v2.188.0

2.188.0 (2026-03-17)

Features

• cache OIDC discovery documents for providers (#2389) (40d07b5)
• enable custom providers by default (#2427) (291cdad)
• modernize IsNotFoundError handler to support errors.Is (#2392) (ab7c9f9)
• oauth-server: allow updating token_endpoint_auth_method for OAuth clients (#2391) (1280dc1)
• passkeys: add admin endpoints to list and delete passkeys (f109550)
• passkeys: add audit, metering, webauthn primitives (039b569)
• passkeys: add configuration, error codes, and schemas (0a5eb95)
• passkeys: add discoverable credential auth flow (#2411) (1bc68ea)
• passkeys: add management endpoints (#2413) (5b3218e)
• passkeys: add rate limiter on the /options endpoint for authentication (#2422) (30b3aeb)
• passkeys: derive friendly name from AAGUID (#2415) (e00ff1a)
• passkeys: progressive enrollment flow (61ae2aa)

Bug Fixes

• add MaxBytesReader middleware to limit request body size to 1MB (#2402) (6f0b2eb)
• bump Go to v1.25.8 (#2412) (a2e357f)
• passkeys: construct configuration env var correctly (dba676e)
• passkeys: enforce passkey cap during registration verify (9868df6)
• passkeys: return 204 when deleting a passkey (7d90fb8)
• passkeys: sign_count should be uint32 (e509e3a)