Every commit scored for change-risk against this repo's own history, so 'elevated' means elevated here rather than on some global curve.
Needs review
181 commits sit in this repo's top risk tercile, which is 34% of the 533scored. The cut is drawn against this codebase's own history rather than a global curve, so a quiet repo still fills its top band, and here it starts at 7.3 out of 10. What pushes a commit up is size and spread together: a large change confined to one area scores below a smaller one scattered across a dozen files.
Commit categories over time, read off the subject line. Fixes carry the accent because that is the series this chart exists to show.
Consistently other-driven across its history.
Ranked by change-risk, highest first. Priority is a tercile of this repo's own distribution, so a quiet repo still fills its top band.
| # | Commit | Author | When | Lines | Risk | Top driver |
|---|---|---|---|---|---|---|
| 1 | 06364339chore: merge ory/x repo | Henning Perl | 1y ago | +63.2K -0 | 100%Elevated | — |
| 2 | d402f824feat: store DeviceAuthn attestation alongside the key | Philippe Gaultierclaudeassisted | 3mo ago | +5.4K -0 | 100%Elevated | — |
| 3 | a96b0d1efeat: dry-run OIDC test flow for project admins | Henning Perlclaudeassisted | 3mo ago | +5.8K -31 | 100%Elevated | — |
| 4 | d651fadefeat: add support for importing all credentials | Henning Perlclaudeassisted | 4mo ago | +8.4K -59 | 100%Elevated | — |
| 5 | 97ac3c16feat(kratos, console): add unified bulk session management endpoint, and allow terminate all identity sessions | Olaclaudeassisted | 3mo ago | +2.4K -9 | 99%Elevated | — |
| 6 | 39c341b9feat: add native api flow support for passkeys | Jeff Hickman | 5mo ago | +1.9K -142 | 99%Elevated | — |
| 7 | 86103bcffeat(kratos): auto-send code when it is the only available method | Pierre Caillaud | 8mo ago | +2.6K -366 | 99%Elevated | — |
| 8 | 71844dd7feat: recovery with any address including with a code via SMS | Philippe Gaultier | 1y ago | +4.8K -34 | 99%Elevated | — |
| 9 | 814c596cfeat(kratos): first-factor login with app PIN | Henning Perlclaudeassisted | 4w ago | +4.0K -75 | 98%Elevated | — |
| 10 | d061f248fix(kratos): normalize phone numbers to E.164 with migration CLI | Henning Perlclaudeassisted | 3mo ago | +3.1K -126 | 98%Elevated | — |
| 11 | 04511690test: deflake and improve performance | Patrik Neu | 7mo ago | +2.5K -2.3K | 98%Elevated | — |
| 12 | 64e04aceautogen: prepare for OSS release - v25.4.0 | github-actions[bot] | 9mo ago | +1.5K -629 | 98%Elevated | — |
| 13 | 53f4b9f9feat(changelog-oel): choose identity schema in self-service registration and login flows | Henning Perl | 1y ago | +3.0K -194 | 98%Elevated | — |
| 14 | 3c84b7aafix: print correct content of down migrations | Patrik Neu | 1y ago | +1.7K -2.0K | 98%Elevated | — |
| 15 | 4fcb2999feat(kratos): update identity from OIDC claims on login | Henning Perlclaudeassisted | 4mo ago | +1.2K -20 | 97%Elevated | — |
| 16 | 6a6928c4fix: add oidc linking/unlinking to api settings flow | Jeff Hickman | 4mo ago | +1.0K -22 | 97%Elevated | — |
| 17 | eb12772cchore: axios update | Deepak Prabhakara | 10mo ago | +1.8K -1.7K | 97%Elevated | — |
| 18 | f2b14979feat(kratos): make passkey authenticator, attestation, and timeout options configurable | Jeff Hickman | 2mo ago | +1.0K -528 | 96%Elevated | — |
| 19 | 075513fffeat: identity region API | Henning Perlclaudeassisted | 3mo ago | +1.2K -31 | 96%Elevated | — |
| 20 | 508137a3fix(kratos): harden identity-schema loading against DoS | Henning Perlclaudeassisted | 3mo ago | +596 -2 | 96%Elevated | — |
| 21 | cc2e4bfcfix: fire settings post-persist hooks after verify_new_address | Jonas Hungershausen | 3mo ago | +1.3K -138 | 96%Elevated | — |
| 22 | 98aaf210feat: carry over upstream OIDC acr/amr to session AAL | Henning Perlclaudeassisted | 3mo ago | +994 -99 | 96%Elevated | — |
| 23 | 951cf3cafeat: add verify_new_address settings hook | Jonas Hungershausen | 3mo ago | +1.6K -127 | 96%Elevated | — |
| 24 | 4c2cfaeffeat: faster UpdateIdentity | Aeneas Rekkas | 9mo ago | +1.2K -111 | 96%Elevated | — |
| 25 | a3ba4970feat: allow settings flow for organization's OIDC/SAML providers | Jonas Hungershausen | 1mo ago | +1.1K -50 | 95%Elevated | — |
| 26 | d944b421feat(kratos): add notify_previous_addresses settings hook | Jonas Hungershausen | 3mo ago | +1.1K -88 | 95%Elevated | — |
| 27 | 15f3eb3achore: update sdks and openapi spec | Deepak Prabhakara | 1y ago | +753 -57 | 95%Elevated | — |
| 28 | 377702a4fix(kratos): describe device authentication API fields for SDK users | Henning Perlclaudeassisted | 3w ago | +745 -192 | 94%Elevated | — |
| 29 | 92caf90ftest: refactor OIDC tests to minimize side-effects | Patrik Neu | 1mo ago | +871 -992 | 94%Elevated | — |
| 30 | 6611397dtest: deflake kratos flow tests with an injectable clock | Henning Perlclaudeassisted | 2mo ago | +838 -486 | 94%Elevated | — |
| 31 | df333da2fix(kratos): normalize phone trait values to E.164 during validation | Henning Perl | 2mo ago | +594 -3 | 94%Elevated | — |
| 32 | 7ae1565dfix(kratos): reject $ref cycles and oversized identity schemas | Henning Perlclaudeassisted | 3mo ago | +458 -2 | 94%Elevated | — |
| 33 | 3a8b572bchore: upgrade herodot to fix information leaks and data races in error handling | Philippe Gaultierclaudeassisted | 3mo ago | +1.0K -964 | 94%Elevated | — |
| 34 | edd1fef8chore: bump ory/pop | Patrik Neu | 4mo ago | +728 -345 | 94%Elevated | — |
| 35 | 9d708594autogen: prepare for OSS release - v26.2.0 | ory-bot | 4mo ago | +698 -197 | 94%Elevated | — |
| 36 | 3f24dbf3feat: add support for NULL and more column types to keysetpagination | Davud Safarov | 6mo ago | +410 -40 | 94%Elevated | — |
| 37 | 46f56e70chore(deps): update dependency @types/lodash to v4.17.21 | ory-bot | 8mo ago | +484 -2.9K | 94%Elevated | — |
| 38 | 57dc7757fix(kratos): persist WebAuthn sign counter for clone detection | Henning Perlclaudeassisted | 3w ago | +477 -2 | 92%Elevated | — |
| 39 | 5d20bb1efeat: pass scoped OAuth2 login request to courier code and verification templates | Henning Perlclaudeassisted | 4w ago | +498 -128 | 92%Elevated | — |
| 40 | 4f470eeafix: parallelize identity conflict lookups during OIDC login and registration | Aeneas Rekkas | 4w ago | +348 -40 | 92%Elevated | — |
| 41 | 71c8c104fix: show send-code buttons on privileged code login refresh | Jonas Hungershausen | 1mo ago | +549 -39 | 92%Elevated | — |
| 42 | 2f4caa23fix: reject duplicate address in settings before and during verification | Ola | 2mo ago | +317 -26 | 92%Elevated | — |
| 43 | 3a5664d2fix: imported totp and lookup secrets credentials can now be used for mfa login | Deepak Prabhakara | 3mo ago | +551 -4 | 92%Elevated | — |
| 44 | 2ab32acffeat: support enum fields in identity schema as dropdowns | Henning Perlclaudeassisted | 3mo ago | +582 -2 | 92%Elevated | — |
| 45 | 286d8747chore: shared serve config | Patrik Neu | 1y ago | +765 -403 | 92%Elevated | — |
| 46 | e7789aaffeat: deviceAuthn implementation in OEL | Philippe Gaultierclaudeassisted | 3mo ago | +1.1K -77 | 91%Elevated | — |
| 47 | 56be7baadocs: improve readme and dev instructions | Aeneas Rekkas | 8mo ago | +342 -427 | 91%Elevated | — |
| 48 | 772572c0feat: trace identity id in errors | Miłosz | 9mo ago | +356 -64 | 91%Elevated | — |
| 49 | 0c80f61cfeat(changelog): find-by and delete SAML credentials | Arne Luenser | 1y ago | +482 -138 | 91%Elevated | — |
| 50 | 6ce2bd86fix(kratos): make one-time secret consumption atomic | Henning Perlclaudeassisted | 1mo ago | +356 -31 | 90%Elevated | — |
Two views of the same model: where the cuts fall, and what commit shape lands you above them.
Every scored commit, binned on the raw 0 to 10 score rather than the percentile. Percentile ranks are uniform by construction, so that axis has no shape to draw. The dashed lines are the tercile cuts behind each row's priority pill.
The 200 most recent commits, on their own recency sample rather than the feed above: that defaults to risk-sorted, so reusing it would plot only the top tercile and call it the spread. Big and scattered is what the model penalises. Click a dot to open it.
Repowise tracks change history across 1,488 files in ory/kratos. In the last 90 days 508 files were touched, 916 times in total, most often persister_identity.go. Every commit is scored for change risk from its size, spread and the history of the files it touches.
