<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="41">
<package pkgid="68821411d3a28fe6264f69faf7022d8eb5961eb5da892b0e0e520b966a4db21f" name="kanidm" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="da66e5c7b7c1ec710d502a03573ae7d5782dea3b59a50983d829e3cba5dae36c" name="kanidm" arch="src">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="879a611c6d0bee138b55c3960cfe0bdc3e1667d36008349b6b61b2e57e418515" name="kanidm" arch="src">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="eba0d1a84405dbff63a34f862e47ef0782bc5fc22b05886246599f51d3b1f8d8" name="kanidm" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="88ccabe73907e5aad018a15cc86faeaf3a7faa5bb5089e7f076856b6954c5c40" name="kanidm-clients" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="44fa78c04dce1a2b3665e3f4f9bae21f585cbb4448b7fd0db1baac6f2bc730fa" name="kanidm-clients" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="d24bce60ec8d3bec29164cd55f8cd5b64272940bc8649750b8b11699df8fd827" name="kanidm-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="4ca411c535273b265e624e2064477c3ddb40f5a7f9933153c73b67be85654f25" name="kanidm-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="35e251fffae1d3de63b044a23b95341bd50fb59c6eb4d1f8fd8cff32821744c4" name="kanidm-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="68bf7a0e8aac97fc110560fdac6695f1ae1c9513ac9156d00679ac7b167599b8" name="kanidm-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="066a673606c202809a3d044b1f656b046d07c0a1b1673a4b5bd1cdfdebf1f88b" name="kanidm-debugsource" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="b73402e83140300ea83bc0cb05bf4b27a20af9e7afc31d93d8a07be0a32cc6fe" name="kanidm-debugsource" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="2557dcf8fbb5ac772790bb3197d69ce288980ea42ad3ae8edb1fb120476b6a0e" name="kanidm-docs" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="357e966a2cf47c8fb22ded09b28b657df76aad2e0709c106deafc5fd89b4f292" name="kanidm-docs" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="6dad98f3bdc4c067768c7f6b0a8be1f44acd5882e188e84122afb8dbfbb5e6c7" name="kanidm-server" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="8444294233ede92584f8134d52a387f807a56c9e569c877d907692a021898529" name="kanidm-server" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="7aa7b769c463cbfe292b23b8f2f290a93d68af425834e9b5f6e8abf30b4a7062" name="kanidm-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="82a7d32a839800aaee50c9a66c31431d7ed36a0b6e66fc6fb4487c2f4cb2a16b" name="kanidm-server-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="fc87da6eee838273ec4468d883bf5654b73c7d48701a25f33cbdc90c4622ebeb" name="kanidm-unixd-clients" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="b64e4bdecee7c5f56256574bcbb7742be0e709410d95f609d99a82ff2c147844" name="kanidm-unixd-clients" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="53cbbedba343e79ad1b6346de2ccadcba84d1ed1bdced4739b950489c01fce6b" name="kanidm-unixd-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.5"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="f09bf477db1e74902971178a2d636b39ae82e95fb624efedcf9d3c8e89dd637e" name="kanidm-unixd-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.11.0~git0.ed10baa49" rel="133.6"/>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
  <changelog author="william.brown@suse.com" date="1785672000">- Update to version 1.11.0~git0.ed10baa49:
  * Release 1.11.0
  * SCIM Filter Recursion Limit
  * Update Cargo.lock
  * Release 1.11.0-pre
  * 20260730 pre release (#4492)
  * Use rfc7662 token verification to ensure that the session returned (#4369)
  * 20260701 application password cli (#4454)
  * Add a minimal templating system that is safe for user defined templates.
  * 20260710 radius tlscache (#4464)
  * Refactor async task startup to improve early server stops (#4468)
  * 20260721 actor framework (#4481)
  * Update crypto glue (#4478)
  * Bump pymdown-extensions in /pykanidm in the uv group across 1 directory (#4488)
  * Bump the all group across 1 directory with 12 updates (#4487)
  * Bump the all group in /rlm_python with 2 updates (#4485)
  * Bump actions/setup-python from 6 to 7 in the all group (#4486)
  * Properly use the Json type so that response headers are set correctly (#4480)
  * Update and improve AI policy to be clearer (#4479)
  * Bump the all group in /rlm_python with 3 updates (#4475)
  * Bump the all group with 11 updates (#4476)
  * 20260702 syntax tidying (#4439)
  * Show sccache stats (#4471)
  * 20260516 oauth2 tester (#4349)
  * Improve handling of alerts in cred update dialog (#4338)
  * Allow service account managers to search relevant attributes (#4381)
  * Allow custom radius reply attributes (#4370)
  * Drop mimalloc on linux (#4469)
  * Fix ci errors (#4472)
  * Fix up incorrect documentation information (#4437)
  * 20260602 pam env (#4413)
  * Fixing the pre-release docs (#4379)
  * Regression test for #4460 and cleaning up error handling a bit in mail-sender (#4463)
  * 20260716 clippy (#4465)
  * Include socks feature in reqwest (#4461)
  * feat: add live server password feedback (#4348)
  * Bump the all group across 1 directory with 12 updates (#4456)
  * Bump the all group in /rlm_python with 3 updates (#4459)
  * Limit password max length (#4442)
  * Bump joserfc in /pykanidm in the uv group across 1 directory (#4447)
  * Bump the all group in /rlm_python with 2 updates (#4423)
  * Fix incorrect logic in bindmount processing (#4433)
  * Missing attributes in migration access (#4387)
  * Typo (#4374)
  * Update ldap3/lber to 0.8.0 (#4412)
  * tools/cli: Rename `u2fhid` to `mozilla`. (#4411)
  * Bump actions/checkout from 6 to 7 in the all group (#4409)
  * Bump the all group in /rlm_python with 3 updates (#4408)
  * Bump the all group with 5 updates (#4410)
  * fix: log IDs for otel LDAP requests (#4373)
  * Add serde alias for bindmount (#4398)
  * Bump the uv group across 1 directory with 2 updates (#4403)
  * Bump the all group with 4 updates (#4402)
  * Bump the all group in /rlm_python with 3 updates (#4401)
  * 20260612 clarify ai content (#4399)
  * Bump aiohttp in /pykanidm in the uv group across 1 directory (#4386)
  * Bump the all group in /rlm_python with 2 updates (#4389)
  * Bump the all group across 1 directory with 11 updates (#4390)
  * docs: clarify and extend opkssh example (#4385)
  * OAuth2 Hardening (#4380)
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Bump the all group in /rlm_python with 2 updates (#4376)
  * fix: Return unique LDAP attributes (#4364)
  * Bump the all group across 1 directory with 2 updates (#4362)
  * Bump the all group with 8 updates (#4363)
  * 20260507 schema in memory (#4315)
  * Add max_age / improve prompt=login - now without grace periods!  (#4336)
  * Bump the uv group across 1 directory with 2 updates (#4358)
  * Resolve incorrect login in commited flag
  * Bump urllib3 in /pykanidm in the uv group across 1 directory (#4355)
  * Bump the uv group across 1 directory with 4 updates (#4341)
  * Bump the all group across 1 directory with 17 updates (#4354)
  * Bump the all group in /rlm_python with 3 updates (#4353)
  * Prevent migration double-deletes
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Bump the all group in /rlm_python with 2 updates (#4326)
  * Allow SMTP urls in mail-sender (#4335)
  * I got a bee in my bonnet (#4333)
  * Bump actions/dependency-review-action from 4 to 5 in the all group (#4327)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)
  * Rust FreeRADIUS module (#4179)
  * Fix inconsistent flag documentation: send-reset-token (#4316)
  * Removing npm usage and replacing with pnpm (#4313)
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Group UI polish (#4285)
  * Resolve base64 encoding of webauthn fields (#4312)
  * Upgrade to v1.11.0-dev (#4305)
  * Update ty requirement in /rlm_python in the all group (#4307)
  * Bump the all group with 5 updates (#4308)</changelog>
</package>
<package pkgid="ebeff837508a9e9bff3dbf48d65d6218f1d08ae69748964faebb21e0c85fc552" name="libsso-mib-devel" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="89dd03caa9afbab4035c3ff533b7bc98fa259c3fa842c5bc7df409bfbbd334a3" name="libsso-mib-devel" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="920428ce5cad3f1e6baaeca17dc0c21f4492cff5261cf255543cae5208adc74a" name="libsso-mib0" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="0eb507d8b90d07f0054f0decb73e38dad3767817cf4e43bbb61387e71439618d" name="libsso-mib0" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="35cd61a8dfaa84108c0fc314c29bffbd68f1b2c0f35940eabbeb3a2276ed585d" name="libsso-mib0-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="c44027178d7a0de4d5946c7e506ed6ed7621aae4eff40f2b61e4a4b263ecd3af" name="libsso-mib0-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="583338266076a198521070e94c06b334cdef07e91e9e2dfaca115d7abdc4a7f2" name="sso-mib" arch="src">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="4531924e758a7d8959daf8e3b7e464aea66c8b4dc4ecdc73ffadea86e4054924" name="sso-mib-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="4a1591a43303ef45d796ecf2f928e128492a9c9994e943e89aa88d35ef286a46" name="sso-mib-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="f2e9f5ba963f8275531afaf1b29bc124a7a1a256eac7ddd5acf9a55671a7b668" name="sso-mib-debugsource" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="78cac055df644bd49fdf53f7be8eecc8d77107b5d2d37a3b61562aa55a0e3d97" name="sso-mib-debugsource" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="a08df3dfd439536b356a8d039c73ef49500cfd8ab35704f22dab1d52a008ce16" name="sso-mib-gch-smtp-o365" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="ca119a38e5617234e85f53b3b30e72076bb90e9b1fce889acd7de863a8e44de7" name="sso-mib-gch-smtp-o365" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="f346ca26d16444658b86eee8e38d9e3b7a48ba3f45e226890569d4230732118c" name="sso-mib-gch-smtp-o365-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="1ec493864968d2081fd5253d63d8dfac613cff725848377b2109ac204a42eaaa" name="sso-mib-gch-smtp-o365-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="992100c4c0a0036b1bac1ecdd33b832da2876a136a9fccb3bcb3ca185559acdc" name="sso-mib-tool" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="d7a996bc5958469059099d603f9caaf363b9cb1fbc21c1c6ca5055d984e14c2a" name="sso-mib-tool" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="9326dccf804f062c86fa9c2d9431236f9e15191d30a20618a9721da894fbf72f" name="sso-mib-tool-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="639def794738914bc7927e6bb8cadab429e2f3c546d3f5a1fa084bf48f3726bd" name="sso-mib-tool-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="9.7"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
</otherdata>