It's a hard blocker for v2 ā v4 on any instance with legacy WebAuthn credentials. The relational migration replays the full event history and hits user_passkeys_relying_party_id_check (relying_party_id <> '') on historical user.human.passwordless.token.added and user.human.mfa.u2f.token.added events that were written with an empty RPID by older versions. What makes it a dead end for self-hosters: the offending events can't be removed (eventstore is append-only, and removing the active token still leaves the historical token.added to replay), and patching the reducer means forking an AGPL-3.0 core, which isn't viable for us. So there's currently no non-fork path to migrate. Concretely: we have a production instance with ~15 active U2F keys carrying empty RPID, fully blocked from upgrading. Is a fix on the roadmap, or is there an official (non-fork) remediation we've missed? Happy to share counts/repro details. Thanks!
Preflight Checklist I could not find a solution in the documentation, the existing issues or discussions I have joined the ZITADEL chat Environment Self-hosted Version No response Database PostgreS...
Continue the conversation
Join the Discord to ask follow-up questions and connect with the community
Z
ZITADEL
ZITADEL - Identity infrastructure, simplified for you.