breaking: the server no longer comes from ZITADEL_API_BASE, the server field of zitadel.json, or a cloud default. Set ZITADEL_URL in an env file, or pass --server; only setup still defaults to Zitadel Cloud. zitadel.json no longer gets an environments block, environments list and environments get are gone, and -e now means --env.

• @zitadel/cli: 492ddf0 - Variables now belong to the project, under a new variable group, and hold a primary value, which primary deployments freeze, and a preview value, which previews freeze, with no fallback between them (docs). A plain variable set writes both, a secret only the primary, and --preview works with the preview value alone; variable resolve shows what a live deployment runs.

  Breaking: the variables commands and the --project-level flag are removed. Drop --project-level, and use variable set NAME, variable get NAME, variable list, variable rm NAME in place of the old variables set/get/list/delete.

• @zitadel/cli, @zitadel/config: #2279 65e1b78 - zitadel setup now writes and publishes a password policy for every new project, .zitadel/policies/auth.factor.password.set.json, with a minimum of 15 characters, NIST's minimum without a second factor, and a README on its settings. The wizard offers 15, 8 or none; --password-min-length <n> sets another, 0 none. Change it in the file and publish it with zitadel deploy.

  Breaking: a scripted zitadel setup now publishes a 15-character minimum. If your scripts or tests register users with passwords shorter than 15 characters, use longer ones, or pass --password-min-length with the length you need.

• @zitadel/cli, @zitadel/sdk-sveltekit: #2383 d9803f3 - The src/hooks.server.ts that zitadel setup --framework sveltekit writes now reads ZITADEL_URL, ZITADEL_PROJECT_SECRET and ZITADEL_PROJECT_ID from SvelteKit's $app/env/private, declared in src/env.ts, so npm run check passes without @types/node, and a missing setting fails with an error naming it instead of proxying to a default server.

  Breaking: setup refuses SvelteKit 2 apps, which have no $app/env/private, and zitadel doctor and zitadel eject no longer recognize a SvelteKit 2 app set up by an earlier release. @zitadel/sdk-sveltekit now peers on @sveltejs/kit 3 only. Upgrade to SvelteKit 3 first.

• @zitadel/cli, @zitadel/server, @zitadel/api, @zitadel/config, @zitadel/components: #2373 d41d1a6 - <zitadel-login> now says why it switched between sign-in and sign-up by itself: an email without an account becomes a sign-up, with a note to fix a typo in the email field, and one with an account a sign-in; an identity provider sign-in without an account gets the same note. Flow API steps carry purpose and, after a switch, notice.

  Upgrading a page or design from an earlier release: a page that shows its own heading in place of the widget's should follow step.purpose from the zitadel-flow-step event, not step names, and a design ejected earlier shows the notice once its template renders messages, as the designs zitadel branding eject copies now do.

• @zitadel/server: #2252 8c0655a - Every error the API returns is now logged once, as an api error line with the status, the operation and the error's code, message and cause: a 5xx at ERROR, with its location and, when instrumentation.log.errors.stack_trace is on, its stack, and a 4xx at INFO. A handler that panics before responding now answers 500 internal instead of closing the connection.

• @zitadel/server, @zitadel/config: #1803 b8fb271 - Rework the console navigation: logo and collapse toggle in the sidebar, project and team switchers and a ⌘K search in the top bar, an account menu with theme and sign-out, and one title line per screen. Settings is your profile, with your passkeys and linked accounts, and teams gain Overview and Members tabs. @zitadel/config/server exports DEFAULT_SERVER, the CLI's default server.

• @zitadel/server, @zitadel/api: #2248 53386a7 - The console's ⌘K search, Projects list and project switcher now find a project by name on the server, however many you can act on: GET /users/me/projects takes name_contains, and listMyProjects() in @zitadel/api accepts it. A project's Admins section no longer says your access comes from the owning team when it cannot tell.

• @zitadel/server: #2286 69cfaa3 - The console's project switcher is a searchable list: type a name and press Enter to switch. It opens on the current and recent projects, then the rest by name while they fit one page, finds others on the server, and shows each project's generated mark and its site's host or ID, so same-named projects can be told apart.

• @zitadel/server: #2291 95ee0c5 - Projects is now the console's home, drawn without the sidebar, which lists only the selected project's screens; a screen opened without a project asks for one. Each row shows the project's generated mark, its name above its site's host, and its ID. Beside the list is the setup command for a new project, below it how a project reaches production.

• @zitadel/server: #2204 6a39340 - The console lists a project's deployments and the release each made live, with its pinned revisions and their documents, and from there deploys a release to the primary origins, redeploys or rolls back a deployment, and revokes a release no origin still serves. The release and deployment operations these screens use accept the Console session.

• @zitadel/server: #2349 d731223 - The console's user schema screen now badges the property a schema signs users in with (x-identifier) and the properties that make up their display name (x-display), and the attribute labels on a user's page line up with their inputs.

• @zitadel/server, @zitadel/api: #1852 db036a5 - POST /deployments/{deployment_id}/rollback re-deploys an earlier primary deployment's release to every current primary origin, as a new deployment with reason: rollback (docs). When nothing would change it answers 200 with the newest primary deployment, and expected_deployment_id guards against a racing deploy with 409 dep.conflict.

• @zitadel/server: #2299 f2660b2 - An unknown address or a failed sign-in callback now shows a page in Zitadel's design with a request ID, and the console's error screens share its layout. Programs get JSON: 404 req.not_found, or 405 req.method_not_allowed with Allow. server.request_id_header takes the request ID from a proxy's header, such as x-vercel-id; set it only behind a proxy that overwrites it.

• @zitadel/server: #2276 95d7c91 - A deployment freezes its kind's variables when it is created, and GET /deployments/{deployment_id}/variables returns that set, a secret as {"secret": true} (docs). A release that references a name without a value for that kind is refused with 400 dep.variables_missing, and a rollback keeps the restored deployment's set.

• @zitadel/server, @zitadel/components: #2236 dcc1282 - A GitHub sign-in button in the login now shows the GitHub logo, in the button's text colour in light and dark mode; Google's logo is unchanged, and providers without a brand icon, such as custom OIDC connections, stay text-only.

• @zitadel/server, @zitadel/config, @zitadel/components: #2231 c0e9b41 - The password step of <zitadel-login> shows the account as a full-width chip that goes back to use another account, with an avatar generated from the typed identifier, so it never confirms an account exists; the console shows the same avatar. Custom templates get the chip as <zl-account>, and <zl-avatar> and @zitadel/components/avatar export the avatar for your own pages.

• @zitadel/server: #2254 afac09f - The access log now writes one INFO line per request, request served, with its method, path without the query, operation id, status, size, duration and, inside a sampled trace, TraceID and SpanID. The handling request line and the error_code field are gone; errors are logged as api error lines. The IdP callback now has a server span of its own.

• @zitadel/server, @zitadel/components: #2126 4bcb7c3 - Where the user chooses a password, the login's password field now follows the project's password policy, its min_length and its max_length or the 64-character cap, and refuses a password outside them with the bound in the message. The fixed minimum of 8 is gone, so a project without a policy has none; sign-in steps carry no length rule.

• @zitadel/server: #2246 ae9d6ab - Name the people who run a deployment as platform operators with platform.operators (NEXTGEN_PLATFORM_OPERATORS, user ids of the platform project). An operator administers every project of the deployment, and their project list in the console is every project. Every change an operator makes is marked as such in the changed project's events. The hosted cloud makes its root admin an operator.

• @zitadel/server, @zitadel/api: #2329 2ecde76 - POST /releases/build now takes operation policies under policies, each the body POST /policies takes, adds a revision only for a changed one and pins each; building them needs policy.write (docs). A sign-in or sign-up applies the policy its release pins, none when it pins none, and the newest revision when no release resolves.

• @zitadel/server: #2228 8e962e8 - GET /policies?project_id=… lists a project's policies at their newest revision, GET /policies/{policy_id} reads one and GET /policies/{policy_id}/revisions pages its history; the reads also accept a console session (docs). A policy's config is typed per operation, and a refused publish lists every failed setting or rule in details.details.violations.

• @zitadel/server: #2109 ce53276 - POST /policies?project_id=… publishes a password policy as a new revision, with optional min_length, max_length and history_depth, and GET /policies/revisions/{revision_id} reads one back (docs). The newest revision applies the next time a password is set; existing passwords are not re-checked. The new scopes are policy.read and policy.write.

• @zitadel/server, @zitadel/api: #1855 89a3471 - POST /deployments now deploys a release to the preview URLs named in targets, each matching one of the project's preview patterns, and keeps each live for the request's ttl, an ISO-8601 duration of up to 365 days, or for 7 days (docs). A session exchange ttl too large to represent now answers 400 instead of wrapping around.

• @zitadel/server, @zitadel/api: #1849 33918fa - GET /projects/{project_id}/previews lists the project's live previews, newest first, with their expiry, and POST /projects/{project_id}/previews/remove ends one at once. Removing a URL with no live preview answers 204 too. A removal that ends a preview is recorded in the audit stream as preview.removed.

• @zitadel/server, @zitadel/api: #1508 5ea7fe4 - GET /projects/{project_id}/admins lists who can administer a project and how: through the team that owns it, an admin grant to them, or one to a team they belong to, as far as the caller may see (docs). GET and PATCH /projects/{project_id} now return owning_team_id, and the person who claimed a project during local setup is listed through its owning team.

• @zitadel/server: #2308 bfdf226 - /readyz now answers 503 while the server's database does not answer within a second, so a load balancer stops sending it requests, and the console's System screen reads it. /livez still answers while the process serves HTTP; point liveness probes there, so a database outage does not restart every instance.

  Breaking: /healthz is removed. Move liveness probes that use it to /livez, and readiness probes to /readyz. A zitadel CLI or @zitadel/testing from an earlier release waits for /healthz, so it does not see a server from this release as up: update them together with the server.

• @zitadel/server: #2123 5615b0d - POST /releases/{release_id}/revoke marks a release revoked, once: a revoked release comes back unchanged with its first revoked_at, and GET /releases and GET /releases/{release_id} now report it. A release that any primary origin or live preview URL still serves answers 409 with rel.in_use, naming each origin and the deployment that pins it. Deploying a revoked release answers 409 with rel.revoked.

• @zitadel/server: #2232 82463d3 - A sign-in that resolves to a release now uses the user schema, branding and identity provider revisions that release pins, the built-in login branding when it pins a flow but no branding, and the SSO client credentials frozen with its deployment; a sign-in with no release still uses the newest revisions and the project's current variables.

• @zitadel/server: #2046 63ea1c1 - POST /auth_attempts and POST /sessions/exchange take the project from the project secret and answer 403 proj.mismatch when the request names another one. A handoff exchange is refused once the release its sign-in started on is revoked; an invalid or expired token still answers 400 sess.invalid_handoff_token.

• @zitadel/server: #2045 37d36c1 - GET /flow/{id} and POST /flow/{id}/submit answer 409 rel.revoked once the release a sign-in started on has been revoked, and a deploy during a sign-in does not change that sign-in's steps.

• @zitadel/server: #2307 44029c8 - The server no longer serves a login page at /ui/login/, which could not sign anyone in; your app presents the login with <zitadel-login>, which zitadel setup adds. The server serves /console/runtime.json even with its own console off, so a console hosted elsewhere keeps working.

  Breaking: the server.login_enabled and server.login_path settings, and the NEXTGEN_SERVER_LOGIN_ENABLED and NEXTGEN_SERVER_LOGIN_PATH variables, are gone. The server ignores them, so remove them from your configuration at your convenience. Links to /ui/login/ now answer 404.

• @zitadel/server: #2253 0529137 - Add an opt-in service ping: with service_ping.enabled (NEXTGEN_SERVICE_PING_ENABLED=true), the server reports its version, whether it runs self-hosted or locally (on a loopback server.public_base), its database dialect, operating system and CPU architecture to Vercel Web Analytics when it starts and once a day after. It never sends its address. It is off by default.

• @zitadel/server: #2392 e9ba1b4 - A successful password sign-in now replaces an outdated stored hash with one written by the project's password hashing method, so imported bcrypt or legacy hashes move to argon2id, or to the method the project chose, as users sign in. A project whose method is bcrypt keeps bcrypt. If the new hash cannot be stored, the sign-in still succeeds.

• @zitadel/server: #2213 fae2169 - GET /idps/revisions/{revision_id} accepts a Console session cookie as the signed-in user, like the other identity provider reads, so the Console can show the document a release pins.

• @zitadel/server: #2364 464a344 - The origins operations (POST /projects/{id}/origins and POST /projects/{id}/origins/remove) and the variable reads (GET /variables and GET /variables/{name}) accept a Console session cookie as the signed-in user, so the Console can manage a project's origins and show its variables; variable writes still take the project secret.

• @zitadel/server: #1469 5bdb8f0 - Set instrumentation.trace.trust_remote_spans (NEXTGEN_INSTRUMENTATION_TRACE_TRUST_REMOTE_SPANS) to true to continue a caller's W3C traceparent trace instead of starting a new one; it was accepted before but did nothing. It is off by default and trusts the caller's sampled flag over instrumentation.trace.fraction, so turn it on only behind a proxy or mesh you control.

Patch Changes

• @zitadel/cli: #2289 5d164ad - The AGENTS.md section zitadel setup writes now says the generated pages and request boundary are the app's to change, as zitadel doctor treats them, and points at the documented --zl-* tokens and ::part() names for theming; the CLI's agent skill says to capture output outside the app directory.

• @zitadel/cli: #2366 2fcf14c - Every question the CLI asks now reads as a plain question, such as "What is the client ID of your Google OAuth app?" instead of "Client ID", and the client secret question says which project variable will hold it.

• @zitadel/cli: #2368 76dc3be - zitadel doctor no longer checks a local Zitadel runtime for a project set up against a hosted server, so another app on port 8080 no longer fails it with E_PORT_IN_USE.

• @zitadel/cli: #2368 76dc3be - The AGENTS.md section zitadel setup writes now says a page heading shown in place of the login's own has to follow its zitadel-flow-step event, since the login moves between sign-in and sign-up by itself, instead of suggesting a fixed heading that read "Sign in" during a sign-up.

• @zitadel/cli: #2386 3c324b5 - zitadel setup creates React, Vue, Solid, Svelte and Qwik apps again: it pins create-vite 9.3.1, since 9.3.2 was published without its templates and setup then failed with "Could not detect a supported app framework".

• @zitadel/cli: #2299 f2660b2 - When the server has no endpoint for a command, the CLI now says that the server and the CLI are different versions instead of reporting a missing resource, and still tells apart a --server that is not a Zitadel API.

• @zitadel/cli: #2371 4d4e814 - zitadel setup asks fewer, clearer questions: your app's port only when that port is taken, and the server with the local one listed even when stopped. An empty client ID skips that sign-in provider and prints the zitadel auth-method sso enable command that adds it later, and Ctrl-C at any prompt exits with code 130 and no error.

• @zitadel/cli: #1649 bd0905d - Commands the CLI suggests running next now keep the run's --env, --env-file or --server, so following one targets the same project instead of the default one.

• @zitadel/cli: #2308 bfdf226 - zitadel start now waits until the local server's database answers, not only its process, and zitadel doctor, zitadel status and zitadel setup count a local server as healthy only then, asking its /readyz instead of /healthz.

• @zitadel/cli, @zitadel/config: #2368 76dc3be - zitadel setup --use-case consumer and --use-case business now make a user's given and family name their display name (x-display), so a signed-in session reads "Ada Lovelace" instead of only the email, in getSession() and <zitadel-session>.

  Upgrading a project set up earlier: add "x-display": ["givenName", "familyName"] to its user schema and run zitadel deploy; users who sign up after that show their name.

• @zitadel/cli: #2326 8e651ad - zitadel doctor now warns when the editor schemas in .zitadel/meta/ are missing or outdated, which leaves a file's $schema pointing at nothing or at old rules, and doctor --fix writes the current ones; branding eject writes .zitadel/meta/branding.json the same way.

• @zitadel/cli, @zitadel/sdk-next: #2372 bbe402b - Adding a route to protectedRoutes alone now requires a sign-in on it: zitadel setup writes a Next.js proxy.ts (middleware.ts on Next.js 15) whose matcher covers every route but Next.js's build files; before, a route missing from the matcher stayed public without a warning.

  Upgrading an app set up earlier: it keeps its matcher; replace it with ["/((?!_next/static|_next/image|favicon.ico).*)"], or add each protected route to it.

• @zitadel/server: #2336 9b5a865 - The theme button on the console's Branding screen now shows which side the preview paints and opens a menu of From branding, Light and Dark, without a side the branding does not publish, instead of cycling through them behind one sun icon.

• @zitadel/server: #2201 b4fba1a - Console form field labels now use Arimo at 14px/20px with regular weight instead of the APK Futural display face.

• @zitadel/server: #2244 cc033b4 - The console's Optional marker beside form field labels now uses Arimo at 12px/16px in sentence case instead of small uppercase letters.

• @zitadel/server, @zitadel/api: #2301 fedce7e - The console's error screens now show the failed request's ID instead of the error code, so a support request can quote it, and ApiError from @zitadel/api carries it as requestId. A not-found screen names what is missing, such as "User not found", and leads back to its list; the others lead to Projects without the selected project.

• @zitadel/server: #2361 1155fb1 - Section headings on the console's detail screens and personal settings, such as Field definitions and Steps, now use the shared heading sizes instead of small uppercase captions.

• @zitadel/server: #2278 c51ec40 - The console's user detail screen shows the schema's name beside its revision box, which now holds only the revision id.

• @zitadel/server: #2268 19c5266 - The console's Users table stays within its width however many properties a schema has: the User column and row menu stay in view while it scrolls, schema properties appear once pinned from the Columns menu, and the rest read in one Attributes column that opens them as fields, JSON or YAML. The Team column is now "Member of".

• @zitadel/server: #2088 0cd5179 - An authenticated request now answers 503 unavailable instead of 500 internal when the database reports a temporary failure during its credential check, so clients can retry it, and the API reference lists unavailable and not_implemented for every endpoint that checks a credential.

• @zitadel/server: #2294 37fa78e - The console's login preview works again off localhost, as on the hosted cloud, for a project that lists its origins: POST /flow now admits the origin server.public_base names, though a step submitted from there is still refused unless the project lists it.

• @zitadel/server: #2297 778bdfb - POST /flow/{id}/submit now checks an opaque Origin (null), which browsers send from sandboxed frames and data: pages, against the project's origins, so a project that lists its origins refuses it with req.invalid instead of skipping the check.

• @zitadel/server: #2269 89369c0 - Building a release that edits an existing identity provider connection, as zitadel deploy does after you change one, no longer fails with 500 internal, and switching a connection back to an earlier document reuses that revision.

• @zitadel/server: #1410 30a113d - A server that fails to start now logs why at ERROR, in the configured log format, so the reason also shows with instrumentation.log.level: warn, where it used to be logged at INFO or, at that level, not at all.

• @zitadel/server: #2205 66ea694 - A caller whose grants in a project are scoped to a team or a single resource now gets 404, as for an id that names nothing, instead of 403 when reading or updating a resource outside every scope it holds, so it no longer learns whether that resource exists.

• @zitadel/server: #2228 8e962e8 - Reading an identity provider connection, its revisions or a schema by id now answers not found when the request's project_id names a project the resource is not in, where a project secret used to get it from its own project.

• @zitadel/server: #2352 219a504 - Removing a stream from instrumentation.log.streams now drops that stream's log lines. Before, every stream was logged whatever the list said. instrumentation.log.add_source now applies to the lines written through the zlog helpers as well; before, those lines never carried a source.

• @zitadel/server: #2345 f85c3e7 - Server error logs no longer include a stack trace by default. Set instrumentation.log.errors.stack_trace: true or NEXTGEN_INSTRUMENTATION_LOG_ERRORS_STACK_TRACE=true to turn it back on while debugging.

• @zitadel/server: #2246 ae9d6ab - A change a console session makes in another project is now recorded in that project's events, not in the events of the project the session belongs to.

• @zitadel/config, @zitadel/components, @zitadel/sdk-core, @zitadel/sdk-next, @zitadel/sdk-nuxt, @zitadel/sdk-react, @zitadel/sdk-vue, @zitadel/sdk-angular, @zitadel/sdk-solid, @zitadel/sdk-qwik, @zitadel/sdk-sveltekit, @zitadel/sdk-solid-start, @zitadel/sdk-qwik-router, @zitadel/sdk-tanstack-start, @zitadel/testing: #2328 31ef6c1 - The packages no longer ship .d.ts.map files. They pointed at src files the packages do not publish, so an editor's go-to-definition already landed on the .d.ts; it still does.

• @zitadel/components, @zitadel/sdk-react, @zitadel/sdk-vue, @zitadel/sdk-angular, @zitadel/sdk-solid, @zitadel/sdk-svelte, @zitadel/sdk-qwik: #2317 5092d59 - The React, Vue, Solid, Svelte, Qwik and Angular SDKs' published types now resolve under strict Node ESM resolution (node16 and nodenext), and @zitadel/components exports defaultTemplate and layoutChromeCss as plain strings, so its declarations import no chunk without types.

• @zitadel/sdk-core, @zitadel/sdk-next: #2374 727b716 - The @zitadel/sdk-next middleware now asks the Zitadel server about a session only on protectedRoutes, and auth() asks when a page reads it, so a page that never calls auth() costs no call; resolveSession in @zitadel/sdk-core takes checkOpaqueSession: false to leave that check to a render layer.

• @zitadel/sdk-core: #2375 704911f - Signing out through a server SDK's /__nextgen proxy now also ends a session still held in the shared __nextgen_session cookie, which Zitadel kept valid until it expired because that sign-out carried no CSRF token.

• @zitadel/sdk-next, @zitadel/sdk-nuxt: #2285 dcea62f - The @zitadel/sdk-next README and the editor docs for getSession(), useAuth(), auth() and NextgenProvider now describe the session as userId, identifier, identifierProperty and display, the fields they return, and the README places proxy.ts next to the app directory; the @zitadel/sdk-nuxt README names the product Zitadel.

• @zitadel/sdk-tanstack-start: #2381 30ba040 - createNextgenRequestMiddleware now type-checks inside createMiddleware({ type: "request" }).server(...), so tsc no longer rejects the src/start.ts that zitadel setup writes with TS2345.

• @zitadel/testing: #2308 bfdf226 - withZitadel now waits for the instance's /readyz, which answers once its database does, instead of /healthz, so a suite starts against an instance that can serve requests.