Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.26).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json
Scope note (#743): the JF12/5.0 line is not validated against a live Jellyfin 12.0 server yet — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.
What's Changed
- Treat whitespace-only SAML roles as blank in the login allow-list by @iderex in #957
- Add a manifest-only regeneration dispatch as a recovery path by @iderex in #958
- Bound the checksum-sidecar fetches to the entries that survive the cap by @iderex in #959
- Resurrect the Stryker mutation gate via a VSTest twin project by @iderex in #960
- Split the mutation run into three parallel scope legs by @iderex in #963
- Pin every SsoAudit emission: shape, level, CRLF-strip, emission points by @iderex in #964
- Make a forgotten rate-limit gate a red build; pin the 429 shapes by @iderex in #965
- Exercise the PAR-enabled challenge path — the untested production default by @iderex in #966
- Test the login-button hosted service and pin the SAML hostile-name route by @iderex in #967
- E2E: stable-binding relogin, admin-policy asserts, SSO-only round-trip by @iderex in #968
- Close the four small unit holes from the coverage audit by @iderex in #969
- Exercise the SSRF connect guard at the real socket layer by @iderex in #970
- E2E: exercise SAML metadata import/SP-metadata, assert secrets-at-rest + audit by @iderex in #971
Full Changelog: 5.0.0-JF12-beta.25...5.0.0-JF12-beta.26