Jellyfin 12.0 (.NET 10) beta 5.1.0-JF12-beta (plugin version 5.1.0.95).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json
Scope note (#743/#1466): the JF12/5.0 line has had no manual Release-QA pass against a live Jellyfin 12.0 server - the checklist has not been run since 12.0 GA shipped on 2026-09-07, and this line is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate. What it does carry since #1466 is the automated seven-stack provider matrix that gates this publish: it boots a live jellyfin/jellyfin:12.0 server, installs the net10.0 artifact this release ships into it, and drives OIDC and SAML login round-trips against seven identity providers. That is the release the net10.0 build compiles against. The 5.0 line clears its own live-validation gate when the manual checklist has been run against a GA server; the GA build exists since 2026-09-07, so that run is the only condition left. Use these betas for testing, not production.
What's Changed
- Bound each outbound connect attempt, and say what the address guard skipped by @iderex in #1766
- Retire the Jellyfin 10.11 / net9.0 leg on the 5.1 line: one target, one metadata file [#1770] by @iderex in #1771
- The refused-challenge line follows the code the provider returned [#1763] by @iderex in #1772
- The two refusal sentences say only what the library hands on [#1763] by @iderex in #1775
- The pairwise phase reports an empty sibling set instead of dying at the listing [#1773] by @iderex in #1776
- An administrator refusal names the two ways to link that account [#1765] by @iderex in #1777
- Measure the Strict preset against the repeated-member walk, and keep the walk [#1043] by @iderex in #1778
- The wiki lint resolves a source link at the ref it names [#1780] by @iderex in #1782
- Bump dotnet-stryker from 4.16.0 to 5.0.0 by @dependabot[bot] in #1783
- Bump the codeql-action group with 3 updates by @dependabot[bot] in #1785
- Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 by @dependabot[bot] in #1786
- An avatar on an opted-in provider's own origin is fetched over the private tier [#1764] by @iderex in #1798
- The RP-initiated logout takes a one-time ticket, read a third time [#1788] by @iderex in #1797
- The avatar validator checks the localhost names on the host it dials by @iderex in #1799
- The private-network help text names the avatar reach the setting covers by @iderex in #1800
- Record a completed ticket-borne OpenID logout in the audit trail [#1795] by @iderex in #1801
- Say which half of the logout route the ticket's session binding covers [#1794] by @iderex in #1802
- The logout-ticket mint answers 503 only where a retry can clear it by @iderex in #1803
- Decide the account behind a logout ticket, and put the redeem behind the switch [#1793] by @iderex in #1804
- The logout-ticket mint charges the Logout rate-limit class [#1796] by @iderex in #1805
- The credential-less logout refusals write a bounded number of bounded lines [#1792] by @iderex in #1807
- The credential-less logout refusals draw on a rate-limit class of their own [#1792] by @iderex in #1808
- The mutation run drives the test project through the MTP runner, and a shard that does not fit fails the run by @iderex in #1809
- The linking page carries a Sign out everywhere control that spends a logout ticket [#1768] by @iderex in #1810
- Move the nightly JF12 beta to the 5.1 line, now that 5.0.0 is stable [#1729] by @iderex in #1816
- The README installs from the stable channel first, and names the beta beside it [#1729] by @iderex in #1819
- The README's install note is two sentences, and the wiki carries the rest [#1729] by @iderex in #1825
Full Changelog: 5.0.0-JF12-beta.88...5.1.0-JF12-beta.95