Implements RFC 7591, allowing clients to register themselves at runtime with support for both open and token-gated modes.

Implements RFC 7592, enabling dynamically registered clients to manage their configurations using a registration access token.

Implements iOS/Android app-link support, including serving required trust files (apple-app-site-association and assetlinks.json) and adding configuration fields to OIDC apps.

Allows users to use their ZITADEL account from another instance as an identity provider.

Adds api.v1.user.appendMetadataRaw to allow storing metadata values without JSON encoding, fixing a regression where scalar strings were always quoted.

Allows resending invite codes to users who had all their auth methods removed by making the 'initialized' check dynamic.

Binds SetSecuritySettings to PUT /v2/settings/security for API path consistency.

Fixes issues where cancelling a username change threw an error and email verification failed if the email address remained unchanged.

Prevents leaking plaintext passwords in Postgres logs during initialization by checking for existing roles before execution.

Resolves a loop and UI flash in OIDC flows with login_hint by resolving the user server-side and skipping the username step.

Adds hidden username fields to password forms to improve compatibility with password managers.

Ensures consistent handling of ignoreUnknownUsernames between server and client-side pages to prevent misleading unknownContext errors.

Fixes a loop where users with passkeys + MFA were stuck because passkey logins weren't correctly marked as fulfilling MFA.

Implements table-level autovacuum tuning for the events2 table to prevent progressive performance degradation and system latency.

Migrates to use the new user_action oneof in IDP intent responses for parity between creation and updates.