chore(docs): update of OEL images

[ory-bot]

Update OEL images

Summary by CodeRabbit

• New Features
  • Added release notes for version 26.3.2 across multiple self-hosted components.
  • Documented a new device login option for Kratos, including app PIN and biometric sign-in.
• Bug Fixes
  • Tightened wildcard handling for return URLs and CORS origins, allowing only safer subdomain-based patterns.
  • Improved sign-in conflict checks to reduce login delays.
• Documentation
  • Updated image tag reference tables with the latest 26.3.2 release entries.
  • Clarified upgrade guidance for wildcard configuration changes.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds v26.3.2 changelog documentation across Keto, Kratos, Oathkeeper, and OAuth2 describing new DNS-label boundary enforcement for wildcard return URLs and CORS origins, additional Kratos-specific notes on device login and OIDC conflict detection, and updates image tag tables and Polis changelog for the release.

Changes

v26.3.2 Documentation Updates

Layer / File(s)	Summary
Wildcard return URL and CORS enforcement changelog docs/self-hosted/oel/keto/changelog/v26.3.2.md, docs/self-hosted/oel/kratos/changelog/v26.3.2.md, docs/self-hosted/oel/oathkeeper/changelog/v26.3.2.md, docs/self-hosted/oel/oauth2/changelog/v26.3.2.md	Documents new DNS-label boundary enforcement restricting wildcard * handling to subdomain-label-confined forms (e.g., https://*.example.com), lists disallowed patterns, clarifies host-only scope, describes enforcement across Kratos/Hydra/Keto/Oathkeeper/Talos, and provides breaking-change upgrade guidance.
Kratos device login and OIDC conflict detection notes docs/self-hosted/oel/kratos/changelog/v26.3.2.md	Adds Kratos-specific notes on new first-factor device login (app PIN/biometrics) with new selfservice.methods.deviceauthn.config options and a breaking change for existing device keys, plus concurrent OIDC identity conflict detection for faster sign-in.
Image tag table updates for v26.3.2 docs/self-hosted/oel/oel-hydra-image-tags.md, docs/self-hosted/oel/oel-keto-image-tags.md, docs/self-hosted/oel/oel-kratos-image-tags.md, docs/self-hosted/oel/oel-oathkeeper-image-tags.md, docs/self-hosted/oel/oel-polis-image-tags.md, docs/self-hosted/oel/polis/changelog/v26.3.2.md	Adds new 26.3.2 rows (release date 2026-07-09) to the Hydra, Keto, Kratos, Oathkeeper, and Polis image tag tables, and adds a Polis changelog file noting no changelog entries were found.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• ory/docs#2527: Updates the same OEL image tag/version tables and placeholder changelog entries for a different release.
• ory/docs#2618: Touches the same OEL component image-tag/changelog markdown files for a different version.
• ory/docs#2637: Adds new version entries to the same shared OEL image tag tables for a different release.

Suggested reviewers: vinckr, aeneasr, unatasha8, adamwalach

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is only a one-line summary and omits the required template sections, including related issue, checklist, and breaking-change notes.	Expand it to follow the template: add the big-picture summary, related issue/design doc or documentation note, checklist items, and breaking-change details if relevant.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: a docs-only update to OEL images.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oel-version-update

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/self-hosted/oel/keto/changelog/v26.3.2.md`:
- Around line 20-26: The changelog entry uses the shorthand allowed_return_urls
key, but the canonical Kratos config path is selfservice.allowed_return_urls.
Update the wording in the changelog text to reference
selfservice.allowed_return_urls consistently, and keep the surrounding guidance
about wildcard handling and exact origins aligned with that same setting so
operators are pointed to the correct configuration key.

In `@docs/self-hosted/oel/kratos/changelog/v26.3.2.md`:
- Around line 31-42: The changelog text in the device authentication section
uses “platform biometrics” too broadly; update the wording in this entry to
explicitly scope biometrics to iOS only. Adjust the description around the
first-factor flow and the `ios_biometric_first_factor` option so it is clear
that biometric first-factor login is an iOS-specific path, while `first_factor`
and `pin_max_attempts` remain general deviceauthn settings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 31e1fb62-6ebd-4bbe-951d-2d1f99488637

📥 Commits

Reviewing files that changed from the base of the PR and between acb1cdd and 47f5462.

📒 Files selected for processing (10)

• docs/self-hosted/oel/keto/changelog/v26.3.2.md
• docs/self-hosted/oel/kratos/changelog/v26.3.2.md
• docs/self-hosted/oel/oathkeeper/changelog/v26.3.2.md
• docs/self-hosted/oel/oauth2/changelog/v26.3.2.md
• docs/self-hosted/oel/oel-hydra-image-tags.md
• docs/self-hosted/oel/oel-keto-image-tags.md
• docs/self-hosted/oel/oel-kratos-image-tags.md
• docs/self-hosted/oel/oel-oathkeeper-image-tags.md
• docs/self-hosted/oel/oel-polis-image-tags.md
• docs/self-hosted/oel/polis/changelog/v26.3.2.md