Repository navigation
chore(release): prepare for publishing - #2348
Closed
devolutionsbot wants to merge 1 commit into
Closed
devolutionsbot wants to merge 1 commit into
devolutionsbot wants to merge 1 commit into
Conversation
github-actions
Bot
force-pushed
the
release-plz/2026-11-01T04-28-41Z
branch
from
November 1, 2026 04:29
d3653a1 to
78de737
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Several changelog entries misrepresent crate-specific changes and omit breaking API requirements, security-relevant key classification, migration guidance, and opt-in message-limit defaults.
6 open issues
Document AVD secret keys recognized by is_secret_key · New Mark PropertySetExt additions as breaking and name required accessors · New Document both opt-in DVC reassembly limits and defaults · New Describe the SSPI constructor and picky dependency adaptation · New Document ProgressiveContextPdu deprecation and replacement API · New Document the opt-in static-channel message-size limit API · New
What changed in this PR
Prepares IronRDP’s next crate releases by updating package versions, dependency requirements, lockfiles, and generated release notes.
The implementation changes described in the changelogs come from previously merged PRs.
Changes:
- Bumps 17 existing crates, including the breaking
ironrdp-cfg0.4.0 release. - Adds initial release notes for the MultiPoint, core-input, and mouse-cursor channel crates.
- Updates dependent manifests and both lockfiles, including several third-party dependency refreshes.
| File | Description |
|---|---|
fuzz/Cargo.lock |
Synchronizes fuzz dependencies with release versions. |
crates/ironrdp/Cargo.toml |
Updates the gateway dependency requirement. |
crates/ironrdp-w365/Cargo.toml |
Updates channel and PDU dependencies. |
crates/ironrdp-vmconnect/Cargo.toml |
Updates the Windows DVC dependency. |
crates/ironrdp-viewer/Cargo.toml |
Adopts configuration crate 0.4. |
crates/ironrdp-svc/CHANGELOG.md |
Documents reassembly limits and recipient context. |
crates/ironrdp-svc/Cargo.toml |
Sets version 0.10.1. |
crates/ironrdp-session/CHANGELOG.md |
Records session APIs, input, and rendering changes. |
crates/ironrdp-session/Cargo.toml |
Sets version 0.13.1. |
crates/ironrdp-rdpsnd/CHANGELOG.md |
Records the audio Training Confirm correction. |
crates/ironrdp-rdpsnd/Cargo.toml |
Sets version 0.11.1. |
crates/ironrdp-rdpevor/CHANGELOG.md |
Adds the 0.2.1 release heading. |
crates/ironrdp-rdpevor/Cargo.toml |
Bumps the package and channel dependencies. |
crates/ironrdp-rdpetxt/Cargo.toml |
Updates optional channel dependencies. |
crates/ironrdp-rdpet/Cargo.toml |
Updates channel and PDU dependencies. |
crates/ironrdp-rdpepnp/Cargo.toml |
Updates channel and PDU dependencies. |
crates/ironrdp-rdpemsc/CHANGELOG.md |
Adds initial mouse-cursor channel release notes. |
crates/ironrdp-rdpemsc/Cargo.toml |
Updates DVC and PDU requirements. |
crates/ironrdp-rdpel/CHANGELOG.md |
Adds the 0.0.3 release heading. |
crates/ironrdp-rdpel/Cargo.toml |
Bumps the package and channel dependencies. |
crates/ironrdp-rdpegt/CHANGELOG.md |
Adds the 0.2.1 release heading. |
crates/ironrdp-rdpegt/Cargo.toml |
Bumps the package and channel dependencies. |
crates/ironrdp-rdpeci/CHANGELOG.md |
Adds initial core-input channel release notes. |
crates/ironrdp-rdpeci/Cargo.toml |
Updates channel and PDU dependencies. |
crates/ironrdp-rdpecam/CHANGELOG.md |
Adds the 0.2.1 release heading. |
crates/ironrdp-rdpecam/Cargo.toml |
Bumps the package and channel dependencies. |
crates/ironrdp-rdpear/Cargo.toml |
Updates DVC and PDU requirements. |
crates/ironrdp-rdpadrv/CHANGELOG.md |
Adds initial MultiPoint channel release notes. |
crates/ironrdp-rdpadrv/Cargo.toml |
Updates DVC and PDU requirements. |
crates/ironrdp-pdu/CHANGELOG.md |
Records Progressive flag changes. |
crates/ironrdp-pdu/Cargo.toml |
Sets version 0.11.1. |
crates/ironrdp-mstsgu/CHANGELOG.md |
Records authentication adaptation and socket tuning. |
crates/ironrdp-mstsgu/Cargo.toml |
Sets version 0.1.1. |
crates/ironrdp-graphics/CHANGELOG.md |
Records RemoteFX and pointer rendering fixes. |
crates/ironrdp-graphics/Cargo.toml |
Sets version 0.11.1. |
crates/ironrdp-egfx/CHANGELOG.md |
Records AVC444, lifecycle, and Progressive fixes. |
crates/ironrdp-egfx/Cargo.toml |
Sets version 0.5.1. |
crates/ironrdp-dvc/CHANGELOG.md |
Records reassembly and channel lifecycle changes. |
crates/ironrdp-dvc/Cargo.toml |
Sets version 0.10.1. |
crates/ironrdp-dvc-pipe-proxy/CHANGELOG.md |
Records proxy cancellation and reopening fixes. |
crates/ironrdp-dvc-pipe-proxy/Cargo.toml |
Sets version 0.7.1. |
crates/ironrdp-displaycontrol/CHANGELOG.md |
Records capability reset on channel reopening. |
crates/ironrdp-displaycontrol/Cargo.toml |
Sets version 0.10.1. |
crates/ironrdp-daemon/Cargo.toml |
Adopts configuration crate 0.4. |
crates/ironrdp-cliprdr/CHANGELOG.md |
Records clipboard and file-lock fixes. |
crates/ironrdp-cliprdr/Cargo.toml |
Sets version 0.9.1. |
crates/ironrdp-cliprdr-native/CHANGELOG.md |
Records native Windows clipboard fixes. |
crates/ironrdp-cliprdr-native/Cargo.toml |
Sets version 0.9.1. |
crates/ironrdp-client/Cargo.toml |
Updates configuration, location, and gateway requirements. |
crates/ironrdp-cfg/CHANGELOG.md |
Adds configuration 0.4.0 release notes. |
crates/ironrdp-cfg/Cargo.toml |
Sets the breaking release version to 0.4.0. |
crates/ironrdp-capture-replay/Cargo.toml |
Updates replay-related IronRDP dependencies. |
crates/ironrdp-agent/Cargo.toml |
Updates configuration and gateway requirements. |
crates/ironrdp-activex/Cargo.toml |
Adopts configuration crate 0.4. |
Cargo.lock |
Synchronizes release versions and refreshes third-party packages. |
Review effort: Balanced
Comment on lines
+11
to
+33
| ### <!-- 1 -->Features | ||
|
|
||
| - Support AVD gateway orchestration, WAM, and OAuth2 auth ([#2247](https://github.com/Devolutions/IronRDP/issues/2247)) ([c58f568711](https://github.com/Devolutions/IronRDP/commit/c58f568711ea30c719812a42607ac978c7513a45)) | ||
|
|
||
| Azure Virtual Desktop connections using `gatewaybrokeringtype:i:1` | ||
| negotiate session placement and gateway routing through an HTTPS | ||
| orchestration endpoint (`/api/v2/connections` or | ||
| `/api/arm/v2/connections`) before upgrading to a WebSocket gateway | ||
| transport and authenticating the target session host with Entra RDS AAD | ||
| Proof-of-Possession tokens. | ||
|
|
||
| Add AVD gateway orchestration, `WWW-Authenticate: Claims:...` challenge | ||
| parsing, Windows Web Account Manager (`WebAuthenticationCoreManager`) | ||
| silent and interactive token acquisition, and a cross-platform | ||
| `OAuthAvdTokenProvider` supporting silent refresh-token exchange, | ||
| loopback PKCE browser login, OAuth2 device-code fallback, persistent | ||
| per-user refresh-token caching, and refresh-to-PoP host token minting. | ||
| Decode `redirectedServerCert` and `redirectedAuthBlob` payloads, wire | ||
| Shortpath UDP peer endpoints (`GatewayConnectionInfo::udp_peer`), | ||
| preserve `load_balance_info` and `target_certificate` across mid-session | ||
| AVD redirections, and add companion `<rdp_file>.json` `UserName` lookup | ||
| and `--prop KEY:TYPE:VALUE` overrides in `ironrdp-daemon`, | ||
| `ironrdp-agent`, and `ironrdp-viewer`. |
Comment on lines
+35
to
+58
| - Support Remote Credential Guard over RDPEAR ([#2256](https://github.com/Devolutions/IronRDP/issues/2256)) ([376eb8f566](https://github.com/Devolutions/IronRDP/commit/376eb8f56634e5c92d7137886e62ddeb6bbb280f)) | ||
|
|
||
| Remote Credential Guard redirects Kerberos and NTLMv2 operations over | ||
| the `Microsoft::Windows::RDS::AuthRedirection` dynamic virtual channel | ||
| (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead | ||
| of delegating credentials through CredSSP `TSTicketCreds`. | ||
|
|
||
| Add `ironrdp-rdpear` with `no_std`/`alloc` outer envelope framing, | ||
| strict ASN.1 DER `TSRemoteGuardInnerPacket` codecs, and portable NDR32 | ||
| type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM | ||
| request/response calls under both the published IDL profile and the | ||
| Windows-native wire profile. Bound inbound static and dynamic channel | ||
| reassembly before fragment retention via | ||
| `SvcProcessor::max_message_size`, `DvcProcessor::max_message_size`, and | ||
| `DrdynvcClient::with_max_transport_message_size`. | ||
|
|
||
| Wire the opt-in `remote-guard` feature through `ironrdp-connector`, the | ||
| async/blocking/Tokio drivers, `ironrdp-cfg`, `ironrdp-client`, | ||
| `ironrdp-daemon`, and `ironrdp-agent` (`--remote-guard` and | ||
| `ironrdp_remote_guard` with `Disabled`, `Negotiate`, `Ntlm`, and | ||
| `Kerberos` modes) backed by `sspi` 0.23.1. RCG requires `HYBRID` or | ||
| `HYBRID_EX` with `REDIRECTED_AUTHENTICATION_MODE_SUPPORTED`, strict TLS | ||
| validation, and a completed CredSSP context handoff, and omits | ||
| passwords, smart-card PINs, and auto-reconnect cookies from Client Info. |
Comment on lines
+13
to
+36
| - Support Remote Credential Guard over RDPEAR ([#2256](https://github.com/Devolutions/IronRDP/issues/2256)) ([376eb8f566](https://github.com/Devolutions/IronRDP/commit/376eb8f56634e5c92d7137886e62ddeb6bbb280f)) | ||
|
|
||
| Remote Credential Guard redirects Kerberos and NTLMv2 operations over | ||
| the `Microsoft::Windows::RDS::AuthRedirection` dynamic virtual channel | ||
| (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead | ||
| of delegating credentials through CredSSP `TSTicketCreds`. | ||
|
|
||
| Add `ironrdp-rdpear` with `no_std`/`alloc` outer envelope framing, | ||
| strict ASN.1 DER `TSRemoteGuardInnerPacket` codecs, and portable NDR32 | ||
| type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM | ||
| request/response calls under both the published IDL profile and the | ||
| Windows-native wire profile. Bound inbound static and dynamic channel | ||
| reassembly before fragment retention via | ||
| `SvcProcessor::max_message_size`, `DvcProcessor::max_message_size`, and | ||
| `DrdynvcClient::with_max_transport_message_size`. | ||
|
|
||
| Wire the opt-in `remote-guard` feature through `ironrdp-connector`, the | ||
| async/blocking/Tokio drivers, `ironrdp-cfg`, `ironrdp-client`, | ||
| `ironrdp-daemon`, and `ironrdp-agent` (`--remote-guard` and | ||
| `ironrdp_remote_guard` with `Disabled`, `Negotiate`, `Ntlm`, and | ||
| `Kerberos` modes) backed by `sspi` 0.23.1. RCG requires `HYBRID` or | ||
| `HYBRID_EX` with `REDIRECTED_AUTHENTICATION_MODE_SUPPORTED`, strict TLS | ||
| validation, and a completed CredSSP context handoff, and omits | ||
| passwords, smart-card PINs, and auto-reconnect cookies from Client Info. |
Comment on lines
+12
to
+33
| ### <!-- 1 -->Features | ||
|
|
||
| - Use the `KdcResolution` enum instead of KDC url ([#1987](https://github.com/Devolutions/IronRDP/issues/1987)) ([d23348621a](https://github.com/Devolutions/IronRDP/commit/d23348621a05ee4fcc82de9bffd8806df0e3d789)) | ||
|
|
||
| This PR adds the `KdcResolution` enum, which specifies how Kerberos | ||
| should resolve the KDC, either by using IAKERB proxy or by connecting | ||
| directly to an external KDC specified by URL. | ||
|
|
||
| ### <!-- 5 -->Performance | ||
|
|
||
| - Disable Nagle on gateway sockets ([#2302](https://github.com/Devolutions/IronRDP/issues/2302)) ([bc3c09f6d4](https://github.com/Devolutions/IronRDP/commit/bc3c09f6d48541503ecc604bf3f9a72d42a7f809)) | ||
|
|
||
| Set TCP_NODELAY before TLS and proxy negotiation on gateway sockets so | ||
| small writes are not held by Nagle buffering. Share the connector across | ||
| direct and proxied RPCH/HTTP connections, matching the existing AVD and | ||
| RDCleanPath socket policy. | ||
|
|
||
| Propagate socket-option failures. Disabling this buffering can increase | ||
| the number of small TCP packets. | ||
|
|
||
| Add a loopback regression for numeric and hostname endpoints, and run it | ||
| from the standard CI test commands. |
Comment on lines
+13
to
+26
| - Read the DWT variant from REGION flags ([#2085](https://github.com/Devolutions/IronRDP/issues/2085)) ([43d75cd48e](https://github.com/Devolutions/IronRDP/commit/43d75cd48e8f2dee6ffa6388346dc53790fc7bb8)) | ||
|
|
||
| The Progressive decoder chose the DWT variant from bit 0 of the | ||
| RFX_PROGRESSIVE_CONTEXT flags. MS-RDPEGFX 2.2.4.2.1.4 defines that bit | ||
| as RFX_SUBBAND_DIFFING; the variant is bit 0 of each | ||
| RFX_PROGRESSIVE_REGION's flags (RFX_DWT_REDUCE_EXTRAPOLATE, | ||
| 2.2.4.2.1.5). Tiles decoded correctly only while a server set both bits | ||
| to the same value. | ||
|
|
||
| Each REGION now selects its own variant. The decoder kept the CONTEXT | ||
| value only for this choice, so its per-surface fallback and the | ||
| MissingBlock("CONTEXT") error are removed; CONTEXT is optional per | ||
| 2.2.4.2.1.4. A stream without CONTEXT for an unseen codec context now | ||
| decodes instead of failing. |
Comment on lines
+13
to
+36
| - Support Remote Credential Guard over RDPEAR ([#2256](https://github.com/Devolutions/IronRDP/issues/2256)) ([376eb8f566](https://github.com/Devolutions/IronRDP/commit/376eb8f56634e5c92d7137886e62ddeb6bbb280f)) | ||
|
|
||
| Remote Credential Guard redirects Kerberos and NTLMv2 operations over | ||
| the `Microsoft::Windows::RDS::AuthRedirection` dynamic virtual channel | ||
| (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead | ||
| of delegating credentials through CredSSP `TSTicketCreds`. | ||
|
|
||
| Add `ironrdp-rdpear` with `no_std`/`alloc` outer envelope framing, | ||
| strict ASN.1 DER `TSRemoteGuardInnerPacket` codecs, and portable NDR32 | ||
| type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM | ||
| request/response calls under both the published IDL profile and the | ||
| Windows-native wire profile. Bound inbound static and dynamic channel | ||
| reassembly before fragment retention via | ||
| `SvcProcessor::max_message_size`, `DvcProcessor::max_message_size`, and | ||
| `DrdynvcClient::with_max_transport_message_size`. | ||
|
|
||
| Wire the opt-in `remote-guard` feature through `ironrdp-connector`, the | ||
| async/blocking/Tokio drivers, `ironrdp-cfg`, `ironrdp-client`, | ||
| `ironrdp-daemon`, and `ironrdp-agent` (`--remote-guard` and | ||
| `ironrdp_remote_guard` with `Disabled`, `Negotiate`, `Ntlm`, and | ||
| `Kerberos` modes) backed by `sspi` 0.23.1. RCG requires `HYBRID` or | ||
| `HYBRID_EX` with `REDIRECTED_AUTHENTICATION_MODE_SUPPORTED`, strict TLS | ||
| validation, and a completed CredSSP context handoff, and omits | ||
| passwords, smart-card PINs, and auto-reconnect cookies from Client Info. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

🤖 New release
ironrdp-pdu: 0.11.0 -> 0.11.1 (✓ API compatible changes)ironrdp-svc: 0.10.0 -> 0.10.1 (✓ API compatible changes)ironrdp-dvc: 0.10.0 -> 0.10.1 (✓ API compatible changes)ironrdp-cfg: 0.3.0 -> 0.4.0 (⚠ API breaking changes)ironrdp-cliprdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)ironrdp-cliprdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)ironrdp-displaycontrol: 0.10.0 -> 0.10.1 (✓ API compatible changes)ironrdp-dvc-pipe-proxy: 0.7.0 -> 0.7.1 (✓ API compatible changes)ironrdp-graphics: 0.11.0 -> 0.11.1 (✓ API compatible changes)ironrdp-egfx: 0.5.0 -> 0.5.1 (✓ API compatible changes)ironrdp-mstsgu: 0.1.0 -> 0.1.1 (✓ API compatible changes)ironrdp-rdpadrv: 0.0.0ironrdp-rdpsnd: 0.11.0 -> 0.11.1 (✓ API compatible changes)ironrdp-rdpeci: 0.0.0ironrdp-rdpemsc: 0.0.0ironrdp-session: 0.13.0 -> 0.13.1 (✓ API compatible changes)ironrdp-rdpegt: 0.2.0 -> 0.2.1ironrdp-rdpel: 0.0.2 -> 0.0.3ironrdp-rdpevor: 0.2.0 -> 0.2.1ironrdp-rdpecam: 0.2.0 -> 0.2.1⚠
ironrdp-cfgbreaking changesChangelog
ironrdp-pduironrdp-svcironrdp-dvcironrdp-cfgironrdp-cliprdrironrdp-cliprdr-nativeironrdp-displaycontrolironrdp-dvc-pipe-proxyironrdp-graphicsironrdp-egfxironrdp-mstsguironrdp-rdpadrvironrdp-rdpsndironrdp-rdpeciironrdp-rdpemscironrdp-sessionThis PR was generated with release-plz.