Repository navigation
1.26.0-rc.0 - #4048
Merged
Merged
1.26.0-rc.0#4048
Conversation
Member
- Add appsec-bot-challenge to COLLECTIONS
- Update appsec_config to include multiple entries
- Correct appsec_config to appsec_configs
- feat(installer): opt-in CrowdSec bot detection
- Update CrowdSec plugin version as new stable dropped
- first pass
- fix redirects
- show paid properly
- remove extra log
- Standalone dns server
- Clean up config for dns servers
- Only install the packages we need
- Split into tabs
- recover olm based on last seen
- Revalidate OIDC sessions with the IdP using refresh tokens
- Add missing api key actions
- Support prices for custom models
- Support a non-interactive installer mode
- Deploy on aws
- address review feedback
- restore in memory coalescing
- add offline_access to default scopes for generic idp
- add toggle to idp settings
- support special google session revalidation
- disbale auto provision section when enterprise gated
- add remote node hybrid endpoint for session revalidation
- SSH log
- Add resource session tracking page
- Resource session page
- New translations en-us.json (French)
- New translations en-us.json (Spanish)
- New translations en-us.json (Bulgarian)
- New translations en-us.json (Czech)
- New translations en-us.json (Danish)
- New translations en-us.json (German)
- New translations en-us.json (Italian)
- New translations en-us.json (Korean)
- New translations en-us.json (Dutch)
- New translations en-us.json (Polish)
- New translations en-us.json (Portuguese)
- New translations en-us.json (Russian)
- New translations en-us.json (Turkish)
- New translations en-us.json (Chinese Simplified)
- New translations en-us.json (Norwegian Bokmal)
- Support matching on the base wildcard resources
- Complete 1.26 migration
- Bump version
- Fix formatting
- support auto provision toggle per org for org idp mode
- Fill in autoProvision
- Fix paid feature display issue
- Fix license
…stream feat(installer): make CrowdSec bot detection opt-in
Updated CrowdSec plugin version to v1.8.1 as new stable
Pangolin consults the IdP only at login and keeps its own session afterwards, so disabling a user or revoking their sessions in the IdP does not end their Pangolin sessions. Store the IdP refresh token at OIDC login as a grant and redeem it at most every server.idp_session_revalidation_minutes (default 5). If the IdP rejects it with invalid_grant, the grant is marked revoked and all sessions backed by it and their resource sessions are deleted. Other errors (IdP unreachable or slower than 10 seconds, invalid_client after a secret change) keep the sessions valid and are retried after at most a minute instead of on every request. Only the instance holding a lease on the grant in the primary database redeems its refresh token, and it writes the result only while it still holds the lease, so instances never redeem the same token concurrently. The per-request lookup reads from a replica through safeRead. Device logins of the Pangolin clients share the grant of the browser session that approved them, read from the primary database, so a rotated refresh token is never redeemed twice by separate sessions. The Entra ID provider type hardcodes its scopes, so it now requests offline_access to get a refresh token.
Add Crowdsec bot detection
Revalidate OIDC sessions with the IdP using refresh tokens
Support matching on the base wildcard resources
miloschwartz
previously approved these changes
Nov 2, 2026
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
[ci skip]
New Crowdin updates
miloschwartz
approved these changes
Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.