[devolutionsbot]

🤖 New release

• winscard: 0.4.0 -> 0.4.1 (✓ API compatible changes)
• sspi: 0.23.0 -> 0.23.1 (✓ API compatible changes)
• kdc: 0.1.1 -> 0.1.2 (✓ API compatible changes)

Changelog

winscard

[0.4.1] - 2026-10-27

Security

• Add support for IAKerb extension for Kerberos client (#751) (a738671298)

  This PR adds support for the IAKERB extension according to the IAKERB
  specification.

  The main changes are focused on the Kerberos state machine.
  Previously, the Preauthentication state handled the entire KDC message
  exchange withing a single async intialize_security_context call. This
  approach does not work with IAKERB, where KDC messages are exchanged via
  a server that acts as a proxy. The Preauthentication state has
  therefore been split into multiple states, allowing the state machine to
  save Kerberos state between KDC message exchanges.

  Additionaly, the AS and TGS exchanges have been extracted into
  separate state machines. These new state machines are KDC
  transport-agnostic and can be used with both external KDC and an IAKERB
  proxy.

sspi

[0.23.1] - 2026-10-27

Security

• Add support for IAKerb extension for Kerberos client (#751) (a738671298)

  This PR adds support for the IAKERB extension according to the IAKERB
  specification.

  The main changes are focused on the Kerberos state machine.
  Previously, the Preauthentication state handled the entire KDC message
  exchange withing a single async intialize_security_context call. This
  approach does not work with IAKERB, where KDC messages are exchanged via
  a server that acts as a proxy. The Preauthentication state has
  therefore been split into multiple states, allowing the state machine to
  save Kerberos state between KDC message exchanges.

  Additionaly, the AS and TGS exchanges have been extracted into
  separate state machines. These new state machines are KDC
  transport-agnostic and can be used with both external KDC and an IAKERB
  proxy.

kdc

[0.1.2] - 2026-10-27

Bug Fixes

• Enforce the sequence number of MIC token only for acce… (#772) (08d8622794)

  This PR fixes #748
  by enforcing sequence number verification only on the acceptor side. The
  initiator verifies the MIC checksum without enforcing the sequence
  number.

---

This PR was generated with release-plz.

[Copilot]

🟢 Approval recommended

The release metadata is consistent, and the dependency refresh matches the configured release-plz workflow.

0 open findings

What changed in this PR

Prepares the sspi 0.23.1 patch release containing the qualified-name parsing fix.

Changes:

• Bumps sspi from 0.23.0 to 0.23.1.
• Adds the release changelog entry.
• Refreshes locked dependencies through release-plz.

File	Description
CHANGELOG.md	Documents the 0.23.1 bug fix.
Cargo.toml	Updates the crate version.
Cargo.lock	Updates the package version and resolved dependencies.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.