[
  {
    "category": "Authentication",
    "description": "Single sign-on for Jellyfin via OpenID Connect and SAML 2.0 - works with self-hosted and\nmanaged identity providers such as Authelia, Authentik, Keycloak, Pocket ID and Kanidm,\nwith multiple providers side by side.\nRole-based access from provider claims (login, administrator, library folders, Live TV),\navatar sync, self-service account linking, and an optional SSO-only mode that disables\npassword login for every account except a designated break-glass admin.\nSign-in works in the Jellyfin Web UI and, via Quick Connect, in native clients.\nA security-first continuation of the archived 9p4/jellyfin-plugin-sso.\nDocumentation and provider setup guides: https://github.com/iderex/jellyfin-plugin-sso\n",
    "guid": "505ce9d1-d916-42fa-86ca-673ef241d7df",
    "imageUrl": "https://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/main/img/logo.png",
    "name": "Community SSO for Jellyfin",
    "overview": "Sign in to Jellyfin through OpenID Connect or SAML 2.0 identity providers.",
    "owner": "iderex",
    "versions": [
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.47).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Refuse a token that vouches for its own signing key, and prove the rows bite by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1334\n* Read the discovery facts with the parser family the screen walks by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1335\n* Refuse an advertised symmetric key, and show which control refuses it by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1336\n* Report both release lines on the README badge by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1337\n* Ship the OpenVEX document on every release leg by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1338\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.32...5.0.0-JF12-beta.47",
        "checksum": "cffb99a3aab17a9fecb9167b1d327cea",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.47/community-sso-for-jellyfin_5.0.0.47.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-13T05:49:59Z",
        "version": "5.0.0.47"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.46).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Add a relogin-only harness pass that reuses an initialised Jellyfin by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1326\n* Refuse a JWT that declares itself a token for the other endpoint by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1327\n* Unpack the archive the documented local build actually writes by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1331\n* Screen the role claim in the scopes its reader enters by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1332\n* Gate the legacy plaintext secret migration with a scripted phase by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1333\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.31...5.0.0-JF12-beta.46",
        "checksum": "c91cc8f238bb0e614368c2fd61a659e6",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.46/community-sso-for-jellyfin_5.0.0.46.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-12T05:47:37Z",
        "version": "5.0.0.46"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.45).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Pin the request body to one reader, and refuse a second [#1033] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1322\n* Measure what refusing an unreadable role claim would cost [#1053] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1323\n* Measure and gate branch coverage on the security surface by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1325\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.30...5.0.0-JF12-beta.45",
        "checksum": "5e339a1d158dccc11f5d5b539cc985f4",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.45/community-sso-for-jellyfin_5.0.0.45.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-11T05:20:23Z",
        "version": "5.0.0.45"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.44).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Measure the login latency on a pinned runner and archive the run by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1310\n* Assert the parse surface's post-conditions under the fuzzer by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1311\n* Replace the typographic dashes in this tree by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1309\n* Derive the browser-bound authorize value's route set and classify every leg by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1312\n* Pin the canonical name to one ordinal comparison on every route it arrives on by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1313\n* Derive the test root once, and pin the walk's own duplicate decision by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1315\n* Add the JWE and nested-JWT rows to the id_token forgery battery by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1316\n* Follow the organisation default for the sponsor button (#1318) by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1319\n* Report a Jellyfin account's SSO posture in one elevation-gated read by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1320\n* Export the account-link table as a username-keyed document by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1321\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.29...5.0.0-JF12-beta.44",
        "checksum": "295972e949a5eabe46257dc9a30eb6a3",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.44/community-sso-for-jellyfin_5.0.0.44.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-10T05:44:01Z",
        "version": "5.0.0.44"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.43).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Add a roles fuzz target and seed its repeated-key grammar [#1158] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1291\n* Name the screened discovery refusal in Test connection [#1064] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1293\n* Bound the provider-authored text in the discovery read's warning [#1194] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1294\n* Refuse the roles when two copies of the role claim disagree [#1040] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1295\n* Refuse a token whose JWS header marks an extension critical [#1038] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1296\n* Pin that a repeated scalar aud collapses to the last occurrence [#1193] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1297\n* Prove the non-parallel-collection rule can go red [#1173] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1298\n* Fold the untrusted-JSON rule into the conformance home [#1037] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1299\n* Retry the logout discovery read inside a stated budget [#1183] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1300\n* Audit a refused role claim with its reason and never its value [#1149] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1301\n* Rewrite the em dash out of the admin page and the translation surface by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1302\n* Pin the OIDC redirect_uri to one builder over one canonical base by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1304\n* Pin the OpenID validation basis to one file and one algorithm set by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1305\n* Name each logout_token refusal instead of collapsing eleven into one by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1306\n* Name the repeated member in the refusal entry, neutralised at the log call [#1195] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1307\n* Build every OpenID client with its discovery metadata already set [#1067] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1308\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.28...5.0.0-JF12-beta.43",
        "checksum": "7f2d7150fb8141834760d7138d231c71",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.43/community-sso-for-jellyfin_5.0.0.43.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-09T05:16:45Z",
        "version": "5.0.0.43"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.42).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Measure the repeated-member walk against a second parser [#1188] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1279\n* Say that this plugin belongs to Flowfin by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1282\n* Classify every provider-named entry point as gated or exempt [#1160] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1275\n* Audit a logout that did not happen apart from a logout that was refused [#1184] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1274\n* Pin which element the three id_token readers take from a multi-valued claim [#1268] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1273\n* Prove which content-read arm the discovery screen can actually reach [#1196] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1272\n* Raise both CodeQL action steps together, and keep them together by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1284\n* Replace the generated artwork with the project's own mark by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1287\n* Name the organisation as the plugin owner by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1286\n* Derive the beta repository URL instead of writing the old owner into it by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1288\n* Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1257\n* Derive the SPDX rule's root set from the project files [#1270] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1276\n* Add the in-process OpenID login-latency bench harness [#1117] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1269\n* Pin what every id_token read route does with a repeated member [#1192] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1267\n* Give the social preview the same layout as the other eleven by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1289\n* Say how far sign-in actually reaches by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1290\n* Derive the process-wide door set for the non-parallel rule [#1171] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1271\n* Signpost the Discussions Q&A channel from the README [#1111] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1232\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.27...5.0.0-JF12-beta.42",
        "checksum": "13571e8beec22ddbfa9a2a76cdf7a0bc",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.42/community-sso-for-jellyfin_5.0.0.42.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-08T05:10:00Z",
        "version": "5.0.0.42"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.41).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Have the logout validator derive its own validation basis [#1176] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1261\n* Derive the HTTP entry-point surface by reflection [#1159] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1262\n* Close the base-class route around the file-local test scans by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1263\n* Pin the duplicate-key posture at the screened discovery seam by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1264\n* Read one comment-form list from both conformance scans by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1226\n* Refuse commit-message characters outside an explicit set [#1006] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1265\n* Settle and date the publish-closure artifact before reading it [#1072] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1266\n* Hold every plugin JSON parse site to a declared table [#1187] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1277\n* Pin the SAML ACS URL to one composition site [#1163] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1278\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.26...5.0.0-JF12-beta.41",
        "checksum": "2d13bfa62c3a78ec00f03c63622c9395",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.41/community-sso-for-jellyfin_5.0.0.41.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-07T05:51:19Z",
        "version": "5.0.0.41"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.40).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Skip the PR-hygiene fail tier for authors outside the repository [#1207] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1228\n* Build the fuzz harness in the gating PR job by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1229\n* Record why the id_token error string carries no per-shape codes by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1230\n* Decide and pin the JWKS-side kid posture: advertised keys are not screened [#1029] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1231\n* Admit a case-variant member repeat, and pin the decision [#1191] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1234\n* Refuse an invalid escape rather than folding two names into one [#1197] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1236\n* Pin that the code flow sends no nonce, and bind the code with PKCE [#1157] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1239\n* Report a lockfile a local build rewrote, at the moment it happens [#1150] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1237\n* Read a redirect parameter through one helper in the test project [#1046] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1240\n* Pin that a forwarded header never moves the rate-limit bucket [#1035] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1241\n* Carry an OpenVEX document and refuse a malformed edit to it [#1092] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1242\n* Document the translation flow and what ships today [#1155] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1243\n* State how a triaged advisory becomes a published VEX statement [#1094] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1244\n* Add the intended-use notice by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1246\n* Read both discovery facts out of one parse [#1170] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1248\n* Fuzz the provider key set, and seed it with a repeated kid [#1156] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1250\n* Pin the JWKS side of the kid allowlist as a set-level contract [#1168] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1251\n* Replay the committed fuzz seeds in the gating build [#1134] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1252\n* Give the file-writing tests a directory the suite owns [#1218] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1253\n* Correct the Dependabot cooldown rationale for action bumps [#1055] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1254\n* Refuse a degenerate multi-segment token instead of raising out of the reader [#1249] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1258\n* Cap provider response bodies at the shared outbound HTTP seam [#1169] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1259\n* Skip the LAN-binding tests on Windows so the suite runs unelevated [#1227] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1260\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.25...5.0.0-JF12-beta.40",
        "checksum": "9721803ebd50579fa9fd9e8740c27177",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.40/community-sso-for-jellyfin_5.0.0.40.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-06T06:43:36Z",
        "version": "5.0.0.40"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.39).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* The em dash leaves the source and the infrastructure, and one marker literal stays [#1202] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1203\n* Refuse a provider response that names a JSON member twice, before the library resolves it by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1065\n* Run the wiki lint on every push to main [#1151] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1206\n* Allow an OIDC provider on a private network, per provider and opt-in [#1058] by @teekennedy in https://github.com/iderex/jellyfin-plugin-sso/pull/1205\n* Derive the failure alert's watched set instead of listing it by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1208\n* Bound the post-logout return URL at a path segment boundary by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1209\n* Prove the SAML Recipient and Destination binding refuses near misses [#1182] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1211\n* Stop two workflow headers asserting a required-check set they get wrong by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1213\n* Declare the solution file's line endings in .gitattributes [#1080] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1212\n* Express the comment-exclusion rule once in the conformance tests [#1124] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1215\n* Localize the three unsubstituted template placeholders in the config page by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1216\n* Seed the discovery and idtoken fuzz corpora with repeated property names by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1217\n* Read the call-site presence scan off code lines, not raw file text [#1122] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1219\n* Freeze the OpenID signature-algorithm allowlist [#1190] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1220\n* Refuse a token-header kid outside the unreserved set before key lookup by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1221\n* Make the documented Prettier command honest on a Windows checkout [#1066] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1222\n* Classify why the role-claim walk produced no roles by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1223\n* Record that the OIDC redirect_uri builder only emits, never compares [#1180] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1224\n* Resolve wiki source links against the git index, not the filesystem [#1152] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1225\n\n## New Contributors\n* @teekennedy made their first contribution in https://github.com/iderex/jellyfin-plugin-sso/pull/1205\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.24...5.0.0-JF12-beta.39",
        "checksum": "f192b54d2fb3f591b7cb452e314fa614",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.39/community-sso-for-jellyfin_5.0.0.39.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-05T06:40:17Z",
        "version": "5.0.0.39"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.38).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Add the per-object-scope repeated-member walk by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1071\n* Move every codeql-action pin to v4.37.3 in one step by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1198\n* Bump scorecard-action to v2.4.4 off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1200\n* Bump setup-uv to v9.0.0 off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1201\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.16...5.0.0-JF12-beta.38",
        "checksum": "de3192141055c0b32cd73b1cc5f53be7",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.38/community-sso-for-jellyfin_5.0.0.38.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-08-04T06:40:00Z",
        "version": "5.0.0.38"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.30).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Move every codeql-action pin to v4.37.1 in one step by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1026\n* Bump the checkout and setup-dotnet pins off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1028\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.15...5.0.0-JF12-beta.30",
        "checksum": "400c789fc832dbf84458531781a18880",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.30/community-sso-for-jellyfin_5.0.0.30.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-07-27T07:45:49Z",
        "version": "5.0.0.30"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.29).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Localize the OIDC editor labels and descriptions [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1007\n* Lock the SAML signature path to one XML stack and cover the 2025 wrapping vectors by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1010\n* Require a reproduction artifact before a lens finding is fix-required by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1017\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.14...5.0.0-JF12-beta.29",
        "checksum": "465428fd4c7df62013a90ead5fad0ec9",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.29/community-sso-for-jellyfin_5.0.0.29.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-07-26T06:48:01Z",
        "version": "5.0.0.29"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.28).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Cover the back-channel logout discovery fail-closed branches by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/985\n* Move internal docs local by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/988\n* Slim the README to a lean start by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/989\n* Strengthen the README AI-assistance disclosure by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/992\n* Alert on failed scheduled publish + check manifest freshness by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/990\n* Add a config-page screenshot to the README by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/993\n* Remove the README config screenshot; fix stale internal-doc links by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/994\n* Promote to Release Candidate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/996\n* Add a served-surface string localizer with the English baseline catalog [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/997\n* Resolve the served-page culture from Accept-Language [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/998\n* Localize the auth-completion page chrome [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/999\n* Localize the login rejection messages on the browser error page [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1000\n* Add client-side UI localization and wire the linking page [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1001\n* Localize the configuration page chrome [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1002\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.13...5.0.0-JF12-beta.28",
        "checksum": "0a6c2eeccc11a011d63e73ba9ae02d98",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.28/community-sso-for-jellyfin_5.0.0.28.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-07-25T06:30:14Z",
        "version": "5.0.0.28"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.27).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Validate id_token auth_time against max_age; fail closed by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/972\n* Add OIDC back-channel logout (logout_token validation + endpoint) by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/973\n* Add opt-in login-time deprovisioning on role-denied SSO logins by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/975\n* Read the manifest via jq --rawfile so the beta publish survives arg-length growth by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/979\n* Publish the newest JF11 beta as the repo's Latest release by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/981\n* Add a changelog entry for the managed login-page buttons by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/983\n* Add the SAML deprovision-off parity test by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/984\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.12...5.0.0-JF12-beta.27",
        "checksum": "b50c90f45b4e41dae1babc42086e7fbb",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.27/community-sso-for-jellyfin_5.0.0.27.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-07-24T06:38:19Z",
        "version": "5.0.0.27"
      },
      {
        "changelog": "Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.26).\nInstall via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\nScope note (#743): the JF12/5.0 line is **not validated against a live Jellyfin 12.0 server yet** — no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.\n\n\n## What's Changed\n* Treat whitespace-only SAML roles as blank in the login allow-list by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/957\n* Add a manifest-only regeneration dispatch as a recovery path by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/958\n* Bound the checksum-sidecar fetches to the entries that survive the cap by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/959\n* Resurrect the Stryker mutation gate via a VSTest twin project by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/960\n* Split the mutation run into three parallel scope legs by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/963\n* Pin every SsoAudit emission: shape, level, CRLF-strip, emission points by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/964\n* Make a forgotten rate-limit gate a red build; pin the 429 shapes by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/965\n* Exercise the PAR-enabled challenge path — the untested production default by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/966\n* Test the login-button hosted service and pin the SAML hostile-name route by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/967\n* E2E: stable-binding relogin, admin-policy asserts, SSO-only round-trip by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/968\n* Close the four small unit holes from the coverage audit by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/969\n* Exercise the SSRF connect guard at the real socket layer by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/970\n* E2E: exercise SAML metadata import/SP-metadata, assert secrets-at-rest + audit by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/971\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/5.0.0-JF12-beta.25...5.0.0-JF12-beta.26",
        "checksum": "8a17d3a63aa08be2881c39e7a22386c5",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/5.0.0-JF12-beta.26/community-sso-for-jellyfin_5.0.0.26.zip",
        "targetAbi": "12.0.0.0",
        "timestamp": "2026-07-23T06:40:22Z",
        "version": "5.0.0.26"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.33).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Refuse a token that vouches for its own signing key, and prove the rows bite by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1334\n* Read the discovery facts with the parser family the screen walks by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1335\n* Refuse an advertised symmetric key, and show which control refuses it by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1336\n* Report both release lines on the README badge by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1337\n* Ship the OpenVEX document on every release leg by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1338\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.32...4.3.0-beta.33",
        "checksum": "b12ba15206f33a62a3a1efbf0dac249f",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.33/community-sso-for-jellyfin_4.3.0.33.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-13T05:46:53Z",
        "version": "4.3.0.33"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.32).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Add a relogin-only harness pass that reuses an initialised Jellyfin by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1326\n* Refuse a JWT that declares itself a token for the other endpoint by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1327\n* Unpack the archive the documented local build actually writes by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1331\n* Screen the role claim in the scopes its reader enters by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1332\n* Gate the legacy plaintext secret migration with a scripted phase by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1333\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.31...4.3.0-beta.32",
        "checksum": "dc2a36e534a864edf6b31e3f74513252",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.32/community-sso-for-jellyfin_4.3.0.32.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-12T05:44:52Z",
        "version": "4.3.0.32"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.31).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Pin the request body to one reader, and refuse a second [#1033] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1322\n* Measure what refusing an unreadable role claim would cost [#1053] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1323\n* Measure and gate branch coverage on the security surface by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1325\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.30...4.3.0-beta.31",
        "checksum": "52c2e9fde7478b938735d44a80a196ff",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.31/community-sso-for-jellyfin_4.3.0.31.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-11T05:17:47Z",
        "version": "4.3.0.31"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.30).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Measure the login latency on a pinned runner and archive the run by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1310\n* Assert the parse surface's post-conditions under the fuzzer by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1311\n* Replace the typographic dashes in this tree by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1309\n* Derive the browser-bound authorize value's route set and classify every leg by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1312\n* Pin the canonical name to one ordinal comparison on every route it arrives on by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1313\n* Derive the test root once, and pin the walk's own duplicate decision by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1315\n* Add the JWE and nested-JWT rows to the id_token forgery battery by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1316\n* Follow the organisation default for the sponsor button (#1318) by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1319\n* Report a Jellyfin account's SSO posture in one elevation-gated read by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1320\n* Export the account-link table as a username-keyed document by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1321\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.29...4.3.0-beta.30",
        "checksum": "f4fa2402b74d66b5df8561500ed4c575",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.30/community-sso-for-jellyfin_4.3.0.30.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-10T05:41:05Z",
        "version": "4.3.0.30"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.29).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Add a roles fuzz target and seed its repeated-key grammar [#1158] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1291\n* Name the screened discovery refusal in Test connection [#1064] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1293\n* Bound the provider-authored text in the discovery read's warning [#1194] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1294\n* Refuse the roles when two copies of the role claim disagree [#1040] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1295\n* Refuse a token whose JWS header marks an extension critical [#1038] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1296\n* Pin that a repeated scalar aud collapses to the last occurrence [#1193] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1297\n* Prove the non-parallel-collection rule can go red [#1173] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1298\n* Fold the untrusted-JSON rule into the conformance home [#1037] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1299\n* Retry the logout discovery read inside a stated budget [#1183] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1300\n* Audit a refused role claim with its reason and never its value [#1149] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1301\n* Rewrite the em dash out of the admin page and the translation surface by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1302\n* Pin the OIDC redirect_uri to one builder over one canonical base by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1304\n* Pin the OpenID validation basis to one file and one algorithm set by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1305\n* Name each logout_token refusal instead of collapsing eleven into one by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1306\n* Name the repeated member in the refusal entry, neutralised at the log call [#1195] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1307\n* Build every OpenID client with its discovery metadata already set [#1067] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1308\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.28...4.3.0-beta.29",
        "checksum": "68f3635b4529acaba5e67907228282d0",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.29/community-sso-for-jellyfin_4.3.0.29.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-09T05:14:10Z",
        "version": "4.3.0.29"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.28).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Measure the repeated-member walk against a second parser [#1188] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1279\n* Say that this plugin belongs to Flowfin by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1282\n* Classify every provider-named entry point as gated or exempt [#1160] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1275\n* Audit a logout that did not happen apart from a logout that was refused [#1184] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1274\n* Pin which element the three id_token readers take from a multi-valued claim [#1268] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1273\n* Prove which content-read arm the discovery screen can actually reach [#1196] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1272\n* Raise both CodeQL action steps together, and keep them together by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1284\n* Replace the generated artwork with the project's own mark by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1287\n* Name the organisation as the plugin owner by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1286\n* Derive the beta repository URL instead of writing the old owner into it by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1288\n* Bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 by @dependabot[bot] in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1257\n* Derive the SPDX rule's root set from the project files [#1270] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1276\n* Add the in-process OpenID login-latency bench harness [#1117] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1269\n* Pin what every id_token read route does with a repeated member [#1192] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1267\n* Give the social preview the same layout as the other eleven by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1289\n* Say how far sign-in actually reaches by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1290\n* Derive the process-wide door set for the non-parallel rule [#1171] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1271\n* Signpost the Discussions Q&A channel from the README [#1111] by @iderex in https://github.com/Flowfin/jellyfin-plugin-sso/pull/1232\n\n\n**Full Changelog**: https://github.com/Flowfin/jellyfin-plugin-sso/compare/4.3.0-beta.27...4.3.0-beta.28",
        "checksum": "be61dfe1e2b9101cd5c27169d4be8361",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.28/community-sso-for-jellyfin_4.3.0.28.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-08T05:07:17Z",
        "version": "4.3.0.28"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.27).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Have the logout validator derive its own validation basis [#1176] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1261\n* Derive the HTTP entry-point surface by reflection [#1159] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1262\n* Close the base-class route around the file-local test scans by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1263\n* Pin the duplicate-key posture at the screened discovery seam by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1264\n* Read one comment-form list from both conformance scans by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1226\n* Refuse commit-message characters outside an explicit set [#1006] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1265\n* Settle and date the publish-closure artifact before reading it [#1072] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1266\n* Hold every plugin JSON parse site to a declared table [#1187] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1277\n* Pin the SAML ACS URL to one composition site [#1163] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1278\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.26...4.3.0-beta.27",
        "checksum": "c2b9ab45ca368b55ecd88527df302302",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.27/community-sso-for-jellyfin_4.3.0.27.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-07T05:48:50Z",
        "version": "4.3.0.27"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.26).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Skip the PR-hygiene fail tier for authors outside the repository [#1207] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1228\n* Build the fuzz harness in the gating PR job by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1229\n* Record why the id_token error string carries no per-shape codes by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1230\n* Decide and pin the JWKS-side kid posture: advertised keys are not screened [#1029] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1231\n* Admit a case-variant member repeat, and pin the decision [#1191] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1234\n* Refuse an invalid escape rather than folding two names into one [#1197] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1236\n* Pin that the code flow sends no nonce, and bind the code with PKCE [#1157] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1239\n* Report a lockfile a local build rewrote, at the moment it happens [#1150] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1237\n* Read a redirect parameter through one helper in the test project [#1046] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1240\n* Pin that a forwarded header never moves the rate-limit bucket [#1035] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1241\n* Carry an OpenVEX document and refuse a malformed edit to it [#1092] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1242\n* Document the translation flow and what ships today [#1155] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1243\n* State how a triaged advisory becomes a published VEX statement [#1094] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1244\n* Add the intended-use notice by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1246\n* Read both discovery facts out of one parse [#1170] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1248\n* Fuzz the provider key set, and seed it with a repeated kid [#1156] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1250\n* Pin the JWKS side of the kid allowlist as a set-level contract [#1168] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1251\n* Replay the committed fuzz seeds in the gating build [#1134] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1252\n* Give the file-writing tests a directory the suite owns [#1218] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1253\n* Correct the Dependabot cooldown rationale for action bumps [#1055] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1254\n* Refuse a degenerate multi-segment token instead of raising out of the reader [#1249] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1258\n* Cap provider response bodies at the shared outbound HTTP seam [#1169] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1259\n* Skip the LAN-binding tests on Windows so the suite runs unelevated [#1227] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1260\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.25...4.3.0-beta.26",
        "checksum": "9a7ca86815050ec79dc26025f2c4440b",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.26/community-sso-for-jellyfin_4.3.0.26.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-06T06:41:05Z",
        "version": "4.3.0.26"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.25).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* The em dash leaves the source and the infrastructure, and one marker literal stays [#1202] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1203\n* Refuse a provider response that names a JSON member twice, before the library resolves it by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1065\n* Run the wiki lint on every push to main [#1151] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1206\n* Allow an OIDC provider on a private network, per provider and opt-in [#1058] by @teekennedy in https://github.com/iderex/jellyfin-plugin-sso/pull/1205\n* Derive the failure alert's watched set instead of listing it by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1208\n* Bound the post-logout return URL at a path segment boundary by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1209\n* Prove the SAML Recipient and Destination binding refuses near misses [#1182] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1211\n* Stop two workflow headers asserting a required-check set they get wrong by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1213\n* Declare the solution file's line endings in .gitattributes [#1080] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1212\n* Express the comment-exclusion rule once in the conformance tests [#1124] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1215\n* Localize the three unsubstituted template placeholders in the config page by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1216\n* Seed the discovery and idtoken fuzz corpora with repeated property names by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1217\n* Read the call-site presence scan off code lines, not raw file text [#1122] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1219\n* Freeze the OpenID signature-algorithm allowlist [#1190] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1220\n* Refuse a token-header kid outside the unreserved set before key lookup by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1221\n* Make the documented Prettier command honest on a Windows checkout [#1066] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1222\n* Classify why the role-claim walk produced no roles by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1223\n* Record that the OIDC redirect_uri builder only emits, never compares [#1180] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1224\n* Resolve wiki source links against the git index, not the filesystem [#1152] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1225\n\n## New Contributors\n* @teekennedy made their first contribution in https://github.com/iderex/jellyfin-plugin-sso/pull/1205\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.24...4.3.0-beta.25",
        "checksum": "92f8471c2fbabf5d54a7c913b6165084",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.25/community-sso-for-jellyfin_4.3.0.25.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-05T06:37:44Z",
        "version": "4.3.0.25"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.24).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Add the per-object-scope repeated-member walk by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1071\n* Move every codeql-action pin to v4.37.3 in one step by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1198\n* Bump scorecard-action to v2.4.4 off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1200\n* Bump setup-uv to v9.0.0 off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1201\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.16...4.3.0-beta.24",
        "checksum": "60eccdc00f9db61d067275292fdfde3c",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.24/community-sso-for-jellyfin_4.3.0.24.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-08-04T06:37:10Z",
        "version": "4.3.0.24"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.16).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Move every codeql-action pin to v4.37.1 in one step by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1026\n* Bump the checkout and setup-dotnet pins off a branch that can gate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1028\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.15...4.3.0-beta.16",
        "checksum": "4dcfaabbc196e4e263cd753c832f9964",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.16/community-sso-for-jellyfin_4.3.0.16.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-07-27T07:43:09Z",
        "version": "4.3.0.16"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.15).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Localize the OIDC editor labels and descriptions [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1007\n* Lock the SAML signature path to one XML stack and cover the 2025 wrapping vectors by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1010\n* Require a reproduction artifact before a lens finding is fix-required by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1017\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.14...4.3.0-beta.15",
        "checksum": "77776c84a99da2217113e980ea603bef",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.15/community-sso-for-jellyfin_4.3.0.15.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-07-26T06:45:30Z",
        "version": "4.3.0.15"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.14).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Cover the back-channel logout discovery fail-closed branches by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/985\n* Move internal docs local by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/988\n* Slim the README to a lean start by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/989\n* Strengthen the README AI-assistance disclosure by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/992\n* Alert on failed scheduled publish + check manifest freshness by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/990\n* Add a config-page screenshot to the README by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/993\n* Remove the README config screenshot; fix stale internal-doc links by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/994\n* Promote to Release Candidate by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/996\n* Add a served-surface string localizer with the English baseline catalog [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/997\n* Resolve the served-page culture from Accept-Language [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/998\n* Localize the auth-completion page chrome [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/999\n* Localize the login rejection messages on the browser error page [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1000\n* Add client-side UI localization and wire the linking page [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1001\n* Localize the configuration page chrome [#913] by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/1002\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.13...4.3.0-beta.14",
        "checksum": "6e474bfa602d0586cb78b51403f03edc",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.14/community-sso-for-jellyfin_4.3.0.14.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-07-25T06:27:16Z",
        "version": "4.3.0.14"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.13).\nInstall via the beta repository URL:\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\n\n\n## What's Changed\n* Validate id_token auth_time against max_age; fail closed by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/972\n* Add OIDC back-channel logout (logout_token validation + endpoint) by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/973\n* Add opt-in login-time deprovisioning on role-denied SSO logins by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/975\n* Read the manifest via jq --rawfile so the beta publish survives arg-length growth by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/979\n* Publish the newest JF11 beta as the repo's Latest release by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/981\n* Add a changelog entry for the managed login-page buttons by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/983\n* Add the SAML deprovision-off parity test by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/984\n\n\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/4.3.0-beta.12...4.3.0-beta.13",
        "checksum": "ef955fbe06ffb212ca576b65f3eed247",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.13/community-sso-for-jellyfin_4.3.0.13.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-07-24T06:36:00Z",
        "version": "4.3.0.13"
      },
      {
        "changelog": "Jellyfin 10.11 beta 4.3.0-beta (plugin version 4.3.0.12).\r\nInstall via the beta repository URL:\r\nhttps://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json\r\n\r\n\r\n## What's Changed\r\n* Treat whitespace-only SAML roles as blank in the login allow-list by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/957\r\n* Add a manifest-only regeneration dispatch as a recovery path by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/958\r\n* Bound the checksum-sidecar fetches to the entries that survive the cap by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/959\r\n* Resurrect the Stryker mutation gate via a VSTest twin project by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/960\r\n* Split the mutation run into three parallel scope legs by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/963\r\n* Pin every SsoAudit emission: shape, level, CRLF-strip, emission points by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/964\r\n* Make a forgotten rate-limit gate a red build; pin the 429 shapes by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/965\r\n* Exercise the PAR-enabled challenge path — the untested production default by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/966\r\n* Test the login-button hosted service and pin the SAML hostile-name route by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/967\r\n* E2E: stable-binding relogin, admin-policy asserts, SSO-only round-trip by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/968\r\n* Close the four small unit holes from the coverage audit by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/969\r\n* Exercise the SSRF connect guard at the real socket layer by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/970\r\n* E2E: exercise SAML metadata import/SP-metadata, assert secrets-at-rest + audit by @iderex in https://github.com/iderex/jellyfin-plugin-sso/pull/971\r\n\r\n\r\n**Full Changelog**: https://github.com/iderex/jellyfin-plugin-sso/compare/5.0.0-JF12-beta.25...4.3.0-beta.12",
        "checksum": "06ba73c32a08eb9a50ec0f6d1f02e9e6",
        "sourceUrl": "https://github.com/Flowfin/jellyfin-plugin-sso/releases/download/4.3.0-beta.12/community-sso-for-jellyfin_4.3.0.12.zip",
        "targetAbi": "10.11.0.0",
        "timestamp": "2026-07-23T06:37:45Z",
        "version": "4.3.0.12"
      }
    ]
  }
]