[renovate]

This PR contains the following updates:

Package	Update	Change
pocketid/pocket-id	minor	v2.15.0-distroless → v2.19.1-distroless

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

pocket-id/pocket-id (pocketid/pocket-id)

v2.19.1

Compare Source

Bug Fixes

• bump go to v1.27.3, alpine to 3.24.3 and distroless to debian13 (ec14aa2 by @​kmendell)

Other

• Bump vite-plus from 1.1.0 to 1.3.0 (274977c by @​kmendell)

Full Changelog: pocket-id/pocket-id@v2.19.0...v2.19.1

v2.19.0

Compare Source

Features

• add configurable login notification modes (#​1813 by @​stonith404)
• make my apps searchable and sortable (9c0c304 by @​stonith404)
• add ability to override SSRF protection with OUTBOUND_ALLOWED_HOSTS_* (3ffe013 by @​stonith404)
• use WebAuthn recommended passkey algorithms (#​1841 by @​michaelbeaumont)
• add ability to force email verification (#​1837 by @​stonith404)
• add ability to deselect scopes on authorization (f81d62c by @​stonith404)

Bug Fixes

• prevent DN collisions from assigning another user's privileges (be45b1c by @​stonith404)
• remove distracting tab switch animation (69065e7 by @​stonith404)
• export from SQLite fails to import into Postgres because of mismatched schemas (8ab3dd4 by @​stonith404)
• limit upload size for profile pictures and application images (#​1819 by @​IonBazan)
• prevent email enumeration via one-time access email request (ade5520 by @​stonith404)
• rate limit updating the own account to slow down user enumeration (226648c by @​stonith404)
• reject cross-origin state-changing requests (d31e3e1 by @​stonith404)
• limit LDAP profile picture downloads to 2 MB (d8ca4b6 by @​stonith404)
• remove unused oidc client /meta endpoint (a58ccea by @​stonith404)
• only return minimal client metadata for public interaction endpoint (03fc844 by @​stonith404)
• prefix audit log event translation keys to separate them from UI strings (c7a7bce by @​stonith404)
• push group removals made on the user page to SCIM (#​1830 by @​jayhemnani9910)
• push group removals if user gets deleted to SCIM (d7f58e5 by @​stonith404)
• fallback to username if chars in name are not supported for avatars (e2cacac by @​stonith404)
• keep integer custom claim values exact in ID tokens and userinfo (#​1829 by @​jayhemnani9910)
• push users disabled by the LDAP sync to SCIM (#​1834 by @​jayhemnani9910)
• skip LDAP users without an email instead of failing the whole sync (#​1835 by @​jayhemnani9910)
• send the API key expiration email again after a renewal (#​1847 by @​jayhemnani9910)
• find user groups by their friendly name in the admin search (#​1854 by @​choksi2212)
• keep login notification and email verification settings on upgrade (6b9aba1 by @​stonith404)

Documentation

• update README screenshots (ed45102 by @​stonith404)

Other

• update AAGUIDs (#​1811 by @​pocket-id-bot[bot])
• Bump sharp from 0.35.4 to 0.35.5 (#​1818 by @​dependabot[bot])
• Bump source-map-js from 1.2.1 to 1.2.2 (#​1817 by @​dependabot[bot])
• Bump the "all-dependencies" group with 4 updates across multiple ecosystems (#​1826 by @​dependabot[bot])
• resolve golangci-lint failures (1bd6f00 by @​stonith404)
• authorize API routes with per-endpoint scopes (#​1823 by @​stonith404)
• use crowdin github actions to sync translations (4416b0c by @​stonith404)
• combine CI checks into a single workflow file (74e08f0 by @​stonith404)
• add missing cache-dependency-path to go setup (b0b09ce by @​stonith404)
• add gofmt to stage hook (54f28f8 by @​stonith404)
• update Fosite (fd7951f by @​stonith404)
• move shared files into .github repo (3355b65 by @​stonith404)
• update golangci-lint (#​1833 by @​ItalyPaleAle)
• upgrade francis to 0.1.1 (#​1838 by @​ItalyPaleAle)
• upgrade Fosite (a7f5d80 by @​stonith404)
• fix flaky unit test (5bf7e1d by @​stonith404)
• run CI checks on v* branches as well (80a504b by @​stonith404)
• remove unused issuer check from refresh token API validation (03cab69 by @​stonith404)
• upgrade Fosite (6b6ef9a by @​stonith404)
• Bump the "all-dependencies" group with 4 updates across multiple ecosystems (#​1851 by @​dependabot[bot])
• update AAGUIDs (#​1856 by @​pocket-id-bot[bot])
• restore the PR template in the repo so the PR quality check can read it (09d4da8 by @​stonith404)
• Bump follow-redirects from 1.16.0 to 1.16.1 (#​1862 by @​dependabot[bot])
• bump Fosite (b352c81 by @​stonith404)

Full Changelog: pocket-id/pocket-id@v2.18.0...v2.19.0

v2.18.0

Compare Source

Features

• display passkey setup page for users coming from the login page (4d2a5e4 by @​stonith404)
• add ability to search and select icons from selfh.st (#​1807 by @​stonith404)
• pin table row actions and add them to details pages (3e201b5 by @​stonith404)

Other

• Bump the "all-dependencies" group with 4 updates across multiple ecosystems (#​1805 by @​dependabot[bot])
• add project_id to crowdin.yml (5560060 by @​stonith404)
• upgrade to SvelteKit 3 (10efd16 by @​stonith404)
• fix vulnerable dependency versions (c968123 by @​stonith404)
• add vite-plus as node toolchain (#​1806 by @​kmendell)

Full Changelog: pocket-id/pocket-id@v2.17.0...v2.18.0

v2.17.0

Compare Source

Features

• add FRANCIS_HOST to connect to a standalone Francis runtime (#​1768 by @​ItalyPaleAle)
• add OIDC back-channel logout (#​1734 by @​alecrubin)
• restore old behavior of automatically creating client secret (d259a15 by @​stonith404)
• redesign OIDC client details page (e588e3f by @​stonith404)
• add support Cloudflare location headers (1a91eaa by @​stonith404)
• update authorization animation slightly (1f67bb7 by @​stonith404)
• make page transitions smoother and faster (9c926bd by @​stonith404)

Bug Fixes

• typo in fallback error message in interaction error page (#​1776 by @​samuelQUANSAH)
• handle localStorage not enabled gracefully (#​1786 by @​ItalyPaleAle)
• add 1min grace period to refresh token invalidation (b2d4fae by @​stonith404)
• use URI validation message for API resources (0235984 by @​stonith404)

Documentation

• add missing swaggertype (77a597d by @​stonith404)

Other

• use Pocket ID as identity for automated commits (5086ece by @​stonith404)
• update AAGUIDs (#​1771 by @​pocket-id-bot[bot])
• pin all GH Actions to a specific SHA (#​1772 by @​ItalyPaleAle)
• Bump the "all-dependencies" group with 1 update across multiple ecosystems (#​1780 by @​dependabot[bot])
• update AAGUIDs (#​1788 by @​pocket-id-bot[bot])
• upgrade Francis to 0.1.0 (#​1787 by @​ItalyPaleAle)
• add Vercel OSS Program badge (fd478ff by @​kmendell)
• bring database.json up-to-date (642ccc8 by @​stonith404)

Full Changelog: pocket-id/pocket-id@v2.16.0...v2.17.0

v2.16.0

Compare Source

Features

• update the design of the email templates (3249b0d by @​stonith404)

Bug Fixes

• loading indicator not visible (4ba2899 by @​stonith404)
• login with Yubikey not working in some Safari browsers (4858db3 by @​stonith404)

Other

• upgrade git cliff version (98f9e39 by @​stonith404)
• update francis to rc7 (#​1769 by @​ItalyPaleAle)
• include frontend dependencies in SBOM (5a1c6f0 by @​stonith404)
• include SBOMs for binaries (8fe53ed by @​stonith404)
• replace local release script with action (ba246e6 by @​stonith404)

Full Changelog: pocket-id/pocket-id@v2.15.0...v2.16.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.