[devolutionsbot]

🤖 New release

• ironrdp-svc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-dvc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-cfg: 0.3.0 -> 0.4.0 (⚠ API breaking changes)
• ironrdp-cliprdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-cliprdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-graphics: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-mstsgu: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• ironrdp-rdpeusb: 0.1.0 -> 0.2.0
• ironrdp-rdpsnd-native: 0.7.0 -> 0.8.0
• ironrdp-session: 0.12.0 -> 0.13.0
• ironrdp-dvc-com-plugin: 0.2.0 -> 0.3.0
• ironrdp-rdpdr-native: 0.8.0 -> 0.9.0
• ironrdp-rpc: 0.1.0 -> 0.2.0
• ironrdp-rdpegt: 0.2.0 -> 0.2.1
• ironrdp-rdpel: 0.0.2 -> 0.0.3
• ironrdp-rdpevor: 0.2.0 -> 0.2.1
• ironrdp-rdpecam: 0.2.0 -> 0.2.1

⚠ ironrdp-cfg breaking changes

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/trait_method_added.ron

Failed in:
  trait method ironrdp_cfg::PropertySetExt::remote_guard_mode in file /tmp/.tmp5F5CMI/IronRDP/crates/ironrdp-cfg/src/lib.rs:618
  trait method ironrdp_cfg::PropertySetExt::set_remote_guard_mode in file /tmp/.tmp5F5CMI/IronRDP/crates/ironrdp-cfg/src/lib.rs:621
  trait method ironrdp_cfg::PropertySetExt::clear_remote_guard_mode in file /tmp/.tmp5F5CMI/IronRDP/crates/ironrdp-cfg/src/lib.rs:623

Changelog

ironrdp-svc

[0.10.1] - 2026-10-28

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

ironrdp-dvc

[0.10.1] - 2026-10-28

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

ironrdp-cfg

[0.4.0] - 2026-10-28

Features

• Support AVD gateway orchestration, WAM, and OAuth2 auth (#2247) (c58f568711)

  Azure Virtual Desktop connections using gatewaybrokeringtype:i:1
  negotiate session placement and gateway routing through an HTTPS
  orchestration endpoint (/api/v2/connections or
  /api/arm/v2/connections) before upgrading to a WebSocket gateway
  transport and authenticating the target session host with Entra RDS AAD
  Proof-of-Possession tokens.

  Add AVD gateway orchestration, WWW-Authenticate: Claims:... challenge
  parsing, Windows Web Account Manager (WebAuthenticationCoreManager)
  silent and interactive token acquisition, and a cross-platform
  OAuthAvdTokenProvider supporting silent refresh-token exchange,
  loopback PKCE browser login, OAuth2 device-code fallback, persistent
  per-user refresh-token caching, and refresh-to-PoP host token minting.
  Decode redirectedServerCert and redirectedAuthBlob payloads, wire
  Shortpath UDP peer endpoints (GatewayConnectionInfo::udp_peer),
  preserve load_balance_info and target_certificate across mid-session
  AVD redirections, and add companion <rdp_file>.json UserName lookup
  and --prop KEY:TYPE:VALUE overrides in ironrdp-daemon,
  ironrdp-agent, and ironrdp-viewer.

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

ironrdp-cliprdr

[0.9.1] - 2026-10-28

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-cliprdr-native

[0.9.1] - 2026-10-28

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-graphics

[0.11.1] - 2026-10-28

Bug Fixes

• Fix RemoteFX quantization, DWT rounding, and pointer alpha (#2263) (cf15d041c3)

  Round RemoteFX wavelet coefficients during quantization using (value + (1 << (factor - 1))) >> factor with widened i32 intermediates as
  specified in [MS-RDPRFX] 3.1.8.1.5 instead of unrounded arithmetic
  right-shifting, which floored negative coefficients in [-(scale / 2), -1] to -1 and produced color speckles on smooth gradients and icons.

  Use ceiling average (a + b + 1) >> 1 in forward DWT low-pass sub-bands
  to match the [MS-RDPRFX] 3.1.8.2.4 inverse DWT lifting step.

  Premultiply software pointer RGB channels by normalized alpha instead of
  squaring each color component.

ironrdp-mstsgu

[0.1.1] - 2026-10-28

Features

• Use the KdcResolution enum instead of KDC url (#1987) (d23348621a)

  This PR adds the KdcResolution enum, which specifies how Kerberos
  should resolve the KDC, either by using IAKERB proxy or by connecting
  directly to an external KDC specified by URL.

ironrdp-rdpeusb

[0.2.0] - 2026-10-27

Features

• [breaking] Add DeviceInfo::isochronous; ADD_DEVICE advertises a no-ack isochronous jitter buffer only when it is set (#2181) (35247071a3)

• Add encode_ts_urb and decode_ts_urb_result to TsUrbInPacket and TsUrbOutPacket, for backends that hand TS_URBs to the operating system (#2181) (35247071a3)

• CANCEL_REQUEST keeps the request pending until the backend completes it (#2181) (35247071a3)

Bug Fixes

• Accept REGISTER_REQUEST_CALLBACK interface IDs below 4, which Windows sends; the session ended right after a device was announced (#2181) (35247071a3)

• Accept control requests without a data stage in TRANSFER_IN_REQUEST messages that keep the OUT direction, as Windows sends them (#2181) (35247071a3)

• A refused device channel no longer uses up an interface ID (#2181) (35247071a3)

• Decoding truncated input returns an error instead of panicking (#2130) (b69cda22ec)

Build

• [breaking] Update ironrdp-dvc public dependency to 0.10

• [breaking] Update ironrdp-pdu public dependency to 0.11

ironrdp-rdpsnd-native

[0.8.0] - 2026-10-27

Features

• [breaking] Decode every server format the backend supports, including AAC through Media Foundation on Windows behind the default aac feature, and remove DecodeStream (#2203) (45b67591e9)

• Play through a jitter buffer with a configurable latency target (PlaybackConfig, DEFAULT_PLAYBACK_LATENCY) and report buffered plus device latency (#2203) (45b67591e9)

• Select playback and capture devices with DeviceSelector, and list them with list_devices (#2203) (45b67591e9)

• Map the server volume to the Windows audio session (#2203) (45b67591e9)

• Add MS-RDPEAI microphone capture behind the capture feature: RdpeaiCaptureBackend captures 16-bit PCM (#1642) (205fe038cc)

• Capture encodes to PCM, G.711 or ADPCM (#2203) (45b67591e9)

• Keep the client's format order, play Wave PDUs from servers older than RDPSND version 8, and apply the server volume to more PCM formats (#1648) (2d9a9bf114)

Bug Fixes

• Stop blocking the real-time playback callback (#1803) (850f654673)

Build

• Raise the minimum supported Rust version to 1.94 (#1495) (0aeea76e95)

• Add the optional ironrdp-rdpeai 0.2 public dependency, enabled by capture

• [breaking] Update ironrdp-rdpsnd public dependency to 0.11

ironrdp-session

[0.13.0] - 2026-10-27

Features

• [breaking] Add ActiveStageOutput::WindowSurfaceUpdates for EGFX surfaces mapped to RemoteApp windows (#2197) (6e54d5e9ec)

• [breaking] Add ActiveStageOutput::SessionId and ActiveStageOutput::LogonErrors, reported from Save Session Info PDUs (#2211) (98413f16cc)

• Add composite_graphics_pipeline and CompositedGraphics, to composite EGFX output from a GraphicsPipelineClient running outside ActiveStage (#2120) (c25dba154b)

Bug Fixes

• The QOIZ decompressor no longer loops forever on an empty update (#2147) (b343a6f9d3)

Build

• [breaking] Update ironrdp-dvc public dependency to 0.10

• [breaking] Update ironrdp-egfx public dependency to 0.5

• [breaking] Update ironrdp-graphics public dependency to 0.11

• [breaking] Update ironrdp-pdu public dependency to 0.11

• [breaking] Update ironrdp-rdpei public dependency to 0.3

• [breaking] Update ironrdp-svc public dependency to 0.10

ironrdp-dvc-com-plugin

[0.3.0] - 2026-10-27

Build

• Declare ironrdp-dvc, ironrdp-pdu and ironrdp-svc as public dependencies, since load_dvc_plugin exposes their types (#2213) (405e6576ba)

• [breaking] Update ironrdp-dvc public dependency to 0.10

• [breaking] Update ironrdp-pdu public dependency to 0.11

• [breaking] Update ironrdp-svc public dependency to 0.10

ironrdp-rdpdr-native

[0.9.0] - 2026-10-27

Bug Fixes

• The Unix drive backend opens server paths one component at a time inside the share and refuses .., symbolic links and mount points that lead outside it (#2221) (bbebd384ce)

• Refuse names Windows cannot hold with STATUS_OBJECT_NAME_INVALID, and open without blocking, so a FIFO in the share cannot stall the client (#2221) (bbebd384ce)

• Create, rename, delete and directory queries follow MS-FSA and report the NT status the Windows backend reports (#2221) (bbebd384ce)

• Cap open files at a quarter of the descriptor limit, at most 1024 (#2221) (bbebd384ce)

Build

• [breaking] Update ironrdp-pdu public dependency to 0.11

• [breaking] Update ironrdp-rdpdr public dependency to 0.9

• [breaking] Update ironrdp-svc public dependency to 0.10

ironrdp-rpc

[0.2.0] - 2026-10-27

Build

• [breaking] Update ironrdp-input public dependency to 0.9

• [breaking] Update ironrdp-rdpei public dependency to 0.3

---

This PR was generated with release-plz.

[Copilot]

🟡 Changes recommended

Breaking public-dependency updates are not consistently reflected in consumer release versions and migration notes.

5 open issues

• Public connector API break requires major release · New
• Futures adapter exposes incompatible async 0.13 types · New
• Public async dependency upgrade requires major release · New
• Public dependency upgrades break patch-version consumers · New
• Changelog omits breaking Kerberos API migration · New

What changed in this PR

Prepares IronRDP crates for publication after the Kerberos configuration API change, updating release versions and dependency requirements across the workspace.

Changes:

• Bumps connector, async, and acceptor to 0.13.0 and adds patch releases for several consumers.
• Updates dependent crates to use the new connection APIs.
• Adds release changelog sections and synchronizes the workspace lockfile.

File	Description
crates/​ironrdp/​Cargo.toml	Updates facade dependency requirements.
crates/​ironrdp-vmconnect/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-vmconnect/​Cargo.toml	Bumps version and connection dependencies.
crates/​ironrdp-tokio/​CHANGELOG.md	Adds the 0.12.1 release heading.
crates/​ironrdp-tokio/​Cargo.toml	Bumps version and async/connector requirements.
crates/​ironrdp-server/​Cargo.toml	Updates connection-stack dependencies.
crates/​ironrdp-rdpeudp-tokio/​Cargo.toml	Requires async 0.13.
crates/​ironrdp-mstsgu/​CHANGELOG.md	Adds Kerberos-related release notes.
crates/​ironrdp-mstsgu/​Cargo.toml	Bumps gateway crate to 0.1.1.
crates/​ironrdp-futures/​Cargo.toml	Requires async 0.13.
crates/​ironrdp-connector/​CHANGELOG.md	Documents the KDC-resolution change.
crates/​ironrdp-connector/​Cargo.toml	Bumps connector to 0.13.0.
crates/​ironrdp-client/​Cargo.toml	Updates connector and gateway requirements.
crates/​ironrdp-blocking/​CHANGELOG.md	Adds the 0.12.1 release heading.
crates/​ironrdp-blocking/​Cargo.toml	Bumps version and connector requirement.
crates/​ironrdp-async/​CHANGELOG.md	Adds the 0.13.0 release heading.
crates/​ironrdp-async/​Cargo.toml	Bumps async and requires connector 0.13.
crates/​ironrdp-agent/​Cargo.toml	Updates the gateway requirement.
crates/​ironrdp-activex/​Cargo.toml	Updates the connector requirement.
crates/​ironrdp-acceptor/​CHANGELOG.md	Adds the 0.13.0 release heading.
crates/​ironrdp-acceptor/​Cargo.toml	Bumps acceptor and its public dependencies.
Cargo.lock	Records updated workspace package versions.

_{Review effort: Balanced}