v4.1.0-rc.2

Pre-release v4.1.0-rc.2

Target release: v4.1.0 (minor bump)
Branch: staging
Commit: c92423f

Commits since v4.0.0

• fix(bnk): resolve staging regressions from v4 migration (#228)
• Merge pull request #207 from f5devcentral/feat/azure-auth-templates
• Merge pull request #219 from f5devcentral/fix/benchmark-target-cluster-uniqueness
• Merge pull request #222 from f5devcentral/fix/gitpython-3.1.60
• security: bump PyJWT to 2.15.0, urllib3 to 2.8.0 and axios to 1.20.0
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): force BNK data refetch after builder apply
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• fix(frontend): module-first cluster detection, targeted BNK force refresh
• fix(backend): keep route serviceSettings in topology responses; always clear CWC caches after resync
• fix(auth): keep Entra ID SSO templates out of provisioning defaults
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into work/v4-localhost
• Merge branch 'fix/gitpython-3.1.60' into fix/benchmark-target-cluster-uniqueness
• security: bump gitpython to 3.1.60
• chore(migrations): renumber Azure credential template migration to v2_159
• Merge branch 'work/v4-localhost' into feat/azure-auth-templates
• chore(migrations): renumber cluster discovery migrations after v2_156
• Merge branch 'fix/benchmark-target-cluster-uniqueness' into work/v4-localhost
• fix(k8s): signal a missing bound template with a reason code
• fix(frontend): cluster detection confirm, BNK cache keys, per-cluster placeholders
• fix(auth): scope Azure credentials to the chosen auth method
• fix(backend): BNK data pipeline, credential discovery and cache correctness
• fix(benchmarks): include cluster id in target picker labels
• fix(migrations): v2_156 downgrade restores unique ix_benchmark_targets_name
• chore(api): update openapi.json and generated typescript types
• fix(benchmarks): scope target name uniqueness to cluster and add name filter
• fix(auth): update openapi spec and frontend api types for azure auth method
• fix(auth): address review findings for azure auth templates
• fix(#207): self-review — tz-naive expiry crash, drop token-leaking SSO routes, doc SSO/terraform split
• fix(auth): deduplicate 24-hour credential expiry notification and align alembic docstring
• fix(auth): set migration revision to v2_156 for independent branch on staging
• fix(auth): rebase migration to v2_157 and harden azure sso token refresh
• feat(auth): add Microsoft Azure Service Principal and Entra ID SSO credential templates
• fix(frontend): fail closed when blueprint template load errors in deploy dialog
• fix(#205 r*): assert kubeconfig encryption-at-rest (M1) + normalize Azure api_server (M3)
• fix(fleet): remove unused re import
• refactor(bnk): consolidate bnk version extraction and coordinate query invalidation
• fix(system): isolate thread db sessions in bnk consumption and harden ca bundle
• fix(ci): suppress upstream CVE-2026-56854 in bundled Go binaries
• perf: optimize F5 BNK diagnostics data caching and cross-tab navigation
• perf(k8s,f5bnk,fleet): eliminate blocking spinners and redundant fetches across tab navigation
• feat(system): add node capacity fallback for bnk resources and polish deploy dialog
• feat(f5bnk): show per-listener connection counters in Traffic Flow
• perf(bnk): cache shared BNK state across tabs, diagnostics, and license endpoints; fix project-switch refresh
• test(f5bnk): return real cluster from mocked KubernetesService.get_cluster
• feat(k8s): expose cluster metadata fields end-to-end
• perf(bnk): cap thread pools and cache expensive cloud/BNK/license work
• fix(f5bnk): evaluate BNK 2.3 policy refs, route parent conditions, and CNE available state
• perf(system): parallelize bnk-consumption cluster collection with 30s timeout
• perf(f5bnk): stop blocking health dashboard on unified data; skip configview probes when no VS rows
• fix(module-library): honor git_ref tag refs and reconcile official source with settings
• feat: support custom TLS CA certificates for corporate SSL inspection proxies
• feat: add operational-state polish to App Delivery (Slice 7)
• feat: add TMM traffic stats to BNK gateway/listener/egress views
• refactor: relocate BNK Resources, MCP, and Benchmarks navigation
• feat: add BNK Resources fleet consumption dashboard to System page
• feat: credential-template-driven cluster auto-detection
• feat: BNK Health dashboard connectivity and integration status
• refactor: DRY operator connectivity, node enrichment, and region selector
• feat: enrich BNK Health dashboard with node/AZ placement metadata
• feat: allow free-form cloud regions and add cluster discovery metadata
• Merge pull request #208 from f5devcentral/feat/unified-cloud-k8s-access
• Merge pull request #203 from f5devcentral/fix/202-multus-openshift-namespace
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• Merge pull request #215 from f5devcentral/security/trivyignore-cve-2026-56854
• security(deps): bump js-yaml 4.3.1 -> 4.3.2 (P4 Security Audit npm HIGH)
• security(deps): bump gitpython 3.1.58 -> 3.1.59 (P4 Security Audit gate)
• security(trivy): suppress CVE-2026-56854 (x/crypto/ssh) until helm 3.22.0 stable
• fix(#208): fail closed on mismatched credential template + self-review nits
• fix(#202 review r1): shared ranked Multus DaemonSet picker; file the class follow-ups
• fix(k8s): load kubeconfig purely in-memory and isolate project credential templates
• fix(k8s): correct AKS AAD server app id and extract multi-cloud badge utilities
• fix(frontend): sync version to 4.0.0 in package-lock.json for npm audit
• chore(deps): bump GitPython to 3.1.59, mcp urllib3, and ignore CVE-2026-56854
• fix(deps): pin urllib3>=2.6.4 to remediate CVE-2026-21441
• chore(security): allowlist microsoft public azure cli client id in gitleaks
• fix(backend,frontend): fix boolean filter syntax and design tokens
• feat(frontend): add multi-cloud provider badges and flags for gke and azure
• fix(k8s): retry cloud OAuth token minting on corporate proxy SSL interception
• feat(k8s): support pure-Python GCP and Azure OAuth token generation with fallback
• fix(#202): deterministic Multus DaemonSet selection + document the pod-count scope (self-review)
• fix(#202): count Multus pods in the DaemonSet's namespace so OpenShift reports correctly