v0.55.1 - September 18, 2025

Bug Fixes

• Tenant-subdomain URL injection — XsuaaAuthProvider._fetch_token now validates tenant_subdomain against the RFC 1123 DNS-label regex (^[A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])?$) before substituting it into the OAuth token URL. Passing a value containing URL delimiters (e.g. evil.example/oauth/token?ignore=) now raises ValueError immediately instead of silently routing credentials to an attacker-controlled endpoint.
• ADMS create_client / create_async_client now wraps RuntimeError from ConfigFactory (missing secrets) as ConfigError, so callers only need to handle one exception type.
• DMS integration test fixture now uses try/finally for repository cleanup, ensuring teardown runs even when a test fails mid-fixture.

Contributors

@betinacosta