[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/zitadel/zitadel	minor	v4.19.5 → v4.20.0

---

Release Notes

zitadel/zitadel (ghcr.io/zitadel/zitadel)

v4.20.0

Compare Source

⚠️ Upgrade notes

• Go 1.26: ZITADEL is now built with Go 1.26.10. Outbound TLS connections (SMTP, external IdPs, Actions and webhook targets, HTTP SMS providers) no longer accept certificate chains through the compromised eMudhra intermediate CAs (#​12969); affected endpoints need a new certificate, the check can't be disabled. Go 1.26 also rejects URLs with invalid colons in the host and offers post-quantum hybrid key exchanges in TLS by default. If a configured URL or outbound connection stops working, GODEBUG=urlstrictcolons=0 or GODEBUG=tlssecpmlkem=0 restores the previous behavior.
• Login V2: the device code check is now signed with ZITADEL_SESSION_COOKIE_SECRET, like the other login proofs. Users in the middle of a device authorization during the upgrade have to enter the user code again.

Bug Fixes

• console: derive environment.json api from the requested origin (#​12893) (e01ccc9), closes #​12009 #​12195
• deps: build with Go 1.26.10 and golang.org/x/net v0.60.0 (#​12932) (3fe639d), closes #​12969 #​12969

Features

• login: configurable text if external user can neither be create… (#​12724) (fb4bc84), closes #​12723

Performance Improvements

• query: skip empty login-name pattern SubSelect (#​12927) (f8ddee1)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 6am on sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.