What's Changed
- Forward-merge main into 4.2 by @iderex in #562
- Widen SourceFilesDeclaring to match record struct and struct declarations by @iderex in #558
- Add SAML service-provider metadata endpoint by @iderex in #567
- Forward-merge main into 4.2 (post-4.1.0.0 fixes) by @iderex in #572
- Add a SAML SP signing-key rollover (part 1 of #491) by @iderex in #573
- Forward-merge main into 4.2 (codeql.yml advanced setup) by @iderex in #576
- Add an admin Test-connection action per provider by @iderex in #577
- Add admin config export/import (#161) by @iderex in #581
- Forward-merge main into 4.2 (README banner) by @iderex in #580
- Accept a SAML response signed by an optional secondary IdP certificate (completes #491) by @iderex in #582
- Forward-merge main into 4.2 (CA1873 log hygiene + Alpha docs) by @iderex in #588
- Forward-merge main into 4.2 (the 4.1.1.0 line + release channels) by @iderex in #595
- Multi-target net9.0/net10.0 for the 10.11 and 12.0 lines (#135) by @iderex in #596
- Forward-merge main into 4.2 (3-part versions + release naming) by @iderex in #598
- Evaluate SAML assertion roles once per login (#479) by @iderex in #599
- Scoped Stryker.NET mutation testing for the SAML/OIDC core (#169) by @iderex in #600
- Weekly SharpFuzz job over the SAML parse surface (#174) by @iderex in #601
- Forward-merge main into 4.2, set 4.2 to its 4.2.0 feature target by @iderex in #603
- Collapse SamlChallenge relayState init to a ternary (#456) by @iderex in #604
- Jellyfin 12.0 (5.0) beta publish leg + two-channel manifest model (#135) by @iderex in #605
- Attest SLSA build provenance for the release plugin zip (#147) by @iderex in #609
- Drop the deprecated assertion-embedded SAML/Auth path (#528) by @iderex in #610
- Document the whole-object-replace contract on provider config (S6964, #196) by @iderex in #615
- Decompose ConvertSigningKeys to cut OIDC id_token validator complexity (S3776, #196) by @iderex in #616
- Accept-with-reason analyzer dispositions in .editorconfig (#104 Unit 0) by @iderex in #617
- Make WebResponse string ops culture-invariant (#104 Unit 1) by @iderex in #618
- Adopt System.Threading.Lock in three lock sites (#104 Unit 3) by @iderex in #619
- Add paramName to ArgumentException throws (#104 Unit 2, MA0015) by @iderex in #620
- Correct the stale target-direction section in ARCHITECTURE.md (#318) by @iderex in #621
- Test the write-only secret converter redaction contract (#192) by @iderex in #622
- Test the AuthorizeStateBinding anti-forgery cookie (#192) by @iderex in #623
- Test the SsoRateLimitGate 429 + fail-open invariant (#192) by @iderex in #624
- Test the admin-or-self authorization helper (#192) by @iderex in #625
- Anchor JF12 beta releases to the built 4.2 commit (#627) by @iderex in #628
- Test ProviderConfigValidator reject paths (#192) by @iderex in #629
- Test SSOViewsController GetView (#192) by @iderex in #630
- Test FlowResponses shaping helpers (#192) by @iderex in #631
- Publish JF12 beta daily, not per 4.2 merge (#632) by @iderex in #633
- Test config XML lifecycle round-trip (#192) by @iderex in #635
- Test [Authorize]-policy enforcement end-to-end (#192) by @iderex in #636
- Test fake-IdP OIDC challenge->callback->auth round-trip (#192) by @iderex in #637
- Record the manual release-QA checklist (#192) by @iderex in #638
- Release 4.2.0: merge the 4.2 feature line into main by @iderex in #640
Full Changelog: 4.1.2-beta.6...4.2.0-stable