os-sso 2026.7.1
Commits
- 044f3a2 docs(readme): document strict group sync and account-expiry refusal
- c1f5321 feat(groups): optional strict group sync (deprovision on login)
- 0c47127 refactor(oidc): key in-flight login state by OIDC state, not shared session keys
- f4b8d2b fix(cp-portal): constrain the redirurl before redirecting
- ff89db1 fix(cp): reject control characters in the captive-portal username
Pull requests
Full Changelog: v2026.6.2...v2026.7.1