• Send the RADIUS session ID as Acct-Session-Id in the Access-Request (#751)
  
• Hardened per-user/group configuration file lookup against path-traversal;
  a malformed per-user/group or default configuration file now causes the
  affected session to be rejected rather than silently ignored. A configured
  default-user-conf or default-group-conf file that cannot be opened also
  now causes session rejection (previously silently ignored).
  
• In certificate authentication the user is not prompted for group selection
  if the certificate provides a single group (#692)
  
• Simplified RADIUS Acct-Session-Time calculation to fix inflated time reporting
  for sessions that reconnected with the same cookie.
  
• On TLS 1.3 CSTP sessions, rekey-method = ssl now performs a transparent
  TLS 1.3 KeyUpdate server-side instead of silently falling back to a full
  tunnel rebuild on every rekey (#745)
  
• Virtual host names longer than 43 characters are no longer silently
  truncated; such a [vhost:NAME] previously never matched the clients SNI
  and its clients were served by the default virtual host. Names may now be
  up to 253 characters (#759)
  
• sec-mod now sends a best-effort RADIUS Accounting-Stop for every open
  session when shutting down (#643)
  
• Simplified the radius backend by standardizing in radcli and removing
  compatibility with legacy radius libraries.
  
• IPv4 /31 networks (netmask 255.255.255.254) can now be used for leases as
  point-to-point links (RFC 3021); previously no address could be leased from
  them. The server takes the network address and the client the other one.
  
• The server-side IPv6 tunnel address is now the network address of
  ipv6-network (previously the network address + 1). Firewall rules, DNS
  settings or scripts that reference the servers ::1 tunnel address must be
  updated. This makes /127 point-to-point networks (RFC 6164) lease the
  expected address to the client, and a client can no longer be assigned
  the servers address as part of the first subnet (#714)
  
• The oidc authentication method supports the OpenID Connect authorization
  code flow, selected with mode=browser: openconnect client users log in
  through a browser. The default, mode=bearer, keeps validating a token
  the client already holds. OIDC support now requires GnuTLS 3.8.2
  or later.