Zitadel NextGen v0.4.0

Generated Release Facts

This section is maintained by release automation. Edit product notes outside this block.

Release commit: 72bf4dcf3ce6

Container Images

Image	Reference
container	ghcr.io/zitadel/nextgen:0.4.0
container	ghcr.io/zitadel/nextgen:latest

npm Packages

Package	Version
@zitadel/cli	0.4.0
@zitadel/server	0.4.0
@zitadel/server-linux-x64	0.4.0
@zitadel/server-linux-arm64	0.4.0
@zitadel/server-darwin-x64	0.4.0
@zitadel/server-darwin-arm64	0.4.0
@zitadel/server-win32-x64	0.4.0
@zitadel/api	0.4.0
@zitadel/config	0.4.0
@zitadel/components	0.4.0
@zitadel/sdk-core	0.4.0
@zitadel/sdk-next	0.4.0
@zitadel/sdk-nuxt	0.4.0
@zitadel/sdk-react	0.4.0
@zitadel/sdk-vue	0.4.0
@zitadel/sdk-angular	0.4.0
@zitadel/sdk-solid	0.4.0
@zitadel/sdk-svelte	0.4.0
@zitadel/sdk-qwik	0.4.0
@zitadel/sdk-sveltekit	0.4.0
@zitadel/sdk-solid-start	0.4.0
@zitadel/sdk-qwik-router	0.4.0
@zitadel/sdk-tanstack-start	0.4.0
@zitadel/testing	0.4.0

Package Changes

Minor Changes

• @zitadel/cli, @zitadel/api, @zitadel/sdk-core: #2357 79d8dd0 - The server SDKs' /__nextgen proxies and the dev proxies zitadel setup writes for single-page apps now recognize the session calls under /api/v1 as well as at their current paths, so sign-in keeps working once the API moves under /api/v1. zitadel doctor warns about a dev proxy an earlier zitadel setup wrote, and zitadel doctor --fix updates it. If you wrote your own production proxy for a single-page app, have it add the project secret to POST /api/v1/sessions/exchange as well as POST /sessions/exchange. @zitadel/api exports API_PREFIX, the path the API moves to.

• @zitadel/cli: #2464 3481a07 - zitadel deploy and zitadel preview record a message when -m is omitted: a GitHub pull request's title, Vercel's commit message, or the current commit's subject on a clean worktree, so a CI run no longer needs -m. zitadel preview -m and zitadel deployment rollback -m record a message of their own, and a blank or over-long -m is refused.

• @zitadel/cli: #2439 d277b8f - release list shows when each release was created, release get shows the resources a release pins, and deployment get shows the variables the deployment froze.

• @zitadel/cli: #2487 bf6ce2e - zitadel skills add gives your project's coding agents the Zitadel skills of the CLI version you run, for Claude Code and most other agents, and the note after setup now names it (Agent setup).

• @zitadel/cli, @zitadel/server, @zitadel/api, @zitadel/sdk-core, @zitadel/sdk-next, @zitadel/testing: #2359 eb363f0 - The SDKs, the login components, the console and the zitadel CLI now call the API under /api/v1, where the server serves it. @zitadel/api's client puts /api/v1 after the proxy path or server origin it is given, and keeps a single prefix when the origin already ends in it. zitadel api takes a path with or without the prefix and shows the full URL with it. A call the server knows no operation for now says the server may be older than the client.

  Breaking: clients from this release need a server that serves /api/v1, so upgrade a self-hosted server before the apps that call it. In a single-page app set up by an earlier zitadel setup, run zitadel doctor --fix: the dev proxy it wrote adds the project secret only to the old path of the session exchange, so sign-in fails until it is updated, and zitadel doctor now fails on it. A production proxy you wrote for a single-page app must add the project secret to POST /api/v1/sessions/exchange. Until 1.0.0 the server also answers every operation at its old path, with a Deprecation header.

• @zitadel/cli, @zitadel/server, @zitadel/api, @zitadel/components, @zitadel/sdk-core, @zitadel/sdk-next, @zitadel/sdk-nuxt, @zitadel/sdk-sveltekit, @zitadel/sdk-solid-start, @zitadel/sdk-qwik-router, @zitadel/sdk-tanstack-start, @zitadel/testing: #2488 db05fbb - The session cookie is now __Host-zitadel_session, which a browser accepts only from Zitadel's own host over https, so another site under the same domain can no longer plant a session. On http://localhost it is zitadel_session, so sign-in keeps working in Safari. An app's own, behind a server SDK or dev proxy, adds _<project id>.

  Breaking: every browser signs in again: cookies named __nextgen_session are no longer read. Update the server, the server SDKs, the CLI and @zitadel/testing together; an SDK from before this release keeps no session with this server, nor the other way round. In @zitadel/testing, SESSION_COOKIE_NAME is __Host-zitadel_session, and sessionCookieName(projectId, url) and the new browserSessionCookieName(url) name the cookies for the app's URL. zitadel doctor fails on the dev proxy of a single-page app set up before this release until zitadel doctor --fix updates it.

• @zitadel/cli: #2461 b2d9cb9 - zitadel setup deploys .zitadel/ to the app's origin once it has committed the project, so the sign-in it asks you to verify is served the release it built. data.deployment reports what it deployed, and a failed deploy is a warning whose next_commands lead with the deploy that fixes it.

• @zitadel/cli, @zitadel/api, @zitadel/config, @zitadel/testing: #2527 0a00b60 - Every paged list method of the @zitadel/api client now has items(), pages() and all(), which follow the cursor for you, and createZitadelClient takes onResponse and onError hooks; @zitadel/api/client exports pagedFunctions, each paged function's typed readers of a page's items and cursor and the arguments of its next page. The CLI no longer stops --all, the resource list commands or zitadel api --paginate when a server sends the same page cursor twice: that is a server bug, and the client trusts the paging contract. deploy, preview, release create and setup's first deploy check the release body against the API's own schema before sending it, and name each field it refuses. @zitadel/testing no longer re-checks the ids the server answers its bootstrap and seeding with, and types BootstrappedProject.previewSecret as always present, as the server always issues one. @zitadel/config's getDefaultHumanUserSchema is typed as the user schema document it returns, $id included, and exports that type as UserSchemaDocument; getDefaultHumanUserSchemaBody returns it without $id, as an inline schema in a release bundle must be.

• @zitadel/server: #2335 02677c2 - The console's release detail shows a pinned policy revision: a Policies group with the policy's settings summarised above the document the CLI publishes.

• @zitadel/server: #2447 3f4da33 - The user schema screen lists every revision of the schema, newest first and marked latest, and opens any of them read-only. An older revision says that users stay on the revision they were created on until they are migrated, and links the migration guide.

• @zitadel/server, @zitadel/api: #2398 26097dd - Deleting a user who is the last active member of a project's owning team now fails with 409 proj.last_owner and changes nothing. The message names the projects and says to add another member to that team, then retry. details.details.project_ids lists the same ids. Admin grants stay freely revocable, suspending or deactivating a user is still allowed, and a project whose owning team already has no active member is left alone.

• @zitadel/server: #2469 3b43b2c - The platform project is now deployed like any project: console sign-in is served a release of the configuration the server ships, including the recommended password policy (at least 15 characters, as zitadel setup writes), and a new server version's defaults reach the console on its first start.

  Breaking: the console signs in only at server.public_base (or a loopback address), and new console passwords need at least 15 characters. Set server.public_base to the address you use. Configuration set on the platform project through the API no longer applies: every start deploys what the server ships.

• @zitadel/server, @zitadel/api: #2477 eaa07c3 - POST /teams/query now accepts an omitted project_id and defaults to the credential's project, matching POST /users/query; explicit project IDs still use the existing authorization checks.

• @zitadel/server: #2480 2cd409d - The server prevents other sites from framing its pages, blocks MIME sniffing, limits referrers, and disables camera, microphone and geolocation while preserving passkeys and clipboard use. The console restricts scripts with Content-Security-Policy and logs violations through /csp-report. The hosted website and docs enforce script hashes, their 404 pages included.

• @zitadel/server: #2358 aa38122 - The server now answers the API under /api/v1 (POST /api/v1/projects, GET /api/v1/users/me), so a proxy, firewall or rate limit in front of it can select API traffic by one prefix. The console, the IdP callbacks and the health probes /livez and /readyz stay at the root. Until 1.0.0 the server also answers every operation at its path without the prefix, and those responses carry a Deprecation header and a Link to the docs on the base URL: move clients that still call them to /api/v1, since 1.0.0 drops them.

• @zitadel/server: #2462 ff2f926 - server.console_origins (NEXTGEN_SERVER_CONSOLE_ORIGINS) names more origins the console is reached at, beside server.public_base's, and the console previews a project's login from each of them. On the hosted cloud, a preview's console now works on its deployment URL as well as on its branch alias.

Patch Changes

• @zitadel/cli: #2523 9b1ef1e - Every command now prints its suggested next steps at the end of a run, including deploy, pull, origin add, release create, deployment create, env add and the resource commands, which used to show them only under --json. env add lists its next commands once, in that block, instead of also spelling them out in its summary. Where stdout is data a script reads (a piped list's rows, a resource's JSON body) the next steps go to stderr instead. The --json output is unchanged.

• @zitadel/cli: #2499 f34a0a5 - zitadel deploy and deploy --dry-run no longer report an empty diff for rapid configuration edits that leave file sizes unchanged.

• @zitadel/cli: #2495 1894af6 - zitadel setup no longer commits local edits to files marked skip-worktree or assume-unchanged, never writes a secret's contents into .git/objects, and leaves .env files and .zitadel/secret out of its commit whatever their case. It refuses a merge, rebase or detached HEAD before writing anything. deploy --json keeps each file's patch with the right file when diff.submodule is set.

• @zitadel/cli, @zitadel/api, @zitadel/sdk-core: #2503 665ea7d - Fix sign-in behind a compressing edge failing with "got no response" after a successful exchange: the SDK proxies no longer forward content-encoding for a body fetch has already decoded, nor the browser's accept-encoding. A response whose body cannot be read now fails as a NetworkError with reason unreadable and says which status arrived, instead of claiming the server never answered.

• @zitadel/server: #2437 8680159 - Project settings lists everyone with admin access to the project and how each holds it: as a member of the owning team, through a grant to a team they are in, or through a grant of their own. The person who claimed the project appears through the owning team. Removing a grant from someone who also has team access says they keep it.

• @zitadel/server: #2474 01ed930 - The console's sign-in page says what the console is: where you manage your Zitadel projects. It also says that your app's users sign in through your app, not there.

• @zitadel/server: #2529 7541fd7 - The console's user detail screen now counts and dates every passkey a user has registered, not only those on the first page.

• @zitadel/server: #2448 3dd0da3 - The console's Users list shows the schema revision each user is on and narrows the list to one schema and to its latest or older revisions, or to one revision.

• @zitadel/server: #2551 d1fe7aa - Event webhook and stdout sinks no longer miss an event whose write commits after a later one, and paging GET /events?order=asc forward no longer skips it.

• @zitadel/server: #2499 f34a0a5 - Prevent PostgreSQL migration deadlocks when multiple servers start while an index is being built concurrently.

• @zitadel/server: #2475 d1ab5d2 - The API document names its session cookie's security scheme sessionCookie instead of nextgenSession, as the API reference now shows it. The id never goes over the wire; a client you generate from the document gets the new name, such as SessionCookie for NextgenSession.

• @zitadel/components: #2500 1ca73bd - Repeated clicks on Sign up or Sign in in <zitadel-login> no longer follow an empty anchor while a request is pending, avoiding unwanted URL and browser-history changes.