hydra

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

• v2.3.0Jan 17, 2025

  Breaking Changes

  Going forward, OAuth2 Clients requesting an OpenID Connect flow must include the redirect_uri parameter or the request will be rejected.

  Deleting consents no longer returns 404 in certain edge cases but instead always 204.

  Bug Fixes

  • Advertise support for response_mode=form_post in OIDC discovery document (#3861) (9cc5f28)
  • Broken JSON round-tripping for custom claims (b36b701):

  Adding custom claims with numerical types (think JavaScript Number) previously did not

  round-trip through Hydra correctly. For example, passing UNIX timestamps in custom claims

  would end up as floating points in exponential notation in the final token. That, in turn,

  confused or broke downstream consumers of the token, including Kratos.

  Ref https://github.com/go-jose/go-jose/issues/144

  • Change comment on revokeOAuth2LoginSessions (#3853) (6d829dd)
  • Change index name in down migration (#3911) (3a09db2)
  • Correct span names (554238b)
  • Correctly pass multiple token audiences and prompt parameters when performing the authorization code flow from the CLI (#3736) (632faef)
  • Cpu contention when reading JWKs and suppress generating duplicate JWKs (#3870) (d5f65c5):

  Previously each concurrent caller would need to lock a shared mutex when reading or writing a given JWK set.

  The read path now doesn't require locking a mutex at all and instead returns valid query results directly.

  The write path is now protected by a concurrency control mechanism (using x/sync/singleflight) to ensure only one JWK set is generated and persisted.

  Note: Duplicate JWK sets may still be improperly generated if running more than one Hydra instance in a high traffic environment.

  • Do not iteratively delete records (#3766) (5ef20a2):

  Resolves performance issues on some databases when deleting consent.

  • Do not retry sending responses (#3764) (1bbfdb5)
  • docs: Adjust note about SDK support on oauth2 flow endpoints (#3812) (d0e047c)
• v2.0.0Oct 27, 2022

  Breaking Changes

  SDK naming has changed for the following operations:

  ory.
  -   V0alpha2Api.AdminDeleteOAuth2Token(context.Background()).
  +   OAuth2Api.DeleteOAuth2Token(context.Background()).
      ClientId("foobar").Execute()
  
  ory.
  -   V0alpha2Api.RevokeOAuth2Token(
  +   OAuth2Api.RevokeOAuth2Token(
          context.WithValue(context.Background(), sdk.ContextBasicAuth, sdk.BasicAuth{
              UserName: clientID,
              Password: clientSecret,
          })).Token(token).Execute()
  
  ory.
  -   V0alpha2Api.AdminIntrospectOAuth2Token(context.Background()).
  +   OAuth2Api.IntrospectOAuth2Token(context.Background()).
      Token(token).
      Scope("foo bar")).Execute()
  

  SDK naming has changed for the following operations:

  ory.
  -   V0alpha2Api.DiscoverJsonWebKeys(context.Background()).
  +   WellknownApi.DiscoverJsonWebKeys(context.Background()).
  

• v1.11.0Jan 21, 2022

  Breaking Changes

  To celebrate this change, we cleaned up the ways you install Ory software. There is now one central brew / bash curl repository:

  -brew install ory/hydra/hydra
  +brew install ory/tap/hydra
  
  -bash <(curl https://raw.githubusercontent.com/ory/kratos/master/install.sh)
  +bash <(curl https://raw.githubusercontent.com/ory/meta/master/install.sh) hydra
  

  Endpoint PUT /clients now returns a 404 error when the OAuth2 Client to be updated does not exist. It returned 401 previously. This change requires you to run SQL migrations!

  Co-authored-by: fjviera

  Please notice that this change requires SQL migrations to be applied! As always, please make a backup before applying them!

  Co-authored-by: aeneasr <3372410+aeneasr@users.noreply.github.com>

  Co-authored-by: Jagoba Gascón

  Co-authored-by: Gajewski Dmitriy

  Bug Fixes

  • Add hiring notice to README (#2893) (0a73d8b)
  • Bump deps (#2868) (b287287)
  • Contributors is upper case (5bad542)
  • Error handling in persister (#2860) (33d75d7)
  • FreeBSD build issue, env loading, add OTEL tracing (5158faa), closes #2597 #2912:

  This fix addresses an issue where configuration values in arrays could not be loaded from environment variables, which is now possible. For more information on how Ory Hydra parses configuration, head over to the documentation!

  Additionally, this PR resolves a build issue on FreeBSD - making it now possible to compile Ory Hydra with the FreeBSD target.

  Lastly, this change adds OpenTelemetry support!

  • Missing imports (42fec62)
  • Missing stack traces (#2858) (1441658)
• v1.10.2May 4, 2021
  • This maintenance release resolves regressions introduced in Ory Hydra v1.10.1. A big change is that Ory Hydra now supports PATCH operations for OAuth2 Clients and is able to handle TLS for admin and public endpoints individually. The breaking changes included in this release address two bugs which are marked as a BREAKING CHANGE. We believe however that these changes do not affect running systems and given the major improvements introduced by the fixes, we decided to mark this as a patch release.

  BREAKING CHANGES

  • This patch makes it so that already handled consent/login/logout requests respond with 410 Gone instead of 409 Conflict. Additionally, a URL is included that the user should be redirected to!

  Co-authored-by: hackerman <3372410+aeneasr@users.noreply.github.com>

  • This patch changes how issuer and public URLs are used. Please be aware that going forward, the public URL is used for redirects. Previously, the issuer URL was used. If no public URL is set, the issuer URL will be used as before.