The field name is now more descriptive of what it actually is – the
configuration of the CAPTCHA provider – and aligns with the key used
when passing it to the client-side React form.
Now that the translations are lazily imported JS chunks rather than plain JSON
assets, `include_asset('locales/<lang>.json')` resolves to a manifest entry
flagged `isDynamicEntry`. Those must not be evaluated eagerly with a `<script>`
tag, so emit the same `modulepreload` hint we already use for imported chunks,
integrity included, and drop the now-unreachable top-level JSON preload.
The interactive playground page and its route/config option are gone; the GraphQL API itself (POST /graphql) is unaffected. External GraphQL usage is deprecated anyway in favour of the REST admin API.
The `nqchar` predicate used exclusive ranges where RFC 6749's NQCHAR
ranges (%x23-5B / %x5D-7E) are inclusive on both ends, so scopes
containing `[` or `~` were rejected with "Invalid scope format". In
particular this broke `urn:matrix:client:device:` scopes for device IDs
containing `~`, which the Matrix spec explicitly allows.
Fixes#5878
Fixes#5572Fixes#2424
This makes it so that MAS binds on a temporary path on startup, sets
permissions and then moves it to the configured path. This means that we don't
error out anymore if there is a stale socket file, and that it is safe to
rollout a new process without killing the old one first, without breaking
connections.
When a browser signs out (or discovers its session was ended), the
session cookie now remembers when that happened; the flag is cleared by
the next successful login. The `additional_authorization_parameters`
templates can read it as `logged_out`, so operators can force a fresh
prompt at the upstream provider after sign-out, e.g.:
additional_authorization_parameters:
prompt: "{% if logged_out %}login{% endif %}"
This addresses the "sign out signs me back in" loop with upstream SSO
providers that still hold a live session.
Fixes#1569
The 2.21 AST grew a dedicated Compare node for chained comparisons,
which the i18n scanner needs to walk. Also raise the workspace
requirements from 2.15.1/2.12.0 to 2.21.0.
schemars 1.0 dropped the type parameter from a generic's default schema name
(SingleResponse_for_User -> SingleResponse with numeric dedup like
SingleResponse2/3...). Those names become the OpenAPI $defs keys and, downstream,
the generated TypeScript type names in element-admin's SDK — so the change both
renamed every wrapper type and made the names positional/unstable.
Restore the 0.9 '_for_T' naming via schemars 1.0's rename format string on the
three generic wrappers (SingleResponse/PaginatedResponse/SingleResource), keeping
the published admin API schema stable for consumers.
Use the icu_locale fallbacker with a default LocaleFallbackConfig, build
PluralRules and the RelativeTimeFormatter from compiled data, format times with
the fieldset-based NoCalendarFormatter, and adopt the new data-error model
(IdentifierNotFound / MarkerNotFound).
Building the HTTP client now relies on a process-level rustls crypto
provider being installed (we no longer pass a pre-configured TLS config
that bundled one). Tests going through TestState that didn't call
setup() — e.g. the login_sso_redirect tests — panicked when building the
client. Call setup() from from_pool_with_site_config so every TestState
installs the provider.
branding.logo_uri was accepted and validated by the config layer but never
plumbed through to SiteConfig or any template, so it had no effect. Remove the
field and regenerate the committed config schema to remove the confusion.
MSC2965 changed the discovery mechanism to stop relying on .well-known
documents a while back. We removed references to this in the configuration
manual some time ago (see e3d1b8abfa) but
`mas-cli doctor` was still checking for it.
See element-hq/backend-internal#5 as well
Quentin Gliech