4.3.0-beta

Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.8).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• SSO-only login (DisablePasswordLogin) with a break-glass admin safety net (#165) by @iderex in #665
• Fail closed on a null FolderRoleMap.Folders in RolePrivilegeMapper by @iderex in #693
• Key the OpenID authorize-state store on UTC, not machine-local time by @iderex in #696
• Redesign the provider config page: workspace, chunked accordion, safe defaults by @iderex in #697
• Harden SAML parsing: dispose the certificate, xsd-faithful time bounds, close XPath injection by @iderex in #698
• Polish the served auth and self-service linking pages by @iderex in #701
• Unify the challenge NewPath resolver and inline a single-caller OIDC wrapper by @iderex in #702
• Correct the ProviderConfigValidator doc and tighten RequestHelpers visibility by @iderex in #703
• Stop repointing third-party-provider accounts under SSO-only login by @iderex in #704
• Type the rate-limit endpoint-class bucket keys by @iderex in #705
• Audit SAML DoNotValidateAudience as an insecure toggle by @iderex in #706
• Restyle browser-navigated SSO error responses and reword the denial by @iderex in #707
• Advance the plugin to Beta for the 4.3.0 release by @iderex in #710
• List SSO-only login in the README feature set by @iderex in #700
• Add a docs/ pointer to the Wiki by @iderex in #711
• Stop reflecting IdP error text into the OpenID browser error page by @iderex in #709
• Show the real OpenSSF badges and a release badge in the README by @iderex in #770
• Remove the orphaned img/custom-button.png asset by @iderex in #771
• Bound the untrusted SAML DOM with MaxCharactersInDocument by @iderex in #772
• Add a restrictive Permissions-Policy to the served auth and error pages by @iderex in #773
• Clarify that this is an independent plugin repository, not the official catalog by @iderex in #774
• Advertise both SAML ACS spellings in SP metadata by @iderex in #775
• Fall back to the standard OIDC picture claim for avatars by @iderex in #776
• Extract the Net module (networking/SSRF/URL primitives) into Api/Net by @iderex in #778
• Extract the Secrets module (secrets at rest) into Api/Secrets by @iderex in #779
• Extract the Audit module (audit logging) into Api/Audit by @iderex in #780
• Extract the Avatar module (avatar fetch) into Api/Avatar by @iderex in #781
• Extract the RateLimit module (login throttling) into Api/RateLimit by @iderex in #782
• Remove the unused Nix dev-shell flake by @iderex in #783
• Extract the Authz module (role to permission mapping) into Api/Authz by @iderex in #785
• Extract the Provider module (config/test/naming) into Api/Provider by @iderex in #786
• Extract the Linking module (account linking) into Api/Linking by @iderex in #787
• Extract the Saml module (SAML core, validators, caches) into Api/Saml by @iderex in #788
• Extract the Oidc module (OIDC flow, discovery, token) into Api/Oidc by @iderex in #789
• Document the module architecture and the extension contract (docs/ARCHITECTURE.md) by @iderex in #792
• Mirror the source module structure in SSO-Auth.Tests (module test folders) by @iderex in #793
• Finish the SSO-Auth.Tests reorganisation + enforce the module-test mirror by @iderex in #794
• Extract the shared ILoginService contract for OIDC and SAML by @iderex in #795
• Invert VerifiedIdentity's dependency on the protocol modules by @iderex in #796
• Extract the Identity module (VerifiedIdentity keystone) from the flat kernel by @iderex in #797
• Extract the Session module (mint, outcomes, SSO-only) from the flat kernel by @iderex in #798
• Move KeyedLockStore into the RateLimit module by @iderex in #801
• Split SsoUrlBuilder into per-protocol URL builders in their modules by @iderex in #802
• Move the SAML library into the Saml module, one type per file (#800) by @iderex in #803
• Give the remaining root types their module homes by @iderex in #805
• Extract the route-shape primitives into a Routing leaf module by @iderex in #816
• Rewrite the catalog listing copy by @iderex in #819
• Add a supported-providers matrix and an honest comparison table by @iderex in #820
• Require docs-impact tracking for every change by @iderex in #824
• Publish the governance, support, CRA, privacy and remediation policy set by @iderex in #825
• Enforce bracketed issue references in every commit subject by @iderex in #836
• Enable nullable reference types across the leaf modules by @iderex in #838
• Enable nullable reference types across Provider, Linking and Session by @iderex in #839
• Link the maturity map from README and SECURITY by @iderex in #840
• Enable nullable reference types across the Shared module by @iderex in #841
• Pin the persisted SSO AuthenticationProviderId, decoupled from the controller type by @iderex in #842
• Extract the Http boundary module and lock the flat Api kernel empty by @iderex in #843
• Constrain the Flows and Shared module import lists in the DAG test by @iderex in #845

Full Changelog: 4.2.1-beta.7...4.3.0-beta.8