5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.15).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• Forward-merge main into 4.2 by @iderex in #562
• Widen SourceFilesDeclaring to match record struct and struct declarations by @iderex in #558
• Add SAML service-provider metadata endpoint by @iderex in #567
• Forward-merge main into 4.2 (post-4.1.0.0 fixes) by @iderex in #572
• Add a SAML SP signing-key rollover (part 1 of #491) by @iderex in #573
• Forward-merge main into 4.2 (codeql.yml advanced setup) by @iderex in #576
• Add an admin Test-connection action per provider by @iderex in #577
• Add admin config export/import (#161) by @iderex in #581
• Forward-merge main into 4.2 (README banner) by @iderex in #580
• Accept a SAML response signed by an optional secondary IdP certificate (completes #491) by @iderex in #582
• Forward-merge main into 4.2 (CA1873 log hygiene + Alpha docs) by @iderex in #588
• Forward-merge main into 4.2 (the 4.1.1.0 line + release channels) by @iderex in #595
• Multi-target net9.0/net10.0 for the 10.11 and 12.0 lines (#135) by @iderex in #596
• Forward-merge main into 4.2 (3-part versions + release naming) by @iderex in #598
• Evaluate SAML assertion roles once per login (#479) by @iderex in #599
• Scoped Stryker.NET mutation testing for the SAML/OIDC core (#169) by @iderex in #600
• Weekly SharpFuzz job over the SAML parse surface (#174) by @iderex in #601
• Forward-merge main into 4.2, set 4.2 to its 4.2.0 feature target by @iderex in #603
• Collapse SamlChallenge relayState init to a ternary (#456) by @iderex in #604
• Jellyfin 12.0 (5.0) beta publish leg + two-channel manifest model (#135) by @iderex in #605
• Attest SLSA build provenance for the release plugin zip (#147) by @iderex in #609
• Drop the deprecated assertion-embedded SAML/Auth path (#528) by @iderex in #610
• Document the whole-object-replace contract on provider config (S6964, #196) by @iderex in #615
• Decompose ConvertSigningKeys to cut OIDC id_token validator complexity (S3776, #196) by @iderex in #616
• Accept-with-reason analyzer dispositions in .editorconfig (#104 Unit 0) by @iderex in #617
• Make WebResponse string ops culture-invariant (#104 Unit 1) by @iderex in #618
• Adopt System.Threading.Lock in three lock sites (#104 Unit 3) by @iderex in #619
• Add paramName to ArgumentException throws (#104 Unit 2, MA0015) by @iderex in #620
• Correct the stale target-direction section in ARCHITECTURE.md (#318) by @iderex in #621
• Test the write-only secret converter redaction contract (#192) by @iderex in #622
• Test the AuthorizeStateBinding anti-forgery cookie (#192) by @iderex in #623
• Test the SsoRateLimitGate 429 + fail-open invariant (#192) by @iderex in #624
• Test the admin-or-self authorization helper (#192) by @iderex in #625
• Anchor JF12 beta releases to the built 4.2 commit (#627) by @iderex in #628

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.15