4.20.0 (2026-10-22)

⚠️ Upgrade notes

• Go 1.26: ZITADEL is now built with Go 1.26.10. Outbound TLS connections (SMTP, external IdPs, Actions and webhook targets, HTTP SMS providers) no longer accept certificate chains through the compromised eMudhra intermediate CAs (#12969); affected endpoints need a new certificate, the check can't be disabled. Go 1.26 also rejects URLs with invalid colons in the host and offers post-quantum hybrid key exchanges in TLS by default. If a configured URL or outbound connection stops working, GODEBUG=urlstrictcolons=0 or GODEBUG=tlssecpmlkem=0 restores the previous behavior.
• Login V2: the device code check is now signed with ZITADEL_SESSION_COOKIE_SECRET, like the other login proofs. Users in the middle of a device authorization during the upgrade have to enter the user code again.

Bug Fixes

• console: derive environment.json api from the requested origin (#12893) (e01ccc9), closes #12009 #12195
• deps: build with Go 1.26.10 and golang.org/x/net v0.60.0 (#12932) (3fe639d), closes #12969 #12969

Features

• login: configurable text if external user can neither be create… (#12724) (fb4bc84), closes #12723

Performance Improvements

• query: skip empty login-name pattern SubSelect (#12927) (f8ddee1)