fix: shrink the CLI binary by 36%

[alnr]

The ory binary drops from 57.6 MB to 37.0 MB (−20.6 MB, −35.8%) and its dependency tree from 241 to 126 modules, with no change to any command.

	Before	After	Δ
Binary (-s -w, darwin/arm64)	57.6 MB	37.0 MB	−20.6 MB (−35.8%)
Modules linked into the binary	241	126	−115
go.mod require entries	272	162	−110

Why the binary was so large

The CLI imports hydra/v2/cmd, kratos/cmd/identities and keto/cmd/check purely to manage a remote Ory Network project. Those packages mixed API-only commands with server commands, and Go resolves dependencies per package — so importing one API command linked the entire Hydra, Kratos and Keto servers into the CLI: persistence layers, migrations, gRPC, and every social sign-in SDK.

Among the 115 modules this removes: modernc.org/sqlite, jackc/pgx, go-sql-driver/mysql, ory/pop, go-webauthn, go-tpm, discordgo, spotify, slack-go, dockertest, moby/moby/client, go-faker, gobuffalo/plush. No pop, sqlite, pgx or */driver package is linked any more.

What changed

Dependency bumps. The upstream packages were split in ory-corp/cloud#13250 (merged). This bumps to those versions:

github.com/ory/hydra/v2    v2.3.1-0.20260729093009-4174065ffb05
github.com/ory/keto        v0.14.1-0.20260729093002-f50b4892b31d
github.com/ory/kratos      v1.3.1-0.20260729093036-b86338da04a0
github.com/ory/x           v0.0.730-0.20260729093043-56240a017fde
github.com/ory/keto/gen/go v0.0.0-20260729093002-f50b4892b31d  // indirect

One code change. wrapHydraCmd called Kratos' cliclient.RegisterClientFlags on the Hydra-backed OAuth2 commands. It was only there to declare a flag named endpoint — but it put "The URL of Ory Kratos' Admin API" into the help text of ory get jwk, ory create oauth2-client and friends, and it linked the whole Kratos server. The wrapped Hydra commands read that flag through cmdx.NewClient, so it is now registered via cmdx directly. --endpoint / -e behaves exactly as before.

Verification

• No user-visible change: all 87 commands are present and --help output for every one of them is byte-identical to a pre-upgrade build.
• go build ./... and go vet ./... clean.
• The binary built against the published upstream versions is byte-for-byte identical (37,006,802 bytes) to the one built against local checkouts of the upstream fix, confirming the split landed as tested.

Notes

The release build already used -s -w; there was no build-flag win left. The -tags=sqlite,hsm,json1 release tags used to add 26 KB via pop and are now inert for this binary.

The remaining 37 MB is mostly legitimate: ory/client-go, the Jsonnet VM (~4.6 MB, powers ory dev jsonnet), and the ory dev tooling (~2.7 MB).

Summary by CodeRabbit

• New Features

  • Added an --endpoint option to Hydra-related command-line operations for specifying the target API URL.
  • The API endpoint can also be configured through the ORY_SDK_URL environment variable.
  • Improved endpoint handling consistency across wrapped commands.

• Improvements

  • Updated supporting components to improve compatibility and streamline command-line configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 06565998-3673-4dd9-8e47-a18dec30c640

📥 Commits

Reviewing files that changed from the base of the PR and between 107a5e9 and e81a103.

⛔ Files ignored due to path filters (1)

• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• cmd/cloudx/oauth2/jwks.go
• go.mod

---

📝 Walkthrough

Walkthrough

Wrapped Hydra commands gain an --endpoint flag using cmdx, while ORY module versions and indirect dependencies are refreshed in go.mod.

Changes

Hydra endpoint configuration

Layer / File(s)	Summary
Register Hydra endpoint configuration cmd/cloudx/oauth2/oauth2.go	Wrapped Hydra commands register the cmdx endpoint flag, document API URL and ORY_SDK_URL resolution, and remove the Kratos CLI client import.
Align ORY dependencies go.mod	ORY module versions and indirect dependencies are updated, including Keto generated packages and the genproto RPC version.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: reducing the CLI binary size.
Description check	✅ Passed	The description covers the motivation, changes, and verification, so it fulfills the template's intent.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/trim-binary-size

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}