verify_new_address hook is on master but not in any release; is phone/SMS supported? #4628

Question: is the verify_new_address settings hook planned for a tagged release, and does it support phone/SMS?

verify_new_address (added in 951cf3c, 2026-04-20; follow-up cc2e4bf, 2026-04-27) is in embedx/config.schema.json on master and documented at https://www.ory.com/docs/actions/verify-new-address, but it is not in v26.2.0 (2026-03-20), which is still the latest tag and Docker image. I could not find an issue or PR that tracks it.

What I tested. I built master at b86338d and ran it with a passwordless-SMS identity schema (phone as the only identifier, code method, verification.use: code), with verify_new_address as the first selfservice.flows.settings.after.profile.hooks entry and a web_hook after it:

• Changing traits.phone through the browser settings flow redirects to /verification?flow=… with a code form.
• The old number stays in the identity and keeps signing in until the code is entered. Exactly one SMS is sent, to the new number.
• After the code is entered, the new number is applied and verified, and the web_hook runs against the updated identity.

So it works for a phone identifier too, although the docs only show email.

Questions

1. Is there a planned release that includes this hook (v26.3 or similar)? Self-hosters currently have to build an untagged master.
2. Is phone/SMS an intended, supported use of verify_new_address? The docs only mention email.
3. Is it meant to be available in open-source Kratos? The docs page is in the Ory Network section.

Without it, a self-service phone change applies immediately and unverified, so a typo or someone else's number locks the person out of their own account.