All pull requests

Pull requests

• fix(consent): ignore ErrNoRows when revoking an already-deleted login session (closes #3504)

  #4125·pacocartones opened Aug 29, 2026·

  ·
  1

  2

• fix: copy device verification query into the synthetic authorize request

  #4124·BetterAndBetterII opened Aug 28, 2026·

  ·
  1

  4

• fix(oauth2): mark device session as rejected when device flow consent is denied

  #4122·waterWang opened Aug 20, 2026·

  ·
  1

  4

• fix: bind consent to the parsed client on the authorize endpoint

  #4121·knQzx opened Aug 12, 2026·

  ·
  2

• fix(oauth2): use UTC timestamp and FOR UPDATE SKIP LOCKED in JTI blacklist cleanup (#4113)

  #4120·waterWang opened Aug 6, 2026·

  ·
  1

  2

• fix(consent): use GetLoginSession in logout handlers to handle remember=false sessions

  #4119·waterWang opened Aug 6, 2026·

  ·
  1

  2

• fix: invalidate session synchronously in AcceptLogoutRequest (closes #4070)

  #4114·scythe-327 opened Jul 15, 2026·

  ·
  1

  4

• test: add Go fuzz tests for OSS-Fuzz integration

  #4106·canolgun opened Jun 11, 2026·

  ·
  13

• feat: optional access token strategy override for DCR

  #4105·vichanse opened May 22, 2026·

  ·
  1

  3

• fix: avoid config watchers in static config tests

  #4101·immanuwell opened May 8, 2026·

  ·
  2

• fix: add code_verifier to token exchange OpenAPI spec

  #4098·chirag1807 opened May 1, 2026·

  ·
  4

• fix: retain existing RegistrationAccessTokenSignature when PATCHing an OAuth2 Client

  #4094·OMBradF opened Apr 22, 2026·

  ·
  1

  2

• fix(oidc): return registration_client_uri in PUT and GET dynamic client responses

  #4090·Yanhu007 opened Apr 12, 2026·

  ·
  1

  1

• fix: support space-separated OIDC prompt parameter values

  #4083·raajheshkannaa opened Mar 18, 2026·

  ·
  1

  7

• fix: add optional exp claim to back-channel logout token

  #4073·ktsu2i opened Mar 1, 2026·

  ·
  5

• chore: remove schema from server_url in benchmark test

  #4062·JCarlosR opened Jan 22, 2026·

  ·
  1

• fix: redirect loop for slash

  #4058·BhautikChudasama opened Jan 12, 2026·

  ·
  1

• fix: add omitempty to optional URI fields in Client JSON serialization

  #4050·panbanda opened Dec 11, 2025·

  ·
  1

  4

• fix: avoid Client slice field be null

  #4046·honsunrise opened Nov 28, 2025·

  ·
  1

• fix: issue #4043 | Ory hydra altering scopes in JWT token claims when scope containing pipes

  #4045·ejazkhan172 opened Nov 25, 2025·

  ·
  1

• fix: check expires_at when get grant public key

  #4036·randomowo opened Oct 23, 2025·

  ·
  1

  2

• chore: upgrade to jose v4 library

  #4032·mitar opened Oct 14, 2025·

  ·

• fix: use up-to-date kid in JWT header when refreshing

  #3973·tilgovi opened Apr 5, 2025·

  ·
  11

• fix: add scopes to token hook on authorization_code

  #3970·sousandrei opened Mar 27, 2025·

  ·
  8

• fix: include client_assertion in token hook payload

  #3949·phooijenga opened Feb 20, 2025·

  ·
  13