chore(deps): update all non-major docker images

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
amazon/aws-lambda-python	final	minor	3.12 -> 3.13
ghcr.io/zitadel/zitadel	final	minor	v2.63.4 -> v2.68.0
localstack/localstack		digest	83138e8 -> c7fc4f8

Review

• Updates have been tested and work
• If updates are AWS related, versions match the infrastructure (e.g. Lambda runtime, database, etc.)

---

Release Notes

zitadel/zitadel (ghcr.io/zitadel/zitadel)

v2.68.0

Compare Source

Bug Fixes

• cache: convert expiry to number (#​9143) (56427cc), closes #​8822 #​9097
• cancel notifications on missing channels and configurable (twilio) error codes (#​9185) (60857c8)
• case changes on org domain (#​9196) (69372e5)
• correctly get x-forwarded-for for browser info in events (#​9149) (c966446), closes #​9106
• eventstore: correct sql push function (#​9201) (9532c9b)
• i18n: typo in Russian login description (#​9100) (42cc6dc)
• include tzdata to validate timezones in scim (#​9195) (07f7473)
• login: allow fallback to local auth in case of IdP errors (#​9178) (4008274), closes #​6466
• oidc: ignore algorithm for legacy signer (#​9148) (db8d794), closes #​9121
• only allowed idps in login step (#​9136) (8d8f38f), closes #​6466
• permissions_v2: add membership fields migration (#​9199) (94cbf97)
• session v2: allow searching for own sessions or user agent (fingerprintID) (#​9110) (84997ff), closes #​8301
• set correct owner on project grants (#​9089) (1949d15)

Features

• /internal: Add User Resource Owner (#​9168) (b664ffe), closes #​5062
• console: allow to configure PostHog (#​9135) (11d36fc)
• create user scim v2 endpoint (#​9132) (e621224), closes #​8140
• delete user scim v2 endpoint (#​9151) (af09e51), closes #​8140
• get user scim v2 endpoint (#​9161) (9c7f2a7), closes #​8140
• replace user scim v2 endpoint (#​9163) (d01d003), closes #​8140

Performance Improvements

• eventstore: fast push on crdb (#​9186) (690147b)
• eventstore: optimize commands to events function (#​9092) (df2c6f1)
• eventstore: redefine current sequences index (#​9142) (829f454)
• fields: create index for instance domain query (#​9146) (f320d18)
• role permissions in database (#​9152) (3f6ea78), closes #​9032

v2.67.4

Compare Source

Bug Fixes

• eventstore: correct sql push function (#​9201) (0719d9d)

v2.67.3

Compare Source

Warning for cockroachdb users

Please skip this release as we discovered a bug in the push function which would insert events at the wrong position. The bug is resolved with v2.67.4

Bug Fixes

• cancel notifications on missing channels and configurable (twilio) error codes (#​9185) (96380b9)
• case changes on org domain (#​9196) (3159e38)
• correctly get x-forwarded-for for browser info in events (#​9149) (0c0babf), closes #​9106
• i18n: typo in Russian login description (#​9100) (fd8e5f8)
• oidc: ignore algorithm for legacy signer (#​9148) (5f7dd9a), closes #​9121
• only allowed idps in login step (#​9136) (1129d7d), closes #​6466

Performance Improvements

• eventstore: fast push on crdb (#​9186) (35948e9)

v2.67.2

Compare Source

Performance Improvements

• eventstore: optimize commands to events function (#​9092) (037384d)
• eventstore: redefine current sequences index (#​9142) (0905a4c)

v2.67.1

Compare Source

Bug Fixes

• cache: convert expiry to number (#​9143) (3f59bcf), closes #​8822 #​9097

Performance Improvements

• fields: create index for instance domain query (#​9146) (0d5d65e)

v2.67.0

Compare Source

Bug Fixes

• idp: correctly get data from cache before parsing (#​9134) (8d7a1ef)
• idp: prevent server errors for idps using form post for callbacks (#​9097) (fa5e590)
• listUsers: Add Search User By Phone to User Service V2 (#​9052) (e1f0d46)
• login: avoid disallowed languages with custom texts (#​9094) (ab6c433)
• restructure resend email code to send email code (#​9099) (8ec099a), closes #​9096
• saml: parse xsd:duration format correctly (#​9098) (bcf416d), closes /github.com/crewjam/saml/blob/bbccb7933d5f60512ebc6caec7120c604581983d/metadata.go#L88-L103
• setup: make step 39 repeatable (#​9085) (da706a8)
• setup: make step 41 repeatable (#​9084) (b89e8a6)
• Typo in Init MFA OTP screen (#​9128) (79af682)

Features

• add exclusion of criteria for active idp query (#​9040) (870e3b1), closes #​8981
• add saml request to link to sessions (#​9001) (c3b97a9), closes #​6053
• specify login UI version on instance and apps (#​9071) (50d2b26)
• v2 api add way to list authentication factors (#​9065) (a3d80f9), closes #​8833

v2.66.7

Compare Source

Bug Fixes

• add aggregate type to subquery to utilize indexes (#​9226) (ce6df3c)

v2.66.6

Compare Source

Bug Fixes

• cancel notifications on missing channels and configurable (twilio) error codes (#​9185) (99d9aa9)

v2.66.5

Compare Source

Performance Improvements

• eventstore: optimize commands to events function (#​9092) (12cd61c)
• eventstore: redefine current sequences index (#​9142) (1665d7c)

v2.66.4

Compare Source

Bug Fixes

• cache: convert expiry to number (#​9143) (ed96035), closes #​8822 #​9097

Performance Improvements

• fields: create index for instance domain query (#​9146) (c36be9b)

v2.66.3

Compare Source

Bug Fixes

• idp: correctly get data from cache before parsing (#​9134) (ebc13e5)

v2.66.2

Compare Source

Bug Fixes

• idp: prevent server errors for idps using form post for callbacks (#​9097) (b58956b)
• login: avoid disallowed languages with custom texts (#​9094) (74479bd)
• saml: parse xsd:duration format correctly (#​9098) (f9eb341), closes /github.com/crewjam/saml/blob/bbccb7933d5f60512ebc6caec7120c604581983d/metadata.go#L88-L103

v2.66.1

Compare Source

Bug Fixes

• setup: make step 39 repeatable (#​9085) (47268c7)
• setup: make step 41 repeatable (#​9084) (ded9491)

v2.66.0

Compare Source

Bug Fixes

• actions: preserve order of execution (#​8895) (85bdf01)
• api: map REST request body in user invite requests (#​9054) (fd70a7d)
• cache: ignore NOSCRIPT errors in redis circuit breaker (#​9022) (ee7beca)
• cache: unset client and user names in defaults (#​8901) (b77901c)
• consistent permission check on user v2 (#​8807) (c07a5f4), closes #​7944
• console: bug fixes for ListProjectRoles and general pagination (#​8938) (33bff5a), closes #​8460 #​8460 #​8460
• eventstore: cleanup org fields on remove (#​8946) (ccef67c)
• eventstore: correct database type in PushWithClient (#​8949) (7714af6)
• eventstore: set application name during push to instance id (#​8918) (522c828)
• eventstore: set created filters to exclusion sub-query (#​9019) (a81d42a)
• fix slice init length (#​8707) (69e9926)
• i18n: Improve Russian locale in the auth module (#​8988) (001fb97), closes #​6864
• login: make sure first email verification is done before MFA check (#​9039) (f20539e)
• migrations: clean stale org fields using events (#​9051) (6f6e223)
• mirror: Fix instance_id check for tables without (#​8852) (a09c772), closes #​8558
• miss-leading labels in the console (#​8972) (26e936a)
• notifications: bring back legacy notification handling (#​9015) (7a3ae8f), closes #​8931 #​9002 #​8931
• notifications: improve error handling (#​8994) (7f03786), closes #​8931
• oidc: do not return access token for response type id_token (#​8777) (778b404)
• oidc: prompts slice conversion function returns slice which contains unexpected empty strings (#​8997) (d0c2354)
• process org remove event in domain verified writemodel (#​8790) (ed42dde), closes #​8514
• project existing check removed from project grant remove (#​9004) (14db628), closes #​8900
• saml: improve error handling (#​8928) (ffe9570), closes /github.com/golang/text/blob/efd25daf282ae4d20d3625f1ccb4452fe40967ae/encoding/ianaindex/ianaindex.go#L156
• saml: provide option to get internal as default ACS (#​8888) (374b9a7)
• setup: improve search query to use index (#​8898) (ecbf0db)
• typo in defaults.yaml where ExternalPort should be ExternalDomain (#​8923) (48ffc90)
• use correct check for user existing on import (#​8907) (7ba797b)

Features

• action v2 signing (#​8779) (7caa43a), closes #​7924
• cache: organization (#​8903) (c165ed0), closes #​8865 #​8902
• cache: redis circuit breaker (#​8890) (3b7b0c6), closes #​8864
• eventstore: accept transaction in push (#​8945) (1ee7a1a)
• eventstore: add row locking option (#​8939) (d4389ab)
• eventstore: exclude aggregate IDs when event_type occurred (#​8940) (ff70ede)
• fields: add instance domain (#​9000) (6614aac)
• i18n: add korean language support (#​8879) (c0a9394)
• notification: use event worker pool (#​8962) (8537805), closes #​8931

v2.65.5

Compare Source

Bug Fixes

• api: map REST request body in user invite requests (#​9054) (21baec9)
• login: make sure first email verification is done before MFA check (#​9039) (b9e351a)
• oidc: prompts slice conversion function returns slice which contains unexpected empty strings (#​8997) (8f929c5)

v2.65.4

Compare Source

Bug Fixes

• project existing check removed from project grant remove (#​9004) (e90e1d0), closes #​8900

v2.65.3

Compare Source

Bug Fixes

• eventstore: set application name during push to instance id (#​8918) (8f97e8a)

v2.65.2

Compare Source

Bug Fixes

• saml: improve error handling (#​8928) (35df5f6), closes /github.com/golang/text/blob/efd25daf282ae4d20d3625f1ccb4452fe40967ae/encoding/ianaindex/ianaindex.go#L156

v2.65.1

Compare Source

Bug Fixes

• actions: preserve order of execution (#​8895) (afcba37)
• cache: unset client and user names in defaults (#​8901) (8f2a845)
• fix slice init length (#​8707) (f65a02c)
• mirror: Fix instance_id check for tables without (#​8852) (7143a35), closes #​8558
• oidc: do not return access token for response type id_token (#​8777) (e879f90)
• saml: provide option to get internal as default ACS (#​8888) (bc67e6e)
• setup: improve search query to use index (#​8898) (c5b6323)
• use correct check for user existing on import (#​8907) (def3130)

v2.65.0

Compare Source

Bug Fixes

• add allowRegister check for register handling in login (#​8782) (c21e171), closes #​8123
• add resourceowner to check for project in project grant (#​8785) (6780c5a), closes #​8685
• correctly check denied domains and ips for actions (#​8810) (79fb4cc)
• correctly search for verified domain (#​8820) (0b5079c)
• load-test: correct k6 command (#​8760) (4ebc23a)
• login: org register script references (#​8842) (692c9b7), closes #​8838
• mac: date command options not found #​8757 (#​8758) (1426823)
• milestones: offset the type enum (#​8849) (9cf67f3)
• milestones: use previous spelling for milestone types (#​8886) (fb6579e), closes #​8788
• Negative values allowed by spinners of Login Lifetimes inputs (#​8694) (4eeb2be)
• translations: typo in VerifyEmail body (#​8872) (04a166f)
• Update Defaults.yaml (#​8731) (7eb54e4), closes #​8531

Features

• cache: redis cache (#​8822) (250f234), closes #​8130
• OIDC: add back channel logout (#​8837) (041af26)

Performance Improvements

• milestones: refactor (#​8788) (32bad3f)
• query: remove transactions for queries (#​8614) (9c3e5e4)

v2.64.4

Compare Source

Bug Fixes

• eventstore: set application name during push to instance id (#​8914) (22d9e9f)
• saml: improve error handling (#​8928) (ea2246f), closes /github.com/golang/text/blob/efd25daf282ae4d20d3625f1ccb4452fe40967ae/encoding/ianaindex/ianaindex.go#L156

v2.64.3

Compare Source

Bug Fixes

• actions: preserve order of execution (#​8895) (93dc5b8)
• saml: provide option to get internal as default ACS (#​8888) (09f8ba8)
• use correct check for user existing on import (#​8907) (c2f88f3)

v2.64.2

Compare Source

Bug Fixes

• setup: improve search query to use index (#​8898) (668fafc)

v2.64.1

Compare Source

Bug Fixes

• correctly check denied domains and ips for actions (#​8810) (7508e6c)
• Update Defaults.yaml (#​8731) (b6fad5a), closes #​8531

v2.64.0

Compare Source

Bug Fixes

• add allowRegister check for register handling in login (#​8782) (539e8ed), closes #​8123
• add default organization as query for org v2 list (#​8719) (d03ad62), closes #​8616
• add domain as attribute to list user auth methods (#​8718) (4d593da), closes #​8615
• always create SAML with metadata (#​8696) (464ca0b), closes #​8443
• API: select org context by domain (#​8706) (dc7330f)
• check if project has resourceOwner and ownerID (#​8725) (911cb42), closes #​7794
• correct error messages for policy queries (#​8722) (5e57d3b)
• correctly compute user state (#​8740) (91b2d67)
• correctly create SMTP provider list (#​8724) (0bcf136), closes #​8545
• handler: optimise snapshot hanlding (#​8652) (ddeeeed)
• ignore projectID and origin check for service accounts (#​8704) (c347e75)
• only allow domain discovery if no organization was preselected (#​8748) (df20332)
• pass sessionID to OTP email link (#​8745) (16171ce)
• respect PrivateLabelingSetting on project for login texts (#​8744) (94f267d), closes #​8502
• SAML: check on empty nameID (#​8714) (1849927)
• SAML: log underlying error if SAML response validation fails (#​8721) (81920e5), closes #​8717
• twilio code generation and verification (#​8728) (f653589), closes #​8678
• update dependencies (#​8713) (c0615e9)
• update logging to allow slog field overwrite (#​8720) (bee0744)

Features

• i18n: Add Hungarian language support to ZITADEL (#​8645) (c455b8b)

Performance Improvements

• cache: pgx pool connector (#​8703) (25dc7bf)
• milestones: remove legacy token event reducer (#​8747) (17303d1)
• oidc: nest position clause for session terminated query (#​8738) (a84b259)

v2.63.7

Compare Source

Bug Fixes

• actions: preserve order of execution (#​8895) (586254c)
• saml: provide option to get internal as default ACS (#​8888) (6ce0afd)
• setup: improve search query to use index (#​8898) (30b07ef)
• use correct check for user existing on import (#​8907) (314ed99)

v2.63.6

Compare Source

Bug Fixes

• correctly check denied domains and ips for actions (#​8810) (b868471)
• Update Defaults.yaml (#​8731) (b1d0813), closes #​8531

v2.63.5

Compare Source

Bug Fixes

• add allowRegister check for register handling in login (#​8782) (f0d1a6d), closes #​8123

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone America/Montreal, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.