Skip to content

pocket-id

v2.9.0 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

Published 1mo Secrets & Credentials
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

idp oidc passkeys self-hosted

Affected surfaces

auth deps

Summary

AI summary

Updates Bug Fixes, Other, and RFC9126 across a mixed release.

Full changelog

Bug Fixes

  • issues with loading new font (#1496 by @MelvinSnijders)
  • PAR parameters not respected by authorize page (3d9d4de by @stonith404)
  • add responsive css for api/user/group/client page add buttons (#1508 by @James18232)
  • load Gloock font from static path instead of inline (89b4abb by @stonith404)
  • update terminology from public key code exchange to proof key co… (#1515 by @maxwassiljew)
  • callback URL validation not validated if prompt=none (8a75774 by @stonith404)
  • passkey card not rounded (84678c3 by @stonith404)

Documentation

  • add AI Usage Policy to CONTRIBUTING.md (fea933b by @stonith404)
  • add PR template (bf9f76b by @stonith404)
  • add "needs more upvotes" label as default (fc42f62 by @stonith404)
  • fix link to watchtower repo (#1500 by @wollew)

Features

  • add support for Pushed Authorization Requests (RFC9126) (#1404 by @Zenithar)

Other

  • fix linter issues (4f97cd4 by @stonith404)
  • update AAGUIDs (#1511 by @github-actions[bot])
  • run svelte check and unit tests in breaking branches (83b45f6 by @stonith404)
  • run formatter (2726ddd by @stonith404)
  • bump vite from 8.0.13 to 8.0.16 (#1521 by @dependabot[bot])
  • npm dependabot not run from root (c0d96a0 by @stonith404)
  • fix wrong assertion (effd2a1 by @stonith404)
  • Bump the "all-dependencies" group with 4 updates across multiple ecosystems (#1523 by @dependabot[bot])

Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.8.0...v2.9.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pocket-id

Get notified when new releases ship.

Sign up free

About pocket-id

A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.

All releases →

Related context

Earlier breaking changes

  • v2.10.0 Migrate signup functionality to single `usersignup` module, requiring API changes.
  • v2.10.0 Migrate WebAuthn functionality to single `webauthn` module, affecting integration points.
  • v2.10.0 Migrate API key functionality to single `apikey` module, requiring code updates.
  • v2.10.0 Drop TOFU support for callback URL, breaking existing flows.

Beta — feedback welcome: [email protected]