4.3.0-beta

Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.9).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• Link the ASVS/RFC 9700 conformance self-assessment from SECURITY by @iderex in #846
• Enable deterministic build settings and document reproducibility by @iderex in #847
• Route the OpenID discovery/JWKS/token fetches through the SSRF-hardened transport by @iderex in #848
• Enforce a minimum asymmetric signing-key strength for IdP signing keys [#733] by @iderex in #849
• Provision new SSO users disabled pending admin approval [#737] by @iderex in #850
• Support step-up / MFA passthrough for OpenID [#757] by @iderex in #851
• Map IdP groups to a parental-rating ceiling (MaxParentalRatingScore) [#736] by @iderex in #852
• Show and copy the exact OIDC redirect URI on the provider form [#724] by @iderex in #853
• Import SAML provider config from IdP metadata (URL or XML) [#735] by @iderex in #854
• Add a SAML provider configuration admin UI [#725] by @iderex in #855
• Correct the actions/checkout pin comment to its exact tag [#858] by @iderex in #859
• Add one-click provider templates to the config page [#726] by @iderex in #857
• Auto-manage the login-page sign-in buttons (core) [#722] by @iderex in #860
• Add the Single Logout session-state store (SLO-1) [#727] by @iderex in #861
• Capture the id_token at login for Single Logout (SLO-1b) [#727] by @iderex in #862
• OIDC RP-initiated logout (SLO-2) [#727] by @iderex in #863
• Deduplicate the SAML metadata action doc; document two nested members by @iderex in #874
• Add a shared TestUsers.Named factory; remove three copied user helpers by @iderex in #875
• Finish the module placement: SSOViewsController + RequestHelpers into Http, dissolve the Kernel test folder by @iderex in #877
• Collapse the two identical SAML signing-key resolvers into one helper by @iderex in #876
• Delete the zero-consumer ILoginService interface by @iderex in #878
• Consolidate served assets into one flat Web/ folder; add a resource-resolution test by @iderex in #879
• Pin namespace to folder under Api/ with a conformance test by @iderex in #880
• Document the internal API surface and enforce it via SA1600 by @iderex in #881
• Pin the internal-doc gate severities so it cannot be silently disabled by @iderex in #882
• Point the repo docs at the consolidated wiki; fix module-table and beta-trigger drift by @iderex in #883
• Add a CI wiki-lint drift guard by @iderex in #884
• Record the OIDC/SAML shared-abstraction evaluation; codify the ≥2-consumer rule by @iderex in #885
• Enable nullable reference types on the Flows module by @iderex in #886
• Enable nullable reference types on the LoginButtons module by @iderex in #887
• Bump System.Security.Cryptography.Xml to 10.0.10 (CVE-2026-47302, -47304) by @iderex in #889
• Enable nullable reference types on the Linking module by @iderex in #891
• Enable nullable reference types on the Logout module by @iderex in #888
• Enable nullable reference types on the Config module by @iderex in #892
• Enable nullable reference types on the Oidc module by @iderex in #893
• Enable nullable reference types on the Saml module (completes #799) by @iderex in #894
• Enable nullable reference types project-wide [#799] by @iderex in #895
• Generate and attach a CycloneDX SBOM to every release [#729] by @iderex in #896
• Adopt a DCO sign-off with a self-contained check [#746] by @iderex in #897

Full Changelog: 4.3.0-beta.8...4.3.0-beta.9

4.3.0-beta

Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.8).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• SSO-only login (DisablePasswordLogin) with a break-glass admin safety net (#165) by @iderex in #665
• Fail closed on a null FolderRoleMap.Folders in RolePrivilegeMapper by @iderex in #693
• Key the OpenID authorize-state store on UTC, not machine-local time by @iderex in #696
• Redesign the provider config page: workspace, chunked accordion, safe defaults by @iderex in #697
• Harden SAML parsing: dispose the certificate, xsd-faithful time bounds, close XPath injection by @iderex in #698
• Polish the served auth and self-service linking pages by @iderex in #701
• Unify the challenge NewPath resolver and inline a single-caller OIDC wrapper by @iderex in #702
• Correct the ProviderConfigValidator doc and tighten RequestHelpers visibility by @iderex in #703
• Stop repointing third-party-provider accounts under SSO-only login by @iderex in #704
• Type the rate-limit endpoint-class bucket keys by @iderex in #705
• Audit SAML DoNotValidateAudience as an insecure toggle by @iderex in #706
• Restyle browser-navigated SSO error responses and reword the denial by @iderex in #707
• Advance the plugin to Beta for the 4.3.0 release by @iderex in #710
• List SSO-only login in the README feature set by @iderex in #700
• Add a docs/ pointer to the Wiki by @iderex in #711
• Stop reflecting IdP error text into the OpenID browser error page by @iderex in #709
• Show the real OpenSSF badges and a release badge in the README by @iderex in #770
• Remove the orphaned img/custom-button.png asset by @iderex in #771
• Bound the untrusted SAML DOM with MaxCharactersInDocument by @iderex in #772
• Add a restrictive Permissions-Policy to the served auth and error pages by @iderex in #773
• Clarify that this is an independent plugin repository, not the official catalog by @iderex in #774
• Advertise both SAML ACS spellings in SP metadata by @iderex in #775
• Fall back to the standard OIDC picture claim for avatars by @iderex in #776
• Extract the Net module (networking/SSRF/URL primitives) into Api/Net by @iderex in #778
• Extract the Secrets module (secrets at rest) into Api/Secrets by @iderex in #779
• Extract the Audit module (audit logging) into Api/Audit by @iderex in #780
• Extract the Avatar module (avatar fetch) into Api/Avatar by @iderex in #781
• Extract the RateLimit module (login throttling) into Api/RateLimit by @iderex in #782
• Remove the unused Nix dev-shell flake by @iderex in #783
• Extract the Authz module (role to permission mapping) into Api/Authz by @iderex in #785
• Extract the Provider module (config/test/naming) into Api/Provider by @iderex in #786
• Extract the Linking module (account linking) into Api/Linking by @iderex in #787
• Extract the Saml module (SAML core, validators, caches) into Api/Saml by @iderex in #788
• Extract the Oidc module (OIDC flow, discovery, token) into Api/Oidc by @iderex in #789
• Document the module architecture and the extension contract (docs/ARCHITECTURE.md) by @iderex in #792
• Mirror the source module structure in SSO-Auth.Tests (module test folders) by @iderex in #793
• Finish the SSO-Auth.Tests reorganisation + enforce the module-test mirror by @iderex in #794
• Extract the shared ILoginService contract for OIDC and SAML by @iderex in #795
• Invert VerifiedIdentity's dependency on the protocol modules by @iderex in #796
• Extract the Identity module (VerifiedIdentity keystone) from the flat kernel by @iderex in #797
• Extract the Session module (mint, outcomes, SSO-only) from the flat kernel by @iderex in #798
• Move KeyedLockStore into the RateLimit module by @iderex in #801
• Split SsoUrlBuilder into per-protocol URL builders in their modules by @iderex in #802
• Move the SAML library into the Saml module, one type per file (#800) by @iderex in #803
• Give the remaining root types their module homes by @iderex in #805
• Extract the route-shape primitives into a Routing leaf module by @iderex in #816
• Rewrite the catalog listing copy by @iderex in #819
• Add a supported-providers matrix and an honest comparison table by @iderex in #820
• Require docs-impact tracking for every change by @iderex in #824
• Publish the governance, support, CRA, privacy and remediation policy set by @iderex in #825
• Enforce bracketed issue references in every commit subject by @iderex in #836
• Enable nullable reference types across the leaf modules by @iderex in #838
• Enable nullable reference types across Provider, Linking and Session by @iderex in #839
• Link the maturity map from README and SECURITY by @iderex in #840
• Enable nullable reference types across the Shared module by @iderex in #841
• Pin the persisted SSO AuthenticationProviderId, decoupled from the controller type by @iderex in #842
• Extract the Http boundary module and lock the flat Api kernel empty by @iderex in #843
• Constrain the Flows and Shared module import lists in the DAG test by @iderex in #845

Full Changelog: 4.2.1-beta.7...4.3.0-beta.8

4.2.1-beta

Jellyfin 10.11 beta 4.2.1-beta (plugin version 4.2.1.7).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• Show link success instead of "Login failed" after account linking (#614) by @iderex in #639
• Fix .NET CI startup_failure on 4.3 (reusable build.yml permissions) by @iderex in #644
• Document the reusable build.yml caller-permission contract by @iderex in #647
• Record single-logout design constraints (#154) by @iderex in #648
• Document the review-gate coverage after external-reviewer removal (#101) by @iderex in #649
• Derive the DORA four keys from git/GitHub (#175) by @iderex in #650
• Conformance test: build-*.yaml artifacts equal the per-TFM publish closure (#608) by @iderex in #651
• Document and drill the release rollback path (#151) by @iderex in #652
• Threat-model SSO-only login before building (Refs #165) by @iderex in #653
• Add the JF12 stable publish leg (#607) by @iderex in #654
• Add the AI-delivery-pipeline threat model; classify agent-config as sensitive (#152) by @iderex in #656
• Consolidate the milestone branches (P4/P5/P5b/P6 work) onto main by @iderex in #657
• Share the publish-manifest-release concurrency group (#655) by @iderex in #658
• Formalize the daily beta as the release canary soak stage (#172) by @iderex in #659
• OpenSSF Best Practices criteria mapping + badge readiness (#403) by @iderex in #660
• Advisory deterministic PR-hygiene checks (#171) by @iderex in #661
• Full RBAC mapping: SSO claims -> PermissionKind (default-deny) (#164) by @iderex in #662
• Move design/process/architecture docs to the wiki; keep only required files by @iderex in #663
• Make the PR-hygiene size check advisory (WARN, never FAIL) by @iderex in #664
• Widen unicode-guard to all branches; tidy publish-pipeline config by @iderex in #691
• Correct stale version references in README and CHANGELOG by @iderex in #692

Full Changelog: 4.2.1-stable...4.2.1-beta.7

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.9).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.9

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.8).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.8

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.7).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.7

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.6).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.6

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.5).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.5

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.4).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.4

5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.3).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• publish-beta: shared publish-manifest-beta concurrency group by @iderex in #606

Full Changelog: 4.1.2-beta.4...5.0.0-JF12-beta.3