Upgrade to v1.77.2¶
Move a v1.77.1 installation to v1.77.2. It fixes the conformance findings of 2026-10-20. History is in the CHANGELOG.
Before you start¶
- Run v1.77.1 (v1.77.1 first if older).
- Find every relying party that reads
emailor a name from an ID token or/userinfo. - The documents, the Pulumi program and the policy need no change.
1. Request the scopes each relying party reads¶
-scope=openid
+scope=openid email profile
The ID token and /userinfo carry email and the names only for the scopes granted (OpenID Connect Core 5.4).
| Claim | Scope it needs |
|---|---|
email, email_verified |
email |
name, given_name, family_name, preferred_username |
profile |
sub, groups, sid, acr, the policy's other claims |
none, as before |
| everything in the access token | none, as before |
For kubectl oidc-login with the username claim email, add --oidc-extra-scope=email (connect a Kubernetes cluster). A refresh keeps the scopes of its sign-in, so an older session loses the address at its next refresh.
2. Check the other behaviour changes¶
| Change | Who notices |
|---|---|
The ID token carries no client_id, and claims_supported no longer lists it |
a relying party that read it; read azp instead |
acr_values_supported lists the conformance class only while conformance.enabled is on |
clients that request every listed class |
| A reused authorization code revokes the access token and the session it issued | a client that redeems one code twice |
/end_session answers 400 invalid_request to an id_token_hint it cannot verify, before the Sign out? page |
a relying party that sends a hint of another issuer or client |
sluisctl login asks for openid email offline_access |
nobody; an older saved session keeps working |
3. Know where the OpenID library comes from¶
| Builds | github.com/zitadel/oidc/v3 |
|---|---|
| sluis's own binaries | third_party/zitadel-oidc, a copy of v3.51.16 without the ID token's client_id, through a replace in go.mod |
| a Go module that imports sluis packages | upstream v3.51.16; no replace needed |
The copy goes when upstream releases the fix (issue 1020, pull request 1021).
4. Roll¶
hack/release-verify.sh v1.77.2
Roll the service and the modules together.
Verify¶
curl -s https://<issuer host>/.well-known/openid-configuration | jq '.claims_supported, .acr_values_supported'
claims_supported has no client_id. A relying party that asks for email still shows the address.
Roll back¶
Roll back to v1.77.1 with the same documents.