v5.1.0

# Tinyauth v5.1.0

Hey everyone, this is Tinyauth v5.1.0, and Tinyauth is now officially OpenID Connect™ Certified thanks to the amazing help of @Rycochet and @scottmckendry. Additionally, this release brings a lot of improvements in access controls (deny-by-default and Kubernetes yay!), LDAP and general UX improvements. It also addresses some important security vulnerabilities ([1](https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-456h-ww26-f758), [2](https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g), [3](https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-9xhm-w3wj-xhqh)) that were responsibly disclosed by our amazing community. Have fun ;)

<img alt="OpenID Certified" width="200" src="https://openid.net/wordpress-content/uploads/2016/05/oid-l-certification-mark-l-cmyk-150dpi-90mm.jpg" />

*yep, we using that everywhere now*

> [!NOTE]
> [Tinyauth](https://github.com/tinyauthapp) has moved! All repositories now live under the new [Tinyauth](https://github.com/tinyauthapp) organization. Pull the new image from `ghcr.io/tinyauthapp/tinyauth`. The old image under my personal account **will no longer be updated**, so switch over when you can.

> [!NOTE]
> The config file is now a **stable** feature. Please switch your configuration file flag to `--configfile` (or `TINYAUTH_CONFIGFILE` for environment variables).

> [!WARNING]
> This release contains **security fixes**. Please update as soon as possible.

> [!WARNING]
> Tinyauth v5.1.0 includes some hardening in the trusted proxies. In case you are using any of the IP ACLs, you may need to specify your proxy IP in `TINYAUTH_AUTH_TRUSTEDPROXIES`.
## New Features

**Authentication & Access Controls**

- Support for authentication through Tailscale
- Deny-by-default access controls
- Annotation-based access controls in Kubernetes @contre95
- Global bypass by IP @scottmckendry
- Provider-specific OAuth whitelists @puneetdixit200
- OAuth whitelist file support @djedditt
- Allow for `NO_PROXY`, `HTTP_PROXY` and `HTTPS_PROXY` for OAuth requests @florianilch

**OpenID Connect**

- Expose all OpenID Connect claims through user attributes @scottmckendry
- Run Tinyauth on a top-level domain to use it as a standalone OIDC provider @jacekkow
- `POST` request support on the OIDC authorize endpoint
- WebFinger support
- Support for `prompt` parameter in OIDC
- Support for `max_age` in OIDC

**Database & Config**

- PostgreSQL as a database backend @scottmckendry
- LDAP bind password file support @Rycochet
- Config file loading is now stable, you will need to rename your CLI flag from `--experimental.configfile` to `--configfile`
- Option to disable lockdown mode
- Attempt to reconnect to LDAP server on start-up
- Support for anonymous LDAP bind @nv6

**Frontend**

- Merge language and theme selector in new quick actions menu
## Improvements

- Preserve login parameters throughout the frontend
- Graceful shutdown on `SIGTERM`
- Pass through the LDAP mail attribute instead of crafting one when it's available
- Rework CLI commands for simpler and more intuitive output
## Fixes

- Fix open redirect vulnerability in the OpenID Connect server @Dredsen
- Use the loaded public key in the OpenID Connect server when available @Dredsen
- Fix lax trusted proxies configuration in IP ACLs
- Remove lockdown mode and rework rate-limiting
## Technical

- Rework dependency injection with Dig
- Rework the user context middleware
- Rework frontend user/app context API paths (changes in `/api/context/app` and `/api/context/user`)
- Switch package manager from Bun to PNPM
- Update dependencies and translations

## New Contributors
- @Rycochet made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/793
- @contre95 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/627
- @djedditt made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/826
- @itasli made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/834
- @Dredsen made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/854
- @puneetdixit200 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/882
- @nv6 made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/979
- @florianilch made their first contribution in https://github.com/tinyauthapp/tinyauth/pull/999

**Full Changelog**: https://github.com/tinyauthapp/tinyauth/compare/v5.0.7...v5.1.0