Derive OIDC and SAML browser-session principals from provider-scoped subjects instead of mutable username or email claims.
Preserve compatibility by migrating legacy username/email RBAC assignments to the stable SSO principal when no authoritative group mapping is present, and pin the invariant in API/security contracts.
Resolve hosted magic-link verification through current organization membership so sessions bind to the stored stable user principal instead of token email.
Add the v6 identity invariant contract and static guards covering hosted handoff, checkout, provisioning, and magic-link boundaries.
Use stable control-plane user IDs as hosted tenant organization principals while preserving email as contact metadata and legacy fallback. Cloud handoff sessions now bind to the signed subject instead of email, seeded tenant orgs store owner/member email separately from durable user IDs, and the subsystem contracts pin that boundary.
Treat OIDC, SAML, and multi-provider SSO as included Community capabilities while retaining advanced_sso as a compatibility key. Remove SAML-specific paywalls and paid-upgrade copy from runtime, settings UI, entitlement snapshots, docs, journey proof, and subsystem contracts.
Refs #1449
Document the continued RC3 issue/discussion sweep after v5.1.29 publication, including the current latest-release state, newest public threads, and confirmation that the remaining v5 maintenance fixes are already covered in v6.
Refs #1447
Use the canonical Docker host identity for token bindings after a matched reconnect, preserve previous/current identity aliases for recreated containers, and keep rejecting token reuse by genuinely different Docker hosts.
Record the RC3 release-gate evidence for the Docker-in-LXC reconnect path.
Preserve the most severe Proxmox connection member state so offline members roll up correctly.
Move history-chart tooltips beside the hovered point when space allows and resolve PBS metric alerts against PBS thresholds during config reevaluation.
Refs #1441
Refs #1452
Refs https://github.com/rcourtman/Pulse/discussions/1448
Bumps frontend-modern DOMPurify from ^3.4.0 / 3.4.0 to ^3.4.1 / 3.4.1 and PostCSS from ^8.4.0 / 8.5.6 to ^8.5.13 / 8.5.13.
Keeps pulse/v6-release aligned with the default-branch Dependabot fixes for GHSA-39q2-94rc-95cp and GHSA-qx2v-qp2m-jg93.
Verification: npm ci, npm audit --audit-level=moderate, npm run type-check, npm run build, npm run lint, status_audit.py --check, registry_audit.py --check from the canonical workspace. Full npm test remains red on origin/pulse/v6-release with the same targeted baseline failures unrelated to these dependency changes.
Every page URL-syncs its search through `?q=...` (Infrastructure,
Workloads, Recovery, Storage all use the same convention via
`routeStateNavigation`), and `useSavedViews.saveCurrent` snapshots the
full URL search string. So saved views already capture both the active
filter chips and the search term, and applying a view later restores
both.
Adds a SharedPrimitives guardrail assertion that pins the
`window.location.search` snapshot in saveCurrent. A future refactor
that narrowed the snapshot to a curated subset of URL params would
silently strip search from saved views; this assertion catches that.
rcourtman