This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryTRUST_PROXY now supports CIDR and IP address lists.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Block link‑local addresses in SSRF protection Block link‑local addresses in SSRF protection Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Feature | Medium |
Add support for CIDR and IP address lists in `TRUST_PROXY` Add support for CIDR and IP address lists in `TRUST_PROXY` Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Dependency | Low |
Bump all dependencies with 3 updates across multiple ecosystems Bump all dependencies with 3 updates across multiple ecosystems Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Deprecation | Low |
Remove low‑demand issue closer feature Remove low‑demand issue closer feature Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Remove public schema references in postgres migration 20250822 Remove public schema references in postgres migration 20250822 Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Sort signup tokens explicitly by creation date Sort signup tokens explicitly by creation date Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Reflect `INTERNAL_APP_URL` in UI URLs Reflect `INTERNAL_APP_URL` in UI URLs Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Ignore tab URL hashes in navigation history Ignore tab URL hashes in navigation history Source: llm_adapter@2026-07-13 Confidence: high |
— |
| Bugfix | Medium |
Allow insecure callback URLs by default until next major release Allow insecure callback URLs by default until next major release Source: llm_adapter@2026-07-13 Confidence: low |
— |
| Bugfix | Low |
Manage instance ID in the KV table Manage instance ID in the KV table Source: llm_adapter@2026-07-13 Confidence: high |
— |
Full changelog
Bug Fixes
- postgres migration 20250822 remove public schema references (#1582 by @MarcoScabbiolo)
- allow insecure callback URLs by default until next major release (d9ead47 by @stonith404)
- sort signup tokens by creation date explicitly (77398a5 by @stonith404)
- login code mobile ux (#1584 by @James18232)
INTERNAL_APP_URLnot reflected in UI URLs (316cf47 by @stonith404)- ignore tab URL hashes in navigation history (a3f27ec by @stonith404)
- block link-local addresses in SSRF protection (9714296 by @stonith404)
Features
- add support for CIDR and IP address lists in
TRUST_PROXY(187cd8d by @stonith404)
Other
- manage instance ID in the KV table (#1579 by @ItalyPaleAle)
- Bump the "all-dependencies" group with 3 updates across multiple ecosystems (#1578 by @dependabot[bot])
- remove low demand issue closer (bb03660 by @stonith404)
Full Changelog: https://github.com/pocket-id/pocket-id/compare/v2.10.0...v2.11.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About pocket-id
A simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services.
Related context
Related tools
Earlier breaking changes
- v2.10.0 Migrate signup functionality to single `usersignup` module, requiring API changes.
- v2.10.0 Migrate WebAuthn functionality to single `webauthn` module, affecting integration points.
- v2.10.0 Migrate API key functionality to single `apikey` module, requiring code updates.
- v2.10.0 Drop TOFU support for callback URL, breaking existing flows.
Beta — feedback welcome: [email protected]