chore(docs): update of OEL images (ory#2647)

ory-bot · web-flow · commit 0ffde363df32 · 2026-06-26T10:15:30.000+01:00
chore(docs): update OEL image tag
diff --git a/docs/self-hosted/oel/keto/changelog/v26.2.22.md b/docs/self-hosted/oel/keto/changelog/v26.2.22.md
@@ -0,0 +1 @@
+No changelog entries found for keto/oel in versions v26.2.22
diff --git a/docs/self-hosted/oel/kratos/changelog/v26.2.22.md b/docs/self-hosted/oel/kratos/changelog/v26.2.22.md
@@ -0,0 +1,14 @@
+## v26.2.22
+
+### Support multiple passkey display-name traits in identity schemas
+
+Identity schemas can now flag more than one trait with `passkey.display_name: true` or `webauthn.identifier: true`. Creating a
+registration flow no longer fails with HTTP 500 and `"no identifier found"` when both `email` and `phone` (or any other
+combination) are flagged as passkey display-name sources.
+
+The browser picks the first form field that the user actually filled in, so the same schema can serve email-only and phone-only
+signup paths without breaking either one. Schemas that flag a single trait, or none at all, continue to work as before.
+
+The fix is backward compatible. Custom registration UIs that parse `passkey_create_data` and read the existing
+`displayNameFieldName` field continue to work; the new `displayNameFieldNames` array is published alongside it for clients that
+want the full candidate list.
diff --git a/docs/self-hosted/oel/oathkeeper/changelog/v26.2.22.md b/docs/self-hosted/oel/oathkeeper/changelog/v26.2.22.md
@@ -0,0 +1 @@
+No changelog entries found for oathkeeper/oel in versions v26.2.22
diff --git a/docs/self-hosted/oel/oauth2/changelog/v26.2.22.md b/docs/self-hosted/oel/oauth2/changelog/v26.2.22.md
@@ -0,0 +1,29 @@
+## v26.2.22
+
+### Much faster OAuth2 logout
+
+This change improves performance of OAuth2/OpenID Connect logout by moving to a database-free implementation. Logout challenges
+and verifiers are now self-contained encrypted tokens instead of database rows, and the lookup of clients registered for front-
+and back-channel logout uses a single indexed query.
+
+The behavior of APIs and user interactions are unchanged. The admin endpoint `GET /admin/oauth2/auth/requests/logout` no longer
+returns `410 Gone` for already-handled logout requests, because handled state no longer exists.
+
+Upgrade notes:
+
+- Run SQL migrations before rolling out this version. The new client lookup query requires the index added by this release; on
+  CockroachDB the query fails if the index is missing.
+- Logout flows that are in flight while the upgrade rolls out fail with "logout request expired". Users retrying complete normally
+  on the new version.
+
+### Revoke login sessions by subject in batches
+
+Revoking all login sessions for a subject through `DELETE /admin/oauth2/auth/sessions/login?subject=...` now deletes the sessions
+in bounded batches instead of a single statement.
+
+Previously, a subject with a very large number of login sessions produced a single, very large delete that could exceed the
+database's transaction limits or time out, failing with a "context canceled" error and leaving the sessions in place. Deleting in
+batches keeps each transaction small, so the request completes reliably regardless of how many sessions a subject has.
+
+The endpoint's behavior is unchanged for callers: all matching login sessions are removed. If the request is canceled partway
+through, the sessions deleted so far stay deleted and the call can be safely retried to finish the rest.
diff --git a/docs/self-hosted/oel/oel-hydra-image-tags.md b/docs/self-hosted/oel/oel-hydra-image-tags.md
@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.2.22                                  | 2026-06-26   |
 | 26.2.21                                  | 2026-06-23   |
 | 26.2.20                                  | 2026-06-19   |
 | 26.2.19                                  | 2026-06-17   |
diff --git a/docs/self-hosted/oel/oel-keto-image-tags.md b/docs/self-hosted/oel/oel-keto-image-tags.md
@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.2.22                                  | 2026-06-26   |
 | 26.2.21                                  | 2026-06-23   |
 | 26.2.20                                  | 2026-06-19   |
 | 26.2.19                                  | 2026-06-17   |
diff --git a/docs/self-hosted/oel/oel-kratos-image-tags.md b/docs/self-hosted/oel/oel-kratos-image-tags.md
@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.2.22                                  | 2026-06-26   |
 | 26.2.21                                  | 2026-06-23   |
 | 26.2.20                                  | 2026-06-19   |
 | 26.2.19                                  | 2026-06-17   |
diff --git a/docs/self-hosted/oel/oel-oathkeeper-image-tags.md b/docs/self-hosted/oel/oel-oathkeeper-image-tags.md
@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.2.22                                  | 2026-06-26   |
 | 26.2.21                                  | 2026-06-23   |
 | 26.2.20                                  | 2026-06-19   |
 | 26.2.19                                  | 2026-06-17   |
diff --git a/docs/self-hosted/oel/oel-polis-image-tags.md b/docs/self-hosted/oel/oel-polis-image-tags.md
@@ -1,5 +1,6 @@
 | Image Tag                                | Release Date |
 | ---------------------------------------- | ------------ |
+| 26.2.22                                  | 2026-06-26   |
 | 26.2.21                                  | 2026-06-23   |
 | 26.2.20                                  | 2026-06-19   |
 | 26.2.19                                  | 2026-06-17   |
diff --git a/docs/self-hosted/oel/polis/changelog/v26.2.22.md b/docs/self-hosted/oel/polis/changelog/v26.2.22.md
@@ -0,0 +1,15 @@
+## v26.2.22
+
+### Fix cross-tenant identity provider selection via idp_hint in Polis
+
+The `idp_hint` parameter on the SAML Identity Federation and SSO endpoints selected an upstream identity provider connection by id
+without checking that the connection belonged to the requesting tenant and product. On a multi-tenant deployment, a co-tenant
+could supply the id of a connection in their own tenant as `idp_hint` for another tenant's federation app, routing the login to an
+identity provider they control and obtaining a Polis-signed assertion audienced to the victim's downstream service provider.
+
+Polis now scopes the hinted connection to the requesting flow. A hint is accepted only when the connection belongs to the
+requested tenant and product, to one of a multi-tenant federation app's tenants, or — for IdP-initiated SSO — to the identity
+provider that issued the response. Out-of-scope hints are rejected with `403`. The upstream-response callback re-checks that the
+selected connection is within the session's tenant scope.
+
+In-scope use of `idp_hint`, including for multi-tenant federation apps, is unchanged.

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+No changelog entries found for keto/oel in versions v26.2.22`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+No changelog entries found for oathkeeper/oel in versions v26.2.22`