Skip to content

pocket-id

v2.10.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 16d Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

idp oidc passkeys self-hosted

Affected surfaces

auth deps

ReleasePort's take

Moderate signal
editorial:auto 11d

The v2.10.0 release drops TOFU support for callback URLs and consolidates API key, WebAuthn, and signup functionality into dedicated modules.

Why it matters: Dropping TOFU breaks existing flows; migrating API keys, WebAuthn, and signup to new modules requires code updates before using v2.10.0.

Summary

AI summary

Dropped TOFU support for callback URLs requiring updated client configurations.

Changes in this release

Security High

Update vulnerable dependencies to mitigate security risks.

Update vulnerable dependencies to mitigate security risks.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Drop TOFU support for callback URL, breaking existing flows.

Drop TOFU support for callback URL, breaking existing flows.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Migrate API key functionality to single `apikey` module, requiring code updates.

Migrate API key functionality to single `apikey` module, requiring code updates.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Migrate WebAuthn functionality to single `webauthn` module, affecting integration points.

Migrate WebAuthn functionality to single `webauthn` module, affecting integration points.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Breaking High

Migrate signup functionality to single `usersignup` module, requiring API changes.

Migrate signup functionality to single `usersignup` module, requiring API changes.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add ability to skip consent for client during authentication.

Add ability to skip consent for client during authentication.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add OAuth APIs with scoped permissions for fine‑grained access control.

Add OAuth APIs with scoped permissions for fine‑grained access control.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add description field to OIDC clients for better metadata.

Add description field to OIDC clients for better metadata.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Add tab bar navigation to improve UI on crowded pages.

Add tab bar navigation to improve UI on crowded pages.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fix /authorize endpoint crash when scope list is empty.

Fix /authorize endpoint crash when scope list is empty.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

Features

  • upgrade shadcn components (80509c8 by @stonith404)
  • add ability to skip consent for client (d467855 by @stonith404)
  • prompt admin with PKCE client support hint (#1499 by @James18232)
  • login code input boxes (#1545 by @James18232)
  • drop TOFU support for callback URL (931a6c2 by @stonith404)
  • add OAuth APIs with scoped permissions (#1542 by @stonith404)
  • add support for unencrypted OIDC request parameter (25dcad7 by @stonith404)
  • add description field to oidc clients (#1547 by @seanmckenzie428)
  • add tab bar navigation for crowded pages (28a553f by @stonith404)

Bug Fixes

  • login code null submission and login code length check (#1512 by @James18232)
  • various bugs in observability / OTel (#1564 by @ItalyPaleAle)
  • /authorize endpoint crashes when list of scopes is empty (#1575 by @ItalyPaleAle)
  • mobile layout improvements (2910c51 by @stonith404)

Documentation

  • add link to API docs (968d072 by @stonith404)
  • fix wrong OpenAPI documentation (da3677f by @stonith404)

Other

  • close low-demand feature requests (35987b9 by @stonith404)
  • Bump the "all-dependencies" group with 2 updates across multiple ecosystems (#1528 by @dependabot[bot])
  • fix locators after shadcn upgrade (dbbe2a4 by @stonith404)
  • use fosite for OAuth 2.0 logic (#1520 by @stonith404)
  • wrap last two migrations into transaction (cf9a319 by @stonith404)
  • remove dead code (519cda0 by @stonith404)
  • update vulnerable dependencies (e538ea0 by @stonith404)
  • fix flaky test (7eaaea7 by @stonith404)
  • add AGENTS.md (d0243fe by @stonith404)
  • use goreleaser for binaries and static image builds (#1478 by @kmendell)
  • add support for Docker Hub (99ab38d by @stonith404)
  • remove static next image tag (49305ed by @stonith404)
  • don't build unnecessary binaries for next image (4b957a0 by @stonith404)
  • change Depot project (cdc2374 by @stonith404)
  • don't tag next image with current version (cf54786 by @stonith404)
  • add exempt user to PR quality checks (254ae88 by @stonith404)
  • migrate API key functionality to single apikey module (9fce987 by @stonith404)
  • migrate Webauthn functionality to single webauthn module (58fcf7c by @stonith404)
  • migrate signup functionality to single usersignup module (ecad31c by @stonith404)
  • make API key renewal date picker navigation date-independent (#1560 by @ItalyPaleAle)
  • integrate Francis actor framework for background jobs, cron scheduling, and rate limiting (#1556 by @ItalyPaleAle)
  • Bump the "all-dependencies" group with 3 updates across multiple ecosystems (#1563 by @dependabot[bot])
  • use go-kit for sending emails (#1565 by @ItalyPaleAle)
  • update AAGUIDs (#1567 by @github-actions[bot])
  • move Pocket ID specific logic from Fosite into Pocket ID repo (9a94aa0 by @stonith404)
  • update Fosite version (337fc6f by @stonith404)
  • pass transaction to resolveResource (7667377 by @stonith404)
  • remove redundant dtos (fa2d08c by @stonith404)
  • rename migrations (c72da58 by @stonith404)
  • remove duplicate fosite config properties (190914f by @stonith404)
  • fix migration version in database.json (a5f2192 by @stonith404)
  • fix wrong migration name (ce7d3a7 by @stonith404)
  • run formatter (59a6868 by @stonith404)
  • upgrade go version (f62d476 by @stonith404)

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.9.0...v2.10.0

Breaking Changes

  • Removed Trust‑on‑First‑Use (TOFU) support for callback URLs; clients must now use explicit, validated redirect URIs.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pocket-id

Get notified when new releases ship.

Sign up free

About pocket-id

A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.

All releases →

Related context

Beta — feedback welcome: [email protected]