Breaking Changes 2

• Enforce query limits on v2 list endpoints (#12875, #12875, #12881) breaking

  Enforces `DefaultQueryLimit` (100) and `MaxQueryLimit` (1000) on v2 list endpoints. Requests without an explicit limit will no longer return all rows. Requests exceeding the maximum limit now fail with `InvalidArgument`. Sorting by ID is now applied to `ListSessions` and `ListOrganizations` by default to ensure stable pagination.

  API (v2) API (v2beta) Users Organizations Sessions
• Restore query limits on v1 list and change endpoints (#12876, #12876, #2342, #2433, #2383, #2612, #2820, #2818, #2838, #3075, #3096) breaking

  Restores search limits (default/max 1000) for v1 list and change endpoints that became unbounded during previous migrations. Includes legacy refresh token revocation. Limits exceeding 1000 now return `InvalidArgument`.

  API (v1) Admin Service Auth Service Management Service System Service

Security 2

• Protect Login V2 sessions with cookie secret

  Login V2 verification steps are now protected by `ZITADEL_SESSION_COOKIE_SECRET`. A random secret must be configured for proper security.

  Login V2
• Strict validation for public host headers

  Reject invalid public host headers instead of ignoring them.

  Net

Bug Fixes 3

• Enforce query limits on v2 list endpoints (#12875, #12875, #12881) breaking

  Enforces `DefaultQueryLimit` (100) and `MaxQueryLimit` (1000) on v2 list endpoints. Requests without an explicit limit will no longer return all rows. Requests exceeding the maximum limit now fail with `InvalidArgument`. Sorting by ID is now applied to `ListSessions` and `ListOrganizations` by default to ensure stable pagination.

  API (v2) API (v2beta) Users Organizations Sessions
• Restore query limits on v1 list and change endpoints (#12876, #12876, #2342, #2433, #2383, #2612, #2820, #2818, #2838, #3075, #3096) breaking

  Restores search limits (default/max 1000) for v1 list and change endpoints that became unbounded during previous migrations. Includes legacy refresh token revocation. Limits exceeding 1000 now return `InvalidArgument`.

  API (v1) Admin Service Auth Service Management Service System Service
• Optimize Console project loading and handle API limits (#12881, #12881, #12875, #12876)

  Optimized Console startup and organization switching by removing expensive unbounded project preloads. Project counts now use `limit: 1` and metadata is fetched by ID as needed. Account switcher sessions are now sorted by creation date to respect new API limits.

  Console

Deprecations 1

• Deprecate unused `query` and `result` fields in `ListProjectGrantMemberRolesRequest` (#12876, #12876)

  The endpoint no longer uses these fields for list semantics as it always returns all possible roles.

  API (v1) Management Service

Removed 1

• Remove redundant V1 search limit configurations (#12876, #12876)

  Removed `Auth.SearchLimit` and `Admin.SearchLimit` config keys as they are superseded by the global `MaxQueryLimit`.

  Configuration

Contributors 3