v2.42.0

Features

• OIDC group claim and requested scopes are now configurable, so providers like Okta that send group membership under a different claim (or only when asked for) can drive Devhub roles. Both can be set in Settings or declaratively through the Helm chart.

Improvements

• License seats are now identified by email, so one person takes a single seat across installs that sign in through different identity providers. The users list shows seat holders by email address instead of an opaque provider ID.
• Connected Applications and refresh-token reuse settings are now grouped per application rather than per connection, so revoking access signs an app out on every machine, and allowing reuse keeps covering the app as it re-registers. The list shows how many registrations and users are behind each app, and an allowance stays visible so it can be switched off even when nobody is currently connected.
• Users with no name (common with OIDC logins) now show their email address wherever a name was expected — approvers, avatars, and the policy people picker — and can be searched by it.

Bug Fixes

• OIDC logins now send and verify a state parameter, protecting the sign-in callback from forged requests.