chore(deps): update dependency canaille to v0.4.3 - autoclosed #52

Closed

renovate wants to merge 1 commit from renovate/canaille-0.x into main

pull from: renovate/canaille-0.x

merge into: yaal:main

yaal:main

yaal:select-visible

yaal:calculations

yaal:activity-concept

Conversation 1 Commits 1 Files changed 2 +1092 -958

renovate commented 2026-08-10 06:21:30 +02:00

Member

• Copy link
• Copy Markdown

This PR contains the following updates:

Package	Change	Age	Confidence
canaille	==0.2.7 → ==0.4.3

---

Release Notes

yaal/canaille (canaille)

v0.4.3

Compare Source

Changed
^^^^^^^

• Groups must have at least one member, on every backend.
  Deleting the account of the last member of a group deletes the group,
  and the clients that only this group owns.
  Existing groups without members need a member before they can be edited.
• SCIM group names can be changed, and group members can be sent without $ref.

Fixed
^^^^^

• OAuth endpoints answered with an internal server error to plain HTTP requests.
  They now answer with an insecure_transport error, and a warning is logged.
• Token introspection ignored the configured sub claim and returned the user name.

v0.4.2

Compare Source

Changed
^^^^^^^

• SCIM provisioning failures, including refused credentials, are logged as errors.
  A warning is logged when a deleted user or group is not found on a client.
• Clients whose SCIM server does not support filters are not provisioned.

Fixed
^^^^^

• The help of canaille delete described arguments and options incorrectly.
• With an asynchronous task broker, the SCIM provisioning of deleted users could fail.
• Trusted clients did not receive the groups without members over SCIM.

v0.4.1

Compare Source

Changed
^^^^^^^

• The endpoints that other servers call, such as token introspection and SCIM,
  accept any host name, for instance the internal name of a container.

Fixed
^^^^^

• The CLI displays an error for unknown references, instead of saving empty values.
• canaille clean removes the consents and authorization codes of deleted users.
• A consent can be accepted without displaying the consent page first, as pytest-iam
  does.
• Clients without an audience issued ID tokens with an empty aud claim.
  :issue:246

v0.4.0

Compare Source

.. warning::

- Manual migration required for the LDAP backend: an ``owner`` attribute has been
  added to clients, and an ``oauthDeviceCode`` object class for device codes.
  Please follow the :ref:`ldap_schema_update` section.
- Existing SCIM clients must be given a ``scim:users:*``, ``scim:groups:*``,
  ``scim:read`` or ``scim:write`` scope.
- SCIM clients may need to be adapted:

  - users and groups are identified by their ``id`` in the URLs, in ``members.value``
    and in ``$ref``, instead of their ``userName`` and ``displayName``;
  - a PATCH request answers ``204 No Content`` when no ``attributes`` are requested;
  - in a bulk request, an operation that refers to an unknown ``bulkId`` answers 409.

- OIDC clients that pass a ``request_uri`` must register it in their
  ``request_uris``.
- Profile photos need the ``front`` packaging extras.

Added
^^^^^

• :rfc:OAuth 2.0 Device Authorization Grant <8628> support, for devices with
  limited input capabilities (smart TVs, consoles, CLI tools…).
• OIDC clients can be owned by users or groups. Users with the
  MANAGE_OWN_CLIENTS permission can create clients and manage the ones they own.
  This permission is not granted by default. :issue:308
• Users who can manage all groups can pick the members of a group when they create
  it, and add several users at once to an existing group. :issue:192
• Groups can have several owners. Owners can choose the other owners among the members,
  invite users as owners, remove the members who are not owners, and step down. Only
  users who can manage all groups can remove the other owners. A group can only be
  deleted by its only owner. :issue:309
• Profile photos can be uploaded in the PNG and WEBP formats, in addition to JPEG.
  Their metadata, such as the GPS coordinates of smartphone photos, are removed.
  They are downscaled to 1024x1024 and cannot weigh more than 5MB. On the LDAP
  backend, they are converted to JPEG.
• Support for SCIM bulk operations, filtering and sorting.
• The token introspection and revocation endpoints accept the
  client_secret_post and private_key_jwt client authentication methods.

Changed
^^^^^^^

• Group invitation links ask for a confirmation before the user joins the group.

• Groups are picked with a search field in the user invitation and account settings
  forms, also without JavaScript. The pages stay light with many groups.

• Form fields are checked when the user leaves them, instead of while they type,
  except for the password strength. Characters typed during a check no longer get
  lost.

• Disabling
  :attr:~canaille.core.configuration.CoreSettings.ENABLE_PASSWORD_RECOVERY also
  disables password initialization, which led to an unreachable page.
  Administrators can still set passwords from the user profile.

• The session cookie is only sent with same-site requests by default
  (SESSION_COOKIE_SAMESITE is Lax), also without the front extras.

• When LOGGING is a dictionary, the loggers that exist before Canaille starts are
  no longer disabled. Set disable_existing_loggers to true to disable them
  again.

• The HTTPS certificates of the outgoing requests, such as the password compromise
  check and the download of request_uri and jwks_uri documents, are checked
  against the system trust store instead of the certifi bundle.

• A client management request with a token issued to another client answers
  400 access_denied instead of 403 unauthorized_client.

• The SCIM server follows RFC 7643 and RFC 7644 more closely:

  • a PATCH that writes the display of a group member is refused with a
    mutability error;
  • the ResourceType endpoints are relative to the SCIM base URL, such as
    /Users;
  • the User resource type declares the enterprise extension as optional;
  • the /ServiceProviderConfig, /ResourceTypes and /Schemas endpoints
    need no token;
  • a PUT that changes nothing keeps the meta.version and meta.lastModified
    of the resource.

• The SCIM client updates the provisioned users and groups with PATCH requests,
  when the client supports PATCH. Only the changed attributes are sent. The
  attributes Canaille does not manage are left untouched.

Removed
^^^^^^^

• End support for Python 3.10.

Fixed
^^^^^

• Some OIDC requests returned a server error instead of an OAuth error:

  • client keys that could not be read at their jwks_uri;
  • a token request without grant_type;
  • without SERVER_NAME, a token request from a public client or with a wrong
    client secret;
  • an authorization request with an unreachable or unparsable request_uri, or
    with a max_age that is not an integer;
  • an unknown answer to the consent page.

• With prompt=login, prompt=select_account or max_age, accepting the
  consent asked to log in again. A max_age of zero asked to log in again and
  again. A negative max_age is refused.

• The prompt and max_age parameters of request objects were ignored.

• Users with several email addresses only received a valid password reset or
  initialization code on one of them.

• For users without a password, the inline validation of the login and password
  fields displayed the whole password initialization page inside the field.

• Profile fields could show the access rights, or the error messages language, of
  the user of another request. After an inline validation, a field of a list, such
  as an email address, could show another access indicator.

• An invalid email address also showed the errors that only make sense for valid
  addresses, such as "No user found with this email address".

• Read-only lists showed the add and remove buttons.

• Without JavaScript, the copy buttons submitted the form they are in.

• Spaces around a table search query prevented any match.

• The browser console showed Content Security Policy errors on every page.

• The user menu of the navigation bar flickered when it opened. In dark mode, it
  had a light background, like the tooltips.

• With the LDAP backend, changing the user name of a user, or the name of a group,
  failed, for instance through SCIM.

• With OpenLDAP 2.7, an LDAP server address that cannot be resolved raised a raw
  BackendError instead of a connection error.

• Canaille did not start with the postgresql and mysql extras, as they
  installed SQLAlchemy 2.1, which sqlalchemy-utils does not support yet.

• The SQL database could not be created on MariaDB. On MariaDB, dates keep their
  microseconds, and tokens and authorization codes are case-sensitive.

• With SQL databases, searching the members of a group also listed users who were
  not members.

• With SQL databases, the members added to a group at the same time could be listed
  in any order.

• Two edits of a resource in the same second got the same SCIM ETag, so an outdated
  If-Match could be accepted.

• A SCIM PUT on a user whose account expires later locked the account at once.

• SCIM PATCH requests that cannot be applied answer a SCIM error instead of an
  HTTP 500 error.

• The SCIM client escapes the identifiers it puts in externalId filters.

Security
^^^^^^^^

• The SCIM API accepted any access token emitted by Canaille. Client tokens now need
  a SCIM scope. User tokens only give access to their own user, with the
  scim:me scope.
• With SCIM, users can only modify the attributes of their WRITE ACL on their own
  account.
• The SCIM client sent the password hashes to the provisioned clients.
• A client could get scopes the user never consented to. With a request object, the
  consent page showed the scopes of the URL. With a request_uri, the request
  object could change between the consent page and the user answer.
• OIDC request objects are only downloaded from the request_uris the client
  registered.
• Request objects and client key sets, downloaded at the request_uri and
  jwks_uri addresses clients indicate, had no size limit. They are now limited
  to 64kB.
• The consent page accepted answers without CSRF token. Another website could make a
  user consent to an application.
• Some authorization errors could redirect to any URI: consent_required with
  prompt=none and a request object, and the error for an unsupported prompt
  value. They only redirect to the URIs registered for the client.
• Trusted clients, which skip the user consent page, need both their
  client_uri and their redirect_uris to match
  :attr:~canaille.oidc.configuration.OIDCSettings.TRUSTED_DOMAINS.
• Users without the USE_OIDC permission could still get tokens with the password,
  refresh token and authorization code grants, and use their existing tokens.
• Deleting a user kept their tokens, consents and authorization codes, except on
  PostgreSQL and MariaDB. Their access tokens stayed active until they expired.
• The logout asks for a confirmation when the ID token hint was issued for another
  user. A link could log a user out without their consent.
• User impersonation was a GET request, not covered by the CSRF protection. It
  is now confirmed with a form, and the /impersonate/<user> endpoint is removed.
• Without :attr:~canaille.app.configuration.RootSettings.TRUSTED_HOSTS, password
  initialization mails carried a link exposed to Host header spoofing. They now
  carry a code, like password reset mails.
• After the inline validation of a password field, the typed passwords could be
  found in the page HTML of other users.
• In debug mode, the pages did not escape the HTML in the values users entered.
• Photo uploads were only checked on their file extension. A SVG file renamed with a
  .jpg extension was served inline. Photos that cannot be served as images are
  now downloaded instead of being rendered.
• Canaille requires Authlib 1.9.1, which fixes several security issues.

v0.3.6

Compare Source

Added
^^^^^

• Client secret expiration dates are displayed and editable in the client administration page. Clients cannot authenticate with an expired secret anymore.
• Client secrets can be renewed from the client administration page.
• canaille jwt registration has a --client-id option to choose the identifier of the client to register, so it is known before the client registers itself.
• canaille jwt registration and canaille jwt management have a --json option that displays the client identifier and the endpoint to use along with the token.

Fixed
^^^^^

• :rfc:RFC7592 <7592> registration access tokens were not bound to the client they were issued for.
• canaille jwt management issued tokens for unregistered clients, and canaille jwt registration for already registered ones, although the endpoints reject both.
• Client registration and management tokens signed with the none algorithm were accepted, so anyone could forge one.
• Client registration and management tokens signed with an inactive key are now accepted, so a key rotation does not invalidate the tokens issued before it.
• DYNAMIC_CLIENT_REGISTRATION_OPEN also disabled the authentication of the :rfc:RFC7592 <7592> client management endpoint, which could then be used without any token. It now only covers the registration of new clients.
• Dynamically registered clients had their client_secret_expires_at set to 1970-01-01 instead of being left empty.

v0.3.5

Compare Source

Fixed
^^^^^

• Server signing keys are imported once instead of at every use, which made pages and endpoints reading them slow with large RSA keys.

v0.3.4

Compare Source

Added
^^^^^

• canaille jwk export command to export the public part of the server signing keys, as JSON metadata or as PEM, for external JWT validators that verify tokens locally.

Fixed
^^^^^

• move tomlkit dependency from the front to the oidc extra

v0.3.3

Compare Source

Fixed
^^^^^

• Duplicate scope values in a request are now deduplicated instead of making token/authorization code storage fail (e.g. on the LDAP backend).

v0.3.2

Compare Source

Fixed
^^^^^

• Unexpected errors on the OIDC endpoints are now logged instead of being silently swallowed, so they are reported to error monitoring such as Sentry.

v0.3.1

Compare Source

Fixed
^^^^^

• CLI commands now report unknown model names with a clean error instead of crashing.
• dump/restore round-trip now preserves binary attributes such as user photos.

v0.3.0

Compare Source

Added
^^^^^

• OIDC RP-Initiated Logout support. :issue:157
• HTMX page loading indicator displayed during in-flight requests.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "every 2 weeks on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [canaille](https://gitlab.com/yaal/canaille) | `==0.2.7` → `==0.4.3` |  |  | --- ### Release Notes <details> <summary>yaal/canaille (canaille)</summary> ### [`v0.4.3`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#043---2026-10-29) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.4.2...0.4.3) Changed ^^^^^^^ - Groups must have at least one member, on every backend. Deleting the account of the last member of a group deletes the group, and the clients that only this group owns. Existing groups without members need a member before they can be edited. - SCIM group names can be changed, and group members can be sent without `$ref`. Fixed ^^^^^ - OAuth endpoints answered with an internal server error to plain HTTP requests. They now answer with an `insecure_transport` error, and a warning is logged. - Token introspection ignored the configured `sub` claim and returned the user name. ### [`v0.4.2`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#042---2026-10-29) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.4.1...0.4.2) Changed ^^^^^^^ - SCIM provisioning failures, including refused credentials, are logged as errors. A warning is logged when a deleted user or group is not found on a client. - Clients whose SCIM server does not support filters are not provisioned. Fixed ^^^^^ - The help of `canaille delete` described arguments and options incorrectly. - With an asynchronous task broker, the SCIM provisioning of deleted users could fail. - Trusted clients did not receive the groups without members over SCIM. ### [`v0.4.1`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#041---2026-10-28) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.4.0...0.4.1) Changed ^^^^^^^ - The endpoints that other servers call, such as token introspection and SCIM, accept any host name, for instance the internal name of a container. Fixed ^^^^^ - The CLI displays an error for unknown references, instead of saving empty values. - `canaille clean` removes the consents and authorization codes of deleted users. - A consent can be accepted without displaying the consent page first, as pytest-iam does. - Clients without an audience issued ID tokens with an empty `aud` claim. :issue:`246` ### [`v0.4.0`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#040---2026-10-28) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.6...0.4.0) .. warning:: ``` - Manual migration required for the LDAP backend: an ``owner`` attribute has been added to clients, and an ``oauthDeviceCode`` object class for device codes. Please follow the :ref:`ldap_schema_update` section. - Existing SCIM clients must be given a ``scim:users:*``, ``scim:groups:*``, ``scim:read`` or ``scim:write`` scope. - SCIM clients may need to be adapted: - users and groups are identified by their ``id`` in the URLs, in ``members.value`` and in ``$ref``, instead of their ``userName`` and ``displayName``; - a PATCH request answers ``204 No Content`` when no ``attributes`` are requested; - in a bulk request, an operation that refers to an unknown ``bulkId`` answers 409. - OIDC clients that pass a ``request_uri`` must register it in their ``request_uris``. - Profile photos need the ``front`` packaging extras. ``` Added ^^^^^ - :rfc:`OAuth 2.0 Device Authorization Grant <8628>` support, for devices with limited input capabilities (smart TVs, consoles, CLI tools…). - OIDC clients can be owned by users or groups. Users with the `MANAGE_OWN_CLIENTS` permission can create clients and manage the ones they own. This permission is not granted by default. :issue:`308` - Users who can manage all groups can pick the members of a group when they create it, and add several users at once to an existing group. :issue:`192` - Groups can have several owners. Owners can choose the other owners among the members, invite users as owners, remove the members who are not owners, and step down. Only users who can manage all groups can remove the other owners. A group can only be deleted by its only owner. :issue:`309` - Profile photos can be uploaded in the PNG and WEBP formats, in addition to JPEG. Their metadata, such as the GPS coordinates of smartphone photos, are removed. They are downscaled to 1024x1024 and cannot weigh more than 5MB. On the LDAP backend, they are converted to JPEG. - Support for SCIM bulk operations, filtering and sorting. - The token introspection and revocation endpoints accept the `client_secret_post` and `private_key_jwt` client authentication methods. Changed ^^^^^^^ - Group invitation links ask for a confirmation before the user joins the group. - Groups are picked with a search field in the user invitation and account settings forms, also without JavaScript. The pages stay light with many groups. - Form fields are checked when the user leaves them, instead of while they type, except for the password strength. Characters typed during a check no longer get lost. - Disabling :attr:`~canaille.core.configuration.CoreSettings.ENABLE_PASSWORD_RECOVERY` also disables password initialization, which led to an unreachable page. Administrators can still set passwords from the user profile. - The session cookie is only sent with same-site requests by default (`SESSION_COOKIE_SAMESITE` is `Lax`), also without the `front` extras. - When `LOGGING` is a dictionary, the loggers that exist before Canaille starts are no longer disabled. Set `disable_existing_loggers` to `true` to disable them again. - The HTTPS certificates of the outgoing requests, such as the password compromise check and the download of `request_uri` and `jwks_uri` documents, are checked against the system trust store instead of the certifi bundle. - A client management request with a token issued to another client answers `400 access_denied` instead of `403 unauthorized_client`. - The SCIM server follows RFC 7643 and RFC 7644 more closely: - a PATCH that writes the `display` of a group member is refused with a `mutability` error; - the `ResourceType` endpoints are relative to the SCIM base URL, such as `/Users`; - the `User` resource type declares the enterprise extension as optional; - the `/ServiceProviderConfig`, `/ResourceTypes` and `/Schemas` endpoints need no token; - a PUT that changes nothing keeps the `meta.version` and `meta.lastModified` of the resource. - The SCIM client updates the provisioned users and groups with PATCH requests, when the client supports PATCH. Only the changed attributes are sent. The attributes Canaille does not manage are left untouched. Removed ^^^^^^^ - End support for Python 3.10. Fixed ^^^^^ - Some OIDC requests returned a server error instead of an OAuth error: - client keys that could not be read at their `jwks_uri`; - a token request without `grant_type`; - without `SERVER_NAME`, a token request from a public client or with a wrong client secret; - an authorization request with an unreachable or unparsable `request_uri`, or with a `max_age` that is not an integer; - an unknown answer to the consent page. - With `prompt=login`, `prompt=select_account` or `max_age`, accepting the consent asked to log in again. A `max_age` of zero asked to log in again and again. A negative `max_age` is refused. - The `prompt` and `max_age` parameters of request objects were ignored. - Users with several email addresses only received a valid password reset or initialization code on one of them. - For users without a password, the inline validation of the login and password fields displayed the whole password initialization page inside the field. - Profile fields could show the access rights, or the error messages language, of the user of another request. After an inline validation, a field of a list, such as an email address, could show another access indicator. - An invalid email address also showed the errors that only make sense for valid addresses, such as "No user found with this email address". - Read-only lists showed the add and remove buttons. - Without JavaScript, the copy buttons submitted the form they are in. - Spaces around a table search query prevented any match. - The browser console showed Content Security Policy errors on every page. - The user menu of the navigation bar flickered when it opened. In dark mode, it had a light background, like the tooltips. - With the LDAP backend, changing the user name of a user, or the name of a group, failed, for instance through SCIM. - With OpenLDAP 2.7, an LDAP server address that cannot be resolved raised a raw `BackendError` instead of a connection error. - Canaille did not start with the `postgresql` and `mysql` extras, as they installed SQLAlchemy 2.1, which sqlalchemy-utils does not support yet. - The SQL database could not be created on MariaDB. On MariaDB, dates keep their microseconds, and tokens and authorization codes are case-sensitive. - With SQL databases, searching the members of a group also listed users who were not members. - With SQL databases, the members added to a group at the same time could be listed in any order. - Two edits of a resource in the same second got the same SCIM ETag, so an outdated `If-Match` could be accepted. - A SCIM PUT on a user whose account expires later locked the account at once. - SCIM PATCH requests that cannot be applied answer a SCIM error instead of an HTTP 500 error. - The SCIM client escapes the identifiers it puts in `externalId` filters. Security ^^^^^^^^ - The SCIM API accepted any access token emitted by Canaille. Client tokens now need a SCIM scope. User tokens only give access to their own user, with the `scim:me` scope. - With SCIM, users can only modify the attributes of their `WRITE` ACL on their own account. - The SCIM client sent the password hashes to the provisioned clients. - A client could get scopes the user never consented to. With a request object, the consent page showed the scopes of the URL. With a `request_uri`, the request object could change between the consent page and the user answer. - OIDC request objects are only downloaded from the `request_uris` the client registered. - Request objects and client key sets, downloaded at the `request_uri` and `jwks_uri` addresses clients indicate, had no size limit. They are now limited to 64kB. - The consent page accepted answers without CSRF token. Another website could make a user consent to an application. - Some authorization errors could redirect to any URI: `consent_required` with `prompt=none` and a request object, and the error for an unsupported `prompt` value. They only redirect to the URIs registered for the client. - Trusted clients, which skip the user consent page, need both their `client_uri` and their `redirect_uris` to match :attr:`~canaille.oidc.configuration.OIDCSettings.TRUSTED_DOMAINS`. - Users without the `USE_OIDC` permission could still get tokens with the password, refresh token and authorization code grants, and use their existing tokens. - Deleting a user kept their tokens, consents and authorization codes, except on PostgreSQL and MariaDB. Their access tokens stayed active until they expired. - The logout asks for a confirmation when the ID token hint was issued for another user. A link could log a user out without their consent. - User impersonation was a `GET` request, not covered by the CSRF protection. It is now confirmed with a form, and the `/impersonate/<user>` endpoint is removed. - Without :attr:`~canaille.app.configuration.RootSettings.TRUSTED_HOSTS`, password initialization mails carried a link exposed to Host header spoofing. They now carry a code, like password reset mails. - After the inline validation of a password field, the typed passwords could be found in the page HTML of other users. - In debug mode, the pages did not escape the HTML in the values users entered. - Photo uploads were only checked on their file extension. A SVG file renamed with a `.jpg` extension was served inline. Photos that cannot be served as images are now downloaded instead of being rendered. - Canaille requires Authlib 1.9.1, which fixes several security issues. ### [`v0.3.6`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#036---2026-08-04) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.5...0.3.6) Added ^^^^^ - Client secret expiration dates are displayed and editable in the client administration page. Clients cannot authenticate with an expired secret anymore. - Client secrets can be renewed from the client administration page. - `canaille jwt registration` has a `--client-id` option to choose the identifier of the client to register, so it is known before the client registers itself. - `canaille jwt registration` and `canaille jwt management` have a `--json` option that displays the client identifier and the endpoint to use along with the token. Fixed ^^^^^ - :rfc:`RFC7592 <7592>` registration access tokens were not bound to the client they were issued for. - `canaille jwt management` issued tokens for unregistered clients, and `canaille jwt registration` for already registered ones, although the endpoints reject both. - Client registration and management tokens signed with the `none` algorithm were accepted, so anyone could forge one. - Client registration and management tokens signed with an inactive key are now accepted, so a key rotation does not invalidate the tokens issued before it. - `DYNAMIC_CLIENT_REGISTRATION_OPEN` also disabled the authentication of the :rfc:`RFC7592 <7592>` client management endpoint, which could then be used without any token. It now only covers the registration of new clients. - Dynamically registered clients had their `client_secret_expires_at` set to 1970-01-01 instead of being left empty. ### [`v0.3.5`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#035---2026-07-30) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.4...0.3.5) Fixed ^^^^^ - Server signing keys are imported once instead of at every use, which made pages and endpoints reading them slow with large RSA keys. ### [`v0.3.4`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#034---2026-07-22) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.3...0.3.4) Added ^^^^^ - `canaille jwk export` command to export the public part of the server signing keys, as JSON metadata or as PEM, for external JWT validators that verify tokens locally. Fixed ^^^^^ - move tomlkit dependency from the front to the oidc extra ### [`v0.3.3`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#033---2026-07-01) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.2...0.3.3) Fixed ^^^^^ - Duplicate scope values in a request are now deduplicated instead of making token/authorization code storage fail (e.g. on the LDAP backend). ### [`v0.3.2`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#032---2026-07-01) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.1...0.3.2) Fixed ^^^^^ - Unexpected errors on the OIDC endpoints are now logged instead of being silently swallowed, so they are reported to error monitoring such as Sentry. ### [`v0.3.1`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#031---2026-06-22) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.3.0...0.3.1) Fixed ^^^^^ - CLI commands now report unknown model names with a clean error instead of crashing. - `dump`/`restore` round-trip now preserves binary attributes such as user photos. ### [`v0.3.0`](https://gitlab.com/yaal/canaille/blob/HEAD/CHANGES.rst#030---2026-06-19) [Compare Source](https://gitlab.com/yaal/canaille/compare/0.2.7...0.3.0) Added ^^^^^ - OIDC RP-Initiated Logout support. :issue:`157` - HTMX page loading indicator displayed during in-flight requests. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Paris) - Branch creation - "every 2 weeks on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMS4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTY3LjUiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

renovate added 1 commit 2026-08-10 06:21:30 +02:00

chore(deps): update dependency canaille to v0.3.6 103268315e

renovate force-pushed renovate/canaille-0.x from 103268315e to 39172c8a87 2026-09-22 06:08:17 +02:00 Compare

camille commented 2026-10-19 15:52:13 +02:00

Owner

• Copy link
• Copy Markdown

En tant que sentinelle cette semaine, je me suis posé la question de ce qu'il fallait faire sur cette PR. On ne peut pas encore mettre à jour. @loan et @eloi sont les plus informés et d'après @eloi ce sera réglé d'ici la pycon (qui a lieu le 1er nov).

En tant que sentinelle cette semaine, je me suis posé la question de ce qu'il fallait faire sur cette PR. On ne peut pas encore mettre à jour. @loan et @eloi sont les plus informés et d'après @eloi ce sera réglé d'ici la pycon (qui a lieu le 1er nov).

renovate force-pushed renovate/canaille-0.x from 39172c8a87 to 7ae7e821b8 2026-11-01 05:11:12 +01:00 Compare

renovate changed title from chore(deps): update dependency canaille to v0.3.6 to chore(deps): update dependency canaille to v0.4.1 2026-11-01 05:11:15 +01:00

renovate force-pushed renovate/canaille-0.x from 7ae7e821b8 to fec5cb2f68 2026-11-02 05:15:58 +01:00 Compare

renovate changed title from chore(deps): update dependency canaille to v0.4.1 to chore(deps): update dependency canaille to v0.4.3 2026-11-02 05:16:00 +01:00

renovate changed title from chore(deps): update dependency canaille to v0.4.3 to chore(deps): update dependency canaille to v0.4.3 - autoclosed 2026-11-04 05:17:21 +01:00

renovate closed this pull request 2026-11-04 05:17:21 +01:00

Some checks failed

Hide checks

renovate/stability-days Updates have met minimum release age requirement

Details

CI / lint (push) Successful in 2m45s

Details

CI / lint (pull_request) Successful in 1m40s

Details

CI / python-tests (pull_request) Failing after 2m36s

Details

CI / python-tests (push) Failing after 3m49s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

yaal/sisyphe!52

No description provided.