chore(deps): update ghcr.io/zitadel/zitadel docker tag to v3.4.9

[renovate]

This PR contains the following updates:

Package	Update	Change
ghcr.io/zitadel/zitadel	minor	v3.3.0 → v3.4.9

---

Release Notes

zitadel/zitadel (ghcr.io/zitadel/zitadel)

v3.4.9

Compare Source

Bug Fixes

• enforce organization scopes (af0a246), closes #​11160

v3.4.8

Compare Source

Bug Fixes

• api: permission checks for some management API endpoints (e891eb8)
• handle encoded paths in auth middleware (d873a7e)
• webauthn: expire invite code by creation date (ad81f32)

v3.4.7

Compare Source

Bug Fixes

• api: check permission based on provided data on user update (61baf06)
• token-v2: compare subject to user id (f1b8848)

v3.4.6

Compare Source

This release also fixes the potential issue noted in v3.4.5.

Bug Fixes

• fields: sync membership roles from projections (#​11178) (633a7fc)
• login: generalize error message on code verifications (0bb00dd)
• setup: member role synchronization execution check (#​11180) (4834aa2)

v3.4.5

Compare Source

⚠️ We're currently investigating issues were some users cannot list users after the upgrade to this version.
✅ Solved in v3.4.6

Bug Fixes

• Force v2 permission checks on user listing (e6b5f55)

v3.4.4

Compare Source

Bug Fixes

• authz: ignore unready auth methods for mfa requirement check (#​11056) (54a395f)
• validate IDP linking conditions (4da0c1c)

v3.4.3

Compare Source

Bug Fixes

• check for 2fa even if not enforced (2a7db64)
• respect lockout policy on password change (with old password) and add tar pit for checks (8529ebd)
• sanitize host headers before use (d9cd4e9)

v3.4.2

Compare Source

Bug Fixes

• actions v2: send event_payload on event executions again (#​10651) (26ae44b), closes /github.com/zitadel/zitadel/blob/131f70db3423b80da1b038a822da59c908e4ffa6/internal/eventstore/event_base.go#L38
• cleanup information in logs (#​10634) (5105cf6)
• correct river otel metrics units (#​10425) (6d83c5b)
• oidc: ignore invalid id_token_hints (#​10682) (6eab962)
• projection: Prevent race condition with event push (#​10676) (a322081)
• projection: prevent skipped events written within the same microsecond (#​10710) (358a0d9)
• projections: added check to make sure there cannot be 2 projections for the same table (#​10439) (4512aa5)
• projections: handle reduce error by updating failed events (#​10726) (bc2a565)
• projections: overhaul the event projection system (#​10560) (47c87b3)

Performance Improvements

• actionsv2: execution target router (#​10564) (f5c34a5)
• cache: use redis unlink for key deletion (#​10658) (f017649)
• drop instance position index (#​10626) (c4c56a2)

v3.4.1

Compare Source

Bug Fixes

• console: metadata decoding and encoding backport (#​10616) (330928f), closes #​10024
• console: single feature patch (#​10476) (bdc21a4), closes #​10459
• oidc: enable webkey feature by default (#​10683) (ca510c5)

v3.4.0

Compare Source

Bug Fixes

• correctly escape backslash in queries (#​10522) (8cb2819)
• login: only allow previously authenticated users on select account page (9daec3d)

Features

• generate webkeys setup step (#​10105) (7083bcd)

Performance Improvements

• oidc: introspection endpoint query optimization (#​10392) (982d7db), closes #​10389

v3.3.6

Compare Source

Bug Fixes

• drop default otel scope info from metrics (#​10306) (fc8e15a)
• idp: make external id check case insensitive (#​10460) (4320ae9), closes #​10457 #​10387

v3.3.5

Compare Source

Bug Fixes

• loginV1: disable org metadata triggers (#​10454) (2f79a01)
• query organization directly from event store (#​10463) (6602a9e)

v3.3.4

Compare Source

Bug Fixes

• user metadata check if already existing (#​10430) (c22b5aa), closes #​10246 #​10434

v3.3.3

Compare Source

Bug Fixes

• allow disabling projections for specific instances (#​10421) (c4fb0d2), closes /github.com/zitadel/zitadel/issues/9832#issuecomment-2866236414
• console: fix shrinking hover background on clear flow button (#​10269) (a293841)
• disable client id in oidc configuration (#​10177) (9dde624), closes #​10149 #​10149 #​8530
• don't trigger session projection on notification handling (#​10298) (850bd8a)
• remove fields entry with instance domain remove (#​10406) (218556e)
• saml: use transient mapping attribute when nameID is missing in saml response (#​10353) (0bbca7f), closes #​10251
• sessions: add an expiration date filter to list sessions api (#​10384) (f133809), closes #​10045

v3.3.2

Compare Source

Bug Fixes

• permission checks on session API (b76d8d3)

v3.3.1

Compare Source

Bug Fixes

• enable opentelemetry metrics for river queue (#​10044) (056399b), closes #​10043
• login v1: correctly auto-link users on organizations with suffixed usernames (#​10205) (c787cdf)
• login v1: ensure the user's organization is always set into the token context (#​10221) (b638ed5)
• login v1: handle password reset when authenticating with email or phone number (#​10228) (d537e86)
• scim: add type attribute to ScimEmail (#​9690) (c2c4967)
• webauthn: allow to use "old" passkeys/u2f credentials on session API (#​10150) (1d409f7)

Performance Improvements

• improve org and org domain creation (#​10232) (42663a2)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[joggrbot]

📝 Documentation Analysis

All docs are up to date! 🎉

---

✅ Latest commit analyzed: 6411d01 | Powered by Joggr

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}