mescon/Muximux v3.4.2

on GitHub

A fix release for OIDC users. Sign-in through Keycloak, Authentik and any
other provider that enforces the PKCE verifier length has failed at the code
exchange since 3.0.29; providers that skip the check were unaffected, which
is how it went unnoticed. Drop-in.

Fixed

• OIDC login works against providers that enforce PKCE verifier length.
  Keycloak, Authentik and any other provider that checks RFC 7636 rejected
  the code exchange with invalid_grant: Invalid code verifier, so sign-in
  ended in a 500 after the identity provider redirected back. The
  code_verifier was 32 characters; the RFC requires 43 to 128. It is now
  64 characters from the unreserved alphabet, and a test exchanges against
  a token endpoint that validates length, charset and the S256 challenge
  the way those providers do. Present since 3.0.29. (#456)

Changed

• Dependencies: grpc 1.83.2 (clears GHSA-2v4p-qf9q-27wj, an xDS-server
  crash that Muximux does not reach), x/crypto 0.57.0, x/term 0.46.0,
  brotli 1.2.4 and dompurify 3.4.15.