Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.26).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json
What's Changed
- Skip the PR-hygiene fail tier for authors outside the repository [#1207] by @iderex in #1228
- Build the fuzz harness in the gating PR job by @iderex in #1229
- Record why the id_token error string carries no per-shape codes by @iderex in #1230
- Decide and pin the JWKS-side kid posture: advertised keys are not screened [#1029] by @iderex in #1231
- Admit a case-variant member repeat, and pin the decision [#1191] by @iderex in #1234
- Refuse an invalid escape rather than folding two names into one [#1197] by @iderex in #1236
- Pin that the code flow sends no nonce, and bind the code with PKCE [#1157] by @iderex in #1239
- Report a lockfile a local build rewrote, at the moment it happens [#1150] by @iderex in #1237
- Read a redirect parameter through one helper in the test project [#1046] by @iderex in #1240
- Pin that a forwarded header never moves the rate-limit bucket [#1035] by @iderex in #1241
- Carry an OpenVEX document and refuse a malformed edit to it [#1092] by @iderex in #1242
- Document the translation flow and what ships today [#1155] by @iderex in #1243
- State how a triaged advisory becomes a published VEX statement [#1094] by @iderex in #1244
- Add the intended-use notice by @iderex in #1246
- Read both discovery facts out of one parse [#1170] by @iderex in #1248
- Fuzz the provider key set, and seed it with a repeated kid [#1156] by @iderex in #1250
- Pin the JWKS side of the kid allowlist as a set-level contract [#1168] by @iderex in #1251
- Replay the committed fuzz seeds in the gating build [#1134] by @iderex in #1252
- Give the file-writing tests a directory the suite owns [#1218] by @iderex in #1253
- Correct the Dependabot cooldown rationale for action bumps [#1055] by @iderex in #1254
- Refuse a degenerate multi-segment token instead of raising out of the reader [#1249] by @iderex in #1258
- Cap provider response bodies at the shared outbound HTTP seam [#1169] by @iderex in #1259
- Skip the LAN-binding tests on Windows so the suite runs unelevated [#1227] by @iderex in #1260
Full Changelog: 4.3.0-beta.25...4.3.0-beta.26