v13.2.1

Security

• [GHSA-mp8m-wcxp-w648] Fix Active Directory password exposure via /authorize query string (CWE-598). When defaultADUsernameFromEmailPrefix is enabled (the default), inputs with no local part (e.g. @corp.com) caused the login to route through an OAuth redirect instead of a credential POST, exposing the password in the URL.
• Backport security dependency fixes to v13.

Fixed

• Emit authorization_error for too_many_attempts, guard Cordova plugin instantiation, fix SelectInput name prop.
• Guard against null domains and trim whitespace in HRD screen.

Changed

• Upgrade react-transition-group v2 to v4 and migrate string refs to createRef.
• Add too_many_attempts i18n key to passwordless error section across all locales.