🌟 Changes in this release:
If you don't use SSO, nothing to do.
If you do: SSO_ONLY_MODE actually works now. If you set it to 1 or yes, it's been doing nothing and password login has stayed open — after this release it closes. Make sure you can sign in through your provider first, and that an admin account is linked to it. Also check your flag values are true/false/1/0/yes/no/on/off — a typo now stops the container instead of being ignored.
Locked out? Set SSO_ONLY_MODE=false and restart.
✨ Enhancements
- feat: standardize client IP resolution and logging for trusted proxies (#1002) by @afairgiant
- feat: warn and log the effective auth mode so operators can see SSO-only lockouts (#989) by @afairgiant
- feat(auth): SSO-only mode and IdP auto-redirect, frontend (#982) by @afairgiant
- feat: Enhance Epic MyChart parsing with layout-aware extraction (#965) by @afairgiant
- feat: Added 12 additional Laboratory tests (#942) by @r-xyz
- feat: update docker compose example (#707) by @eightys3v3n
- feat: add language switcher to mobile navigation and adjust z-index for dropdown (#944) by @afairgiant
- feat(auth): Enhance SSO functionality with SSO_ONLY_MODE and auto-redirect options (#980) by @afairgiant
- Update Medication/Procedure/Treatment filter/sort (#960) by @robf17
- feat: Add Greek UI support (#955) by @robf17
🐛 Bug Fixes
- fix: enforce strict parsing for SSO_ENABLED to prevent misconfiguration (#1003) by @afairgiant
- fix: localize auth and SSO error messages by returning stable error codes from the backend (#1001) by @afairgiant
- fix: make user preferences language nullable to support browser detection (#998) by @afairgiant
- fix: allow removing a patient's assigned practitioner (#995) (#997) by @afairgiant
- fix: update paperless connection to handle new paperless-ngx updates (#996) by @afairgiant
- fix: wire SSO settings into deployment files, correct break-glass docs (#987) by @afairgiant
- fix: fixed external ID lookup for GitHub SSO users and update routing logic (#984) by @afairgiant
- fix(sso): GC state store, wire rate limiting, guard forced password change (#977) by @afairgiant
- fix: handle must_change_password flag for SSO users and update routing logic (#972) by @afairgiant
- fix: correct reference range parsing and enhance status calculation logic (#966) by @afairgiant
- Security: file access and ssrf fixes (#964) by @afairgiant
- fix: Correct display_order collision in test library (#961) by @afairgiant
- fix: enhance future date validation with timezone tolerance (#947) by @afairgiant
- fix: use local date instead of UTC when auto-filling symptom dates (#946) by @mblauser
- fix: Address language switching issues (#953) by @robf17
🛠️ Refactoring & Maintenance
- refactor: declare background requests at the call site instead of matching URLs (#999) by @afairgiant
- refactor(auth): centralize login redirects behind one helper (#978) by @afairgiant
- chore(deps): bump packaging from 25.0 to 26.3 (#969) by @dependabot[bot]
- chore(deps): bump the minor-and-patch group across 1 directory with 25 updates (#963) by @dependabot[bot]
- chore(deps): update aiohttp to 3.14.3 and cryptography to 50.0.0 (#962) by @afairgiant
- chore(deps): bump github/codeql-action from 4 to 4.37.3 (#949) by @dependabot[bot]
- chore(deps): bump actions/setup-python from 6 to 7 (#950) by @dependabot[bot]
- chore(deps): bump actions/setup-node from 6 to 7 (#948) by @dependabot[bot]