<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="42">
<package pkgid="a75ecac6b36e218d2bd4fca75502c2662af1f9e88ee71a8049658201aa1504fa" name="kanidm" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="f8e21d579b3c48a9dda17ba33a578cc762d2c1e267401e36a22119fabe1594a4" name="kanidm" arch="src">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="4e013eed0b0d4d9307efc84c3853608b3ac5114dd67264a4f57715452ee1d90d" name="kanidm" arch="src">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="75914ba68255f3420c1663800bb63498de43f4d4e577f511a369a238cc1b8cd3" name="kanidm" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="8368ad854eab0a75a7ba3e1596a59e8fc26958f5d40f8e53d32b63b234638c90" name="kanidm-clients" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="5735acb9b0730196c267c584af9c28bfe007d08a3ae7950fc229842e9e9d3a76" name="kanidm-clients" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="80cffbb86fa14bb5622682a210c105e1460ff991a693cb8285b316e25e25856c" name="kanidm-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="beb527bba9ed2dd26d9316bd253bfb0d51b6db2a635c2527a613a297daa96a69" name="kanidm-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="b27866c49ecd69978ff3ab186735b4c0f5258444ba9eee3b6dc8d74a7a7a856a" name="kanidm-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="3ee73d1407f641a3f5c8087155c67819d695126a3d7f765161cfd244883fe56c" name="kanidm-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="d4e4832c535363c09a89b695fc3f23c05fa03b318d6edf3b3db4435bfe6dc294" name="kanidm-debugsource" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="df9ea98278e9c9853fa591071509a0a825c2260a80049bf58f4e6daae912f803" name="kanidm-debugsource" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="f292ec6f2f5c599026646c6447ccfd5814fa5cacb30ad5529c2cbd477ee19bcf" name="kanidm-docs" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="d9a184a8dd1e96d657d396d961992d3e48edd8bf997be1428c780d7960354f51" name="kanidm-docs" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="621935f9a475bc90d4597e3836fbafdec19fca9243df72950ac9cd00026192a4" name="kanidm-server" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="e8989e0ce10cd101cbd34f30532a99cebdc01dff4a21a11cc5a20c13d8751b7c" name="kanidm-server" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="f987837936b45d97413a8f8dcc15e31b949939aa328acbcc49feded9ff7e7e58" name="kanidm-server-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="adf42ef152802b5dab2c99f09ebc7e8a87e35c349f43f093fc31701cfeab7d24" name="kanidm-server-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="c22951010f8c1b44d8f8316d012c0673fdd6212adeffb0960943c8e7c07d7759" name="kanidm-unixd-clients" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="0604126e611acde572728937bda6ca7a2f02074e915a3964a7f27ca2aa9ddc77" name="kanidm-unixd-clients" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="bf7c0921b4fdff0b3f5e6eef6343aadaf1333515fd23050e82b3951f807ef07e" name="kanidm-unixd-clients-debuginfo" arch="aarch64">
  <version epoch="0" ver="1.10.1~git0.d02660a98" rel="127.1"/>
  <changelog author="william.brown@suse.com" date="1753963200">- Update to version 1.7.0-pre~git0.7d9da9dc8:
  * Release 1.7.0-pre
  * 20250729 pre release (#3756)
  * Helps to enable features like defer spans (#3755)
  * Downgrade notify-debouncer (#3747)
  * Reduce memory usage on unixd (#3754)
  * Bump the all group with 4 updates (#3753)
  * 20250723 application passwords again (#3748)
  * Docs oauth2 examples (#3750)
  * Groups WebUI, modify description (#3734)
  * Improve replication logging (#3746)
  * 20250711 type migrations (#3741)
  * Bump the all group with 3 updates (#3743)
  * Use constants for /etc/shadow and related paths (#3740)
  * fix: don't show people's whole tokens in debugs (#3742)
  * Updates to makefile (#3736)
  * Add a new paragraph in the installation quickstart for installing required client tools, and clarify the client tool setup paragraph (#3735)
  * Bump the all group with 4 updates (#3737)
  * Add ppc64le support for docker images (#3733)
  * Basic interface to get and regenerate the RADIUS password (#3728)
  * book: fix command example in pam_and_nsswitch.md (#3732)
  * fix docgen (#3731)
  * Fix for Failed to deserialize query: missing field 'state' (#3726)
  * Add user facing SCIM pagination / sorting (#3725)
  * Admin UI Group name modification (#3717)
  * fix typo in documentation: tls_path to tls_key (#3727)
  * Pre-validate and extract UAT into ClientAuthInfo (#3714)
  * Security policy updates (re: #3719) (#3722)
  * Fix using wrong template when setting POSIX password (#3719) (#3720)
  * Resolve startup failure with client TLS certificates (#3712)
  * Bump the all group with 2 updates (#3718)
  * Simple group list (#3713)
  * Update repos (#3711)
  * 20250621 application passwords (#3700)
  * Update docs, doc fmt (#3710)
  * Apply review feedback
  * Correctly log connection information
  * Refactor middleware/extractors
  * [htmx] basic profile updating (#2994)
  * Correct 389DS command (#3707)
  * Schema again (#3706)
  * examples: small grammar fix (#3705)
  * Clippy (#3702)
  * 20250627 update hsm crypto (#3701)
  * Update 389 content sync instructions (#3699)
  * Corrections to radius examples (#3697)
  * fix: wording (#3696)
  * Update radius.md (Explain: NAS == Network Access Server) (#3691)
  * updating docs around packages (#3695)
  * 20250618 rustls (#3687)
  * fix: error message that wasn't an error (#3690)
  * Only generate passwords on service accounts (#3688)
  * Add hmac 256 for cryptography operations (#3663)
  * Update Nextcloud example (#3683)
  * Bump the all group with 8 updates (#3684)
  * Allow deferring spans in unixd (#3680)
  * OpenSUSE build fix (#3681)
  * Dark mode improvements (#3660)
  * Add port examples for server.toml (#3679)
  * Fix SCIM filter parser for quoted values with spaces and escaped quotes (#3673)
  * fix: strip comments from UNIX files before parsing (#3674)
  * Bump the all group across 1 directory with 11 updates (#3675)
  * Start to implement SCIM apis (#3535)
  * Fix healthcheck to use ENV for config path (#3656)
  * maint: rewrite crypto Password::try_from (#3637)
  * doc(book): Add  option to Nextcloud Oauth2.0 example (#3654)
  * Bump the all group with 4 updates (#3655)
  * Make it clearer that the http address section is needed (#3652)
  * TODO trimming (#3641)
  * Investigate and reduce memory consumption of unixd (#3645)
  * Swap bytes mut at buffer limits (#3651)
  * Clippy for 1.87 (#3644)
  * fix: Improve unixd &amp; unixd-tasks startup coupling (#3638)
  * Bump the all group with 2 updates (#3648)
  * reload schema before verify (#3643)
  * Defend against split_at panic (#3636)
  * Fix minor issue with untagged version handling (#3634)
  * Move shadow processing out of task event loop (#3631)
  * Dont specify config path in container (#3630)
  * Accept SSHA with different salt lengths (#3629)
  * Bye poetry, hi uv for python things (#3627)
  * Resolve flaw with ssh key parse if the key has no comment (#3628)
  * Indicate that this is an ip list, not a range (#3626)
  * Test for corrupted unicode in SSH keys, keep the key title on error/resubmit (#3618)
  * Reduce replication logging verbosity
  * Bump the all group across 1 directory with 7 updates (#3623)
  * Bump the all group in /pykanidm with 2 updates (#3621)
  * cargo publish (#3613)
  * fix: clippy
  * maint: typo in log message
  * Set kid manually to prevent divergence
  * Order keys in application JWKS / Fix rotation bug
  * Fix toml issues with strings
  * OAuth2 Client ID's should be processed as lowercase (#3605)
  * Resolve reload of oauth2 on startup (#3604)
  * Bump petgraph from 0.7.1 to 0.8.1 in the all group (#3595)
  * Bump the all group in /pykanidm with 2 updates (#3596)
  * Avoid openssl for md4 (#3594)
  * Fixes #3586, inverts the navbar button color (#3593)
  * Update to 1.7.0-dev (#3592)</changelog>
  <changelog author="william.brown@suse.com" date="1754049600">- Update to version 1.7.0~git0.621ac7be0:
  * Release 1.7.0
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)</changelog>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
</package>
<package pkgid="8b06526c9041485d97a393df594e4f46e64b617285a8d4026a1fadc43e04af88" name="kanidm-unixd-clients-debuginfo" arch="x86_64">
  <version epoch="0" ver="1.10.4~git0.97b1edbc4" rel="130.1"/>
  <changelog author="william.brown@suse.com" date="1754481600">- Update to version 1.7.1~git0.130a31d29:
  * Release 1.7.1
  * Update tracing-forest
  * Handle SEC1 private key (#3761)</changelog>
  <changelog author="william.brown@suse.com" date="1755259200">- Update to version 1.7.2~git0.d331ea986:
  * Release 1.7.2
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Break-glass account disable command (#3780)
  * Make it clearer why the user can't login with unixd (#3778)
  * Improve argon2id parameter search speed (#3768)</changelog>
  <changelog author="william.brown@suse.com" date="1755864000">- Update to version 1.7.3~git0.10847190e:
  * Release 1.7.3
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)</changelog>
  <changelog author="william.brown@suse.com" date="1762948800">- Update to version 1.8.0~git0.42d0e864c:
  * Release 1.8.0
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * Release 1.8.0-pre
  * Release Prep (#3938)
  * 20251029 hmac name uniqueness (#3931)
  * sssshhhhh quiet there. (#3906)
  * Add support for proxyv1 (#3935)
  * 20251031 nss sync conn persist (#3921)
  * Improve offline authentication (#3934)
  * 20251005 multiple accept (#3933)
  * Add CSS to support forced-colors on the toggle switch (#3932)
  * Prevent replication certificate renewal deadlock
  * fix: ensure CLI exits with non-zero code on HTTP client errors (#3929)
  * Bump the all group with 5 updates (#3927)
  * 20251015 OIDC auth source (#3905)
  * Bump the all group with 2 updates (#3913)
  * Bump the all group with 2 updates (#3914)
  * Prevent users saving their credentials if there are none (#3805)
  * Fix passkey typos (#3907)
  * fix: Replace letter "d" by sink (#3909)
  * Bump the all group with 33 updates (#3898)
  * Fix: set OAuth2 JTI to session ID  (#3901)
  * Open app links in new tabs (#3899)
  * 20251009 account/group schema changes (#3880)
  * [fix] Mail attribute on service accounts not accessible (#3893)
  * Correct RADIUS API token generation examples (#3890)
  * Foundations of message sending (#3878)
  * 20251010 drop eckeys (#3882)
  * Remove systemd notify-reload. (#3885)
  * Bump the all group with 3 updates (#3884)
  * 20250801 reference entries (#3863)
  * 20251009 3829 OIDC groups (#3879)
  * Bump the all group with 5 updates (#3876)
  * 20251003 im silly (#3874)
  * When no upgrade checks are performed, issue a status: PASS (#3873)
  * Example of ipv4 to ipv6 addr mapping. (#3871)
  * 20250919 csp again (#3856)
  * client_secret_post auth for oauth2 endpoints (#3833)
  * Fix some CLI things (#3870)
  * Bump the all group with 6 updates (#3869)
  * Use connection address for Proxy::Local Requests (#3868)
  * Dont prevalidate UAT on oauth2 routes (#3865)
  * Backup Compression (#3821)
  * fix: always throw error when pam_allowed_login_groups is empty in Kanidm unixd (#3840)
  * update oauth2 outline config example (#3826)
  * Syntax errors in openapi.json (#3859)
  * fix: stop duplicating logs in otel mode (#3704)
  * Update fedora docs, start to add authselect profile (#3806)
  * Document oauth2 shortnames in book (#3857)
  * Bump the all group with 9 updates (#3861)
  * fix: Revert adding fetching ui hints to the reset-credentials flow. (#3831)
  * 20250912 unixd performance (#3846)
  * Fix readme file for better readability (#3775)
  * Updates for rust 1.90 (#3855)
  * Add password check api (#3847)
  * Bump the all group with 3 updates (#3853)
  * Add form-action localhost to csp (#3849)
  * Bump the all group across 1 directory with 8 updates (#3845)
  * Bump actions/setup-python from 5 to 6 in the all group (#3842)
  * docs: Don't enable unixd Kanidm provider in safe default config (#3839)
  * Add yescrypt support (#3844)
  * fix: spelling (#3841)
  * Bump the all group with 2 updates (#3836)
  * Bump tracing-subscriber from 0.3.19 to 0.3.20 in the cargo group (#3832)
  * CLI gardening (#3819)
  * Bump the all group with 7 updates (#3823)
  * Bump actions/upload-pages-artifact from 3 to 4 in the all group (#3824)
  * Prevent memory exhaustion on freebsd builds (#3818)
  * Make it clearer why acceptor isnt available (#3812)
  * Minor: reduce logging verbosity during debug (#3810)
  * Handle IP addresses in replication SAN field (#3811)
  * Update to use the codec properly (#3807)
  * Show the admin page in the navbar when the user has experiment ui hint. (#3793)
  * Bump actions/checkout from 4 to 5 in the all group (#3803)
  * Bump the all group with 5 updates (#3804)
  * Update whatwg email validation regex (#3797)
  * Fix account recover-disable edge case (#3796)
  * Dynamic version for centos/fedora repository (#3794)
  * Resolve replication show-cert issue (#3792)
  * Add json codec wrapper for unix integration (#3789)
  * Break-glass account disable command (#3780)
  * Bump the all group across 1 directory with 11 updates (#3790)
  * Bump slab from 0.4.10 to 0.4.11 in the cargo group (#3788)
  * [webui] add members to group (#3786)
  * Bump actions/download-artifact from 4 to 5 in the all group (#3785)
  * Make it clearer why the user can't login with unixd (#3778)
  * fix: bump HSTS age to 2 years + 1 second (#3779)
  * updating packages (#3774)
  * Improve argon2id parameter search speed (#3768)
  * Improve error messages during server startup to identify failing cert… (#3771)
  * Update docs re PA and google (#3772)
  * Forget username if user no longer wants to be remembered (#3770)
  * 20250802 handle sec1 keys (#3769)
  * Trying to clean up order of operations in kanidm_unixd_tasks (#3762)
  * Bump the all group with 7 updates (#3764)
  * Provide correct access for RADIUS service accounts (#3759)
  * Fix a couple of commands in the OAuth2 Proxy examples (#3758)
  * Design doc for email messaging (#3729)
  * 20250725 unixd access token (#3751)
  * 20250729 dev version (#3757)</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1763035200">- Resolve Leap:15 build issues</changelog>
  <changelog author="william.brown@suse.com" date="1763553600">- Update to version 1.8.1~git0.3d1bdfd13:
  * Release 1.8.1
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)</changelog>
  <changelog author="william.brown@suse.com" date="1764331200">- Update to version 1.8.2~git0.387e2ce61:
  * Release 1.8.2
  * Prevent deprecation warnings affecting release
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Missing constraint on skip upgrade process (#3983)
  * Document the upgrade process through versions. (#3982)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)</changelog>
  <changelog author="william.brown@suse.com" date="1764331201">- Update to version 1.8.3~git0.471c021f2:
  * Release 1.8.3
  * Resolve infinite reauth loop</changelog>
  <changelog author="william.brown@suse.com" date="1765368000">- Update to version 1.8.4~git0.2449805e3:
  * Release 1.8.4
  * Handle concurrent pam sessions. (#4001)
  * fix: correcting parsing of backup compression input (#3995)
  * fixing up docs builds (#4006)</changelog>
  <changelog author="william.brown@suse.com" date="1770724800">- Update to version 1.8.6~git0.268c71d0a:
  * Release 1.8.6
  * Release 1.8.5
  * OAuth2 CSP form-action (#4011)
  * Force webauthn 0.5.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1770724801">- Enable python bindings for the primary python version on newer
  distributions and 3.11 on 15.x</changelog>
  <changelog author="william.brown@suse.com" date="1771329600">- Update to version 1.9.0~git0.2df2bfc4a:
  * Release 1.9.0
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Corrected recycle_bin.md typo (#4135)
  * Set docker tag properly
  * Release "1.9.0-pre"-pre
  * chore: Release Notes (#4129)
  * Update to use hjson (#4128)
  * Python OpenAPI-based internals (#4119)
  * Allow reseting (aka clearing) softlocks (#4111)
  * 20260122 SCIM batch (#4088)
  * Improve upgrade/downgrade testing and checks (#4125)
  * Adding scripts for testing nginx and proxyv1 ldap, updating haproxy-protocol (#4087)
  * Allow extra characters in claim names (#4110)
  * Add ability to backup via stdout (#4114)
  * Remove mozilla webauthn authenticator backend (#4118)
  * 20260205 truncate service acct tokens (#4113)
  * clarify ssh_publickeys oidc claim (#4116)
  * Add note about building client tools locked (#4117)
  * add RFC8693 to features section of the book (#4112)
  * FIX: make tracing-forest stop panic'ing things when enabling otel (#4105)
  * Bump bytes from 1.11.0 to 1.11.1 (#4107)
  * Tweaking rm_if_exist to remove a race condition (#4103)
  * Set `sudo_provider = none` in sssd.conf; Update default value for LDAP_MAXIMUM_QUERYABLE_ATTRIBUTES (#4098)
  * Improve secure origin handling in OAuth2 (#4097)
  * Radius support for SAN-DN (#4094)
  * Bump the all group with 10 updates (#4093)
  * Allow UUID when Name also allowed (#4089)
  * Disallow methods that should not be used (#4083)
  * Prevent panic (#4082)
  * 20260116 kanidmd json mode (#4075)
  * Return http409 on AttrUniqueness error (#4079)
  * Hardening against process errors (#4061)
  * 20260108 sync polish (#4054)
  * Allow overriding css (#4077)
  * Bump the all group with 8 updates (#4078)
  * Support homeDirectory virtual attribute (#4073)
  * Bump the uv group across 2 directories with 3 updates (#4074)
  * Allow invalid passwords to be skipped (#4071)
  * shrinking logo.svg and re-brotli-ing others (#4069)
  * fallback for target_os dependency management in kanidm_tools webauthn-authenticator-rs (#4067)
  * allows service desk to change account validity (#4068)
  * kanidm-ipa-sync aws-lc-rs crypto provider fix (#4065)
  * 20260107 unixd documentation (#4046)
  * Bump the all group with 12 updates (#4059)
  * Bump lru from 0.16.2 to 0.16.3 (#4047)
  * Prevent server crashing on requests with low log level (#4039)
  * Correct rw flag in service account documentation (#4042)
  * Bump rsa from 0.9.9 to 0.9.10 (#4041)
  * Implement OIDC auth for service-accounts (RFC8963) (#4021)
  * 20251219 Uint64/Int64 syntax types (#4022)
  * Bump the all group across 1 directory with 16 updates (#4036)
  * update askama, askama_web to v0.15 (#4030)
  * Bump the all group with 11 updates (#4024)
  * Bump yescrypt from 0.1.0-rc.0 to 0.1.0-rc.1 in the all group (#4017)
  * Bump the all group with 2 updates (#4016)
  * OAuth2 CSP form-action (#4011)
  * Handle concurrent pam sessions. (#4001)
  * Bump the all group with 5 updates (#4005)
  * fix: correcting parsing of backup compression input (#3995)
  * Add a home strategy framework (#3985)
  * Bump the all group with 8 updates (#3996)
  * Resolve infinite reauth loop (#3992)
  * Ignore CredentialTypeMinimum during migrations (#3991)
  * Allow disabling OAuth2 consent prompt (#3972)
  * Report correct client IP in request log (#3990)
  * Ensure that privileged sessions expirations are synced (#3984)
  * Add reference to the Kanidm anthem (#3987)
  * Missing constraint on skip upgrade process (#3983)
  * Changing how we parse environment variables in kanidmd (#3977)
  * Document the upgrade process through versions. (#3982)
  * Bump actions/checkout from 5 to 6 in the all group (#3979)
  * Bump the all group with 8 updates (#3980)
  * lib crypto should not depend on proto (#3975)
  * Change AttributeUniqueness to yield BAD_REQUEST (#3974)
  * fix: kanidm_build_profiles has unwrap which can cause builds to fail (#3973)
  * Small fixes (#3965)
  * Make log messages more verbose for issues with resources server (#3954)
  * unixd_tasks: update home alias symlink conditionally and atomically (#3947)
  * Manually handle form bytes to allow optional encoding (#3968)
  * Improve handling of ready event (#3967)
  * Fix typo in kanidm-ldap-sync (#3964)
  * Bump the all group with 10 updates (#3963)
  * Bump js-yaml (#3957)
  * Bump the all group with 3 updates (#3948)
  * 20251108 lld (#3944)
  * Improve uid/gid overlap message during IAM migration (#3943)
  * 1.9.0-dev (#3939)</changelog>
  <changelog author="william.brown@suse.com" date="1771934400">- Update to version 1.9.1~git0.36055feca:
  * Release 1.9.1
  * 20260220 prevent migration accidents (#4156)
  * Alert on unsaved changes (#4155)
  * Warn about systemd-userdb (#4147)
  * Dont be as upset when migration dir doesnt exist (#4146)</changelog>
  <changelog author="william.brown@suse.com" date="1773403200">- Update to version 1.9.2~git0.6a2bb66bd:
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)</changelog>
  <changelog author="william.brown@suse.com" date="1777550400">- Update to version 1.9.2~git6.896acba35:
  * Release 1.9.3
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Update two vulnerable dependencies</changelog>
  <changelog author="william.brown@suse.com" date="1777550401">- Update to version 1.9.3~git0.7d4108698:
  * Release 1.9.3
  * Security - High: SCIM Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user
  * Security - Moderate: PNG Image validation did not correctly handle short images allowing a panic to occur in a worker thread. This may lead to system instability over time
  * Security - Low: HTML injection via user DisplayName in Passkey enrolment dialogs. This allows an admin to execute JS in the context of a users browser. Since the admin already can reset the users credentials, the impact of this is minimal.
  * Security - Low: non-constant time comparison of OAuth2 client secret may allow a remote attacker to remotely recovery the bytes of the secret. Due to the length of the secret (48 chars) this is infeasible practically.
  * Security - Low: incorrect handling of origin validation in Webauthn-RS allowed a malicious domain to collide with a valid one (badexample.com would match with example.com). This is mitigated by browsers detecting the forgery and preventing the authentication from proceeding.
  * Security - High: LDAP Filters did not contain a bound on their parsing depth allowing stack exhaustion to occur leading to Denial of Service by an unauthenticated user.
  * Update two vulnerable dependencies
  * Release 1.9.2
  * Allow urlencoded client_id in basic auth (#4141)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Remove thread local storage (#4204)</changelog>
  <changelog author="william.brown@suse.com" date="1777636800">- Update to version 1.10.0-pre~git1.32e2f8ec6:
  * Release 1.10.0
  * Release 1.10.0-pre
  * Release notes (#4304)
  * Update ldap3/webauthn-rs (#4302)
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Merge commit from fork
  * Add notes on server migration (#4301)
  * 20260517 sparkle (#4280)
  * Bump mozilla-actions/sccache-action in the all group (#4298)
  * Bump the all group with 6 updates (#4299)
  * Bump the all group across 1 directory with 3 updates (#4283)
  * 20260331 send account recovery emails (#4259)
  * Update oauth2 well known urls (#4296)
  * Clippy for Rust 1.95 (#4291)
  * Invert incorrect thread count logic (#4294)
  * Allow modification of OAuth2 Refresh Expiry (#4276)
  * 20260327 Introspection token auth metadata (#4230)
  * fix: add missing kanidm-mail-sender binary (#4279)
  * Correctly handle deleted accounts during page visits (#4275)
  * don't fail auth when passed ui_locales (#4288)
  * Bump actions/upload-pages-artifact from 4 to 5 in the all group (#4284)
  * Fix link formatting in oauth2.rs documentation (#4278)
  * Feat: Add OIDC Prompt Support (#4224)
  * Handle multivalue URLs in SCIM (#4271)
  * Correctly encode ssh tag values (#4272)
  * Bump the all group with 2 updates (#4263)
  * Bump the all group in /rlm_python with 4 updates (#4262)
  * Bump the all group with 8 updates (#4264)
  * Update deployment.md with configuration notes (#4258)
  * Add .well-known/passkey-endpoints (#4255)
  * show repl cert metadata and also handle socket timeouts (#4252)
  * Update docs regarding replication cert lifetime (#4251)
  * Log cleanup (#4248)
  * adding timeouts and tests and port docs for mail_sender (#4246)
  * Bump the all group with 5 updates (#4247)
  * add dependency data to released containers (#4239)
  * Fix to end code block and render remaining md correctly (#4241)
  * Update readme.md for replication (#4236)
  * Added note on primary email address and email aliases (#4237)
  * Bump the all group with 6 updates (#4235)
  * Bump the all group with 2 updates (#4234)
  * Bump the uv group across 1 directory with 2 updates (#4231)
  * cli: allow clearing person's legalname attribute (#4228)
  * Add shell diagnostics (#4220)
  * OpenSSL shall be vanquished (#4219)
  * Bump the all group across 1 directory with 16 updates (#4225)
  * Bump rustls-webpki from 0.103.9 to 0.103.10 (#4223)
  * Bump flatted (#4222)
  * Tabular data is tabular (#4221)
  * Example sshd-config fragment, deployment de-activated on Debian (#4214)
  * Update RELEASE_NOTES.md (#4215)
  * fix(debian): Use correct bin path for kanidmd reload (#4212)
  * Allow urlencoded client_id in basic auth (#4141)
  * add nsswitch config check to unixd (#4210)
  * 20260311 zxcvbn check (#4206)
  * Enhance Traefik documentation (#4194)
  * Re-add incorrectly removed utopia feature flag (#4207)
  * Update ldap3 to 0.7.0 to resolve config filter issue (#4205)
  * Added PasswordChangedTime attribute and database field (#3999)
  * Defer on some routes (#4202)
  * Remove thread local storage (#4204)
  * Improve FreeBSD building, fully drop ring as a dependency.
  * 20260218 credential reset emails (authenticated only) (#4151)
  * android support for cli (#4197)
  * Bump the all group with 4 updates (#4198)
  * Bump the all group with 7 updates (#4199)
  * feat: bind mount home strategy (#3997)
  * Bump the all group with 2 updates (#4183)
  * Bump the all group with 8 updates (#4184)
  * Bump minimatch (#4180)
  * Disable multithreading on RADIUS when DEBUG is False. (#4177)
  * Don't revert admin changes in some groups during migrcation (#4176)
  * Fix bug where DEBUG is always true in RADIUS entrypoint. (#4169)
  * 20260220 prevent migration accidents (#4156)
  * Bump the all group across 1 directory with 20 updates (#4163)
  * Move the grafana group creation step (#4160)
  * Alert on unsaved changes (#4155)
  * pykanidm v1.3.0 - major rewrite to use openapi-generated codebase based on 1.9.0 spec (#4149)
  * Warn about systemd-userdb (#4147)
  * Dont require basic auth on token introspection (#4142)
  * Dont be as upset when migration dir doesnt exist (#4146)
  * Add AGENTS.md instructions (#4148)
  * Feature OIDC updated at (#4007)
  * pykanidm: clarify token use with service accounts (#4043)
  * Fixed small typo in how_does_oauth2_work.md (#4138)
  * Bye bye lazy static (#4134)
  * Allow LDAP CA verification to be disabled in sync (#4133)
  * Add oauth2 example, fix inter-migration reference handling (#4136)
  * Add missing future migration in domain check (#4132)
  * Corrected recycle_bin.md typo (#4135)
  * 20260211 dev version (#4131)</changelog>
  <changelog author="william.brown@suse.com" date="1778155200">- Update to version 1.10.1~git0.d02660a98:
  * Release 1.10.1
  * Fix copy in TOTP removal prompt and align TOTP case (#4314)
  * Resolve base64 encoding of webauthn fields (#4312)</changelog>
  <changelog author="william.brown@suse.com" date="1778760000">- Update to version 1.10.2~git0.f3dc9ef1f:
  * Release 1.10.2
  * Security - CRITICAL - authenticated user privilege escalation
  * Refactor modification access paths to remove duplication
  * Revert ClientID header (#4334)
  * Disable prompt=login (#4340)
  * Add missing `/sbin/kanidm-mail-sender` (#4323)
  * Remove debug symbols in release builds. (#4319)</changelog>
  <changelog author="william.brown@suse.com" date="1782216000">- Update to version 1.10.4~git0.97b1edbc4:
  * Release 1.10.4
  * Clippy
  * Update ldap3_lber to 0.8.0
  * Avoid LSE instructions in arm64 Linux builds (#4372)
  * Release 1.10.3
  * Resolve incorrect login in commited flag
  * Prevent migration double-deletes</changelog>
</package>
<package pkgid="a2aa5edfd149a903e82e96c522c9b0b9c265290ab940ef1733a0b9b1ef346b9d" name="libsso-mib-devel" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="aee12282493eeef7b2a2777f0450ed0f07244bc0d73af98f52ae317dbef3e871" name="libsso-mib-devel" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="dc1c7173bf022249cab75315fffe222439314e0a2311130fb419077234106df4" name="libsso-mib0" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="9c899a6305e7e4a9e0945f98d090ab46d28d481d48eb5396ffe0f1e47f6a2561" name="libsso-mib0" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="f1ce10c1f7b9cecf6c83ec63bc3910ff679e252dad68eb57af57b7d212cb2036" name="libsso-mib0-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="e0b6f0c4cb5e46a814a78247a1929e06cfee3a182607ad4e1d79b3dafd013b96" name="libsso-mib0-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="a6402503d8800ec28457870403823b4a6f9d0e4d354576dcb41939a6e1a65b6c" name="sso-mib" arch="src">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="43f6849a334295b6cd17f351cefc73779cc05ea5dc8d732cdf7444a764610372" name="sso-mib" arch="src">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="9e7d8cb4d507c62c839adafb4d7736739f747fe934fc0c040c7270b465ba5cfc" name="sso-mib-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="5470a1d7cc56505c100352d598ff33778529857f75bc47dd3f119c111334069c" name="sso-mib-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="ac10540323987d8ce477935197031ee168a10db62e53e60dd9632abefebcad40" name="sso-mib-debugsource" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="a0d4a56b0920c64f1d567a28987c4a65dbe5701b7b63ec8f9ee1deef01d3351e" name="sso-mib-debugsource" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="a914764cc7500cbe884dca00f11acc9396efe23409b050355fdf23f4e02bdb76" name="sso-mib-gch-smtp-o365" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="7be520e49708a44218cc9fddbf0095764b689ce18ea6491291e0af2dadf06b85" name="sso-mib-gch-smtp-o365" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="39517740bc7bef20e4335b3ac623f7046ae8fba0c43c067fe258635c6b746fab" name="sso-mib-gch-smtp-o365-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="7d7df6939b5c9124eaa0f607fc13450dfbbd9af2d0dae1569415c12548d79c5a" name="sso-mib-gch-smtp-o365-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="96c628f75d84a3eb1e7f86b9f4d7f3070763ab0f7d161232ba2ef5b27df10166" name="sso-mib-tool" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="73c111d339c1711f9346f1f434a72b8e342ea99a5733ba0b843a0fc0ff153705" name="sso-mib-tool" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
<package pkgid="eceedd7a57172ce615f1f1d739141eda6c34d30829f69f0e82b1f3290e238dda" name="sso-mib-tool-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="8.1"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1783080000">- Import version 0.10.0
  This release adds an async API for all functions that communicate
  via DBus. The API is modeled similar to gdbus. Manpages for tools
  are also now provided.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1784894400">- Import version 0.10.1
  Fix bug to avoid activating broker on app creation</changelog>
</package>
<package pkgid="6c9d1c72bf3da1373bbb912c377f872c2d1b4afb8c06d39b0dadcfd7fa5cef5e" name="sso-mib-tool-debuginfo" arch="aarch64">
  <version epoch="0" ver="0.9.0" rel="5.2"/>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1772971200">- Import version 0.7.0</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1773748800">- Import version 0.8.0
  This release adds support for v2.0.2+ MSFT broker versions and adds
  JSON output for sso-mib-tool commands. Along that, many minor bugs
  in the library have been fixed.</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1776945600">- Import version 0.8.1
  This bugfix release hardens the codebase against various kinds of
  errors</changelog>
  <changelog author="Luca Boccassi &lt;luca.boccassi@gmail.com&gt;" date="1778155200">- Import version 0.9.0
  This bugfix release fixes building without libjwt and implements
  asking for consent if needed when acquiring a token</changelog>
</package>
</otherdata>