Starstruk Logo MarkStarstruk

v4.15.2

parruda/swarmv4.15.2Jun 17, 2026by github-actions[bot]

AI Summary

A comprehensive bug fix release addressing security vulnerabilities, OAuth/PKCE handling, and login flows, including passkey support.

Key Highlights

  • Fixed JWT IdP validation and audience management
  • Applied PKCE for building OAuth and OIDC providers
  • Fixed connection handling after specific migration steps
  • Added support for passkey registration in login sessions
  • Fixed custom font loading in Content Security Policy (CSP)

New Features

  • Passkey registration support
  • Custom font loading from branding settings

Full Release Notes

## [4.15.2](https://github.com/zitadel/zitadel/compare/v4.15.1...v4.15.2) (2026-06-17)


### Bug Fixes

* always validate exp and iat claims of JWT IdPs ([4925fab](https://github.com/zitadel/zitadel/commit/4925fab849d39a88674485d937b79e54318b48a8))
* client_id verification during code exchange and refresh token flows ([5624030](https://github.com/zitadel/zitadel/commit/562403079a98cf2059cdac11865a45e2f285be71))
* connection handling in setup after migration steps 40, 64 and 70 ([#12293](https://github.com/zitadel/zitadel/issues/12293)) ([c53d977](https://github.com/zitadel/zitadel/commit/c53d9774d4272d3cebeee4131012c20bd77b9dfb))
* **eventstore:** allow overwriting resource owner of events ([#12261](https://github.com/zitadel/zitadel/issues/12261)) ([a939b84](https://github.com/zitadel/zitadel/commit/a939b847d90c3370bd162064e57764b89c01be46))
* **idp:** apply PKCE when building OAuth and OIDC providers ([#12247](https://github.com/zitadel/zitadel/issues/12247)) ([ab7c6c0](https://github.com/zitadel/zitadel/commit/ab7c6c09d3bb34ac3ec18fc9e0c72d810a614263)), closes [#12036](https://github.com/zitadel/zitadel/issues/12036) [#12054](https://github.com/zitadel/zitadel/issues/12054)
* **jwt idp:** manage and validate audience ([999e2bb](https://github.com/zitadel/zitadel/commit/999e2bbc81b56fca693ccc87a863fdfc182b1316))
* **login:** accept IDP sessions on passkey registration ([#12275](https://github.com/zitadel/zitadel/issues/12275)) ([add46e0](https://github.com/zitadel/zitadel/commit/add46e0c8be3dbf014f77f4ca264f832e4ee49b0))
* **login:** load custom font from branding settings and allow in CSP ([#12279](https://github.com/zitadel/zitadel/issues/12279)) ([9f1561d](https://github.com/zitadel/zitadel/commit/9f1561dc8e56419bba816f5f003e96c606c9f5b1)), closes [#11200](https://github.com/zitadel/zitadel/issues/11200)
* remove unnecessary entry from default denylist ([#12294](https://github.com/zitadel/zitadel/issues/12294)) ([1ca1fbd](https://github.com/zitadel/zitadel/commit/1ca1fbdab4aea43aac76e66abeda3dd3238afc84))
* use protected http client for outgoing connections ([b6f7808](https://github.com/zitadel/zitadel/commit/b6f78086913b8d916bce9ab2e049ab0d84f947fd))