v0.10.0

[0.10.0] — 2026-11-05

Added

• SSO: map IdP groups to access and roles per provider (admin group, user group,
  groups claim). Roles follow the groups on every login; users in no allowed group
  are refused.
• SSO: declare a provider through SSO_OIDC_* environment variables. It is synced
  on startup and read-only in the admin panel. See the Keycloak guide in
  the SSO docs.
• SSO: SSO_ONLY=true disables password sign-in, registration, password changes
  and invitations, leaving the identity provider as the only way in.

Changed

• The first-admin setup page stays closed while an enabled SSO provider maps an
  admin group, so such a deployment needs no local admin.
• Bump dependencies, including PyMuPDF 2 and Pillow 13.

Fixed

• SSO: reject callbacks for a disabled provider and userinfo responses whose
  subject differs from the id_token.
• Report downloads now reject an unknown format with a 422 instead of silently
  returning another format.

Full Changelog: v0.9.3...v0.10.0