[devolutionsbot]

🤖 New release

• ironrdp-pdu: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-svc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-dvc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-cfg: 0.3.0 -> 0.4.0 (⚠ API breaking changes)
• ironrdp-cliprdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-cliprdr-format: 0.3.0 -> 0.3.1 (✓ API compatible changes)
• ironrdp-cliprdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-displaycontrol: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-dvc-pipe-proxy: 0.7.0 -> 0.7.1 (✓ API compatible changes)
• ironrdp-graphics: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-egfx: 0.5.0 -> 0.5.1 (✓ API compatible changes)
• ironrdp-mstsgu: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• ironrdp-rdpadrv: 0.0.0
• ironrdp-rdpdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-rdpsnd: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-rdpeci: 0.0.0
• ironrdp-rdpemsc: 0.0.0
• ironrdp-session: 0.13.0 -> 0.13.1 (✓ API compatible changes)
• ironrdp-rdpdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-rdpegt: 0.2.0 -> 0.2.1
• ironrdp-rdpel: 0.0.2 -> 0.0.3
• ironrdp-rdpevor: 0.2.0 -> 0.2.1
• ironrdp-rdpecam: 0.2.0 -> 0.2.1

⚠ ironrdp-cfg breaking changes

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/trait_method_added.ron

Failed in:
  trait method ironrdp_cfg::PropertySetExt::remote_guard_mode in file /tmp/.tmp6Ll5uG/IronRDP/crates/ironrdp-cfg/src/lib.rs:618
  trait method ironrdp_cfg::PropertySetExt::set_remote_guard_mode in file /tmp/.tmp6Ll5uG/IronRDP/crates/ironrdp-cfg/src/lib.rs:621
  trait method ironrdp_cfg::PropertySetExt::clear_remote_guard_mode in file /tmp/.tmp6Ll5uG/IronRDP/crates/ironrdp-cfg/src/lib.rs:623

Changelog

ironrdp-pdu

[0.11.1] - 2026-11-07

Security

• Withhold licensing secrets from Debug output (#2344) (5c4dcfa7b1)

  The licensing PDUs derived Debug, so a log at the debug or trace level
  printed the premaster secret, the MAC salt and license keys, the client
  and server randoms, the encrypted HWID, the platform challenge and its
  response, and the license itself, as the server sent it, byte by byte;
  also the user and machine names the client announces. Such a log can't
  be handed to anyone.

  Those fields now print as their length only (<48 bytes withheld>), in
  Debug implementations of their own. The server certificate's material
  (chain, modulus, signature) is public but prints the same way, for a
  different reason: a derived Debug writes its kilobytes as a decimal list
  that buries the rest of the exchange, while the lengths tell the key
  size and the chain's shape. What tells an exchange apart stays: the
  security and license headers (message type, flags, version, size), the
  product and scope, the public exponent, error codes and state
  transitions. The connector also logs the Server License Request, the
  client's reply to it, and the error message that ends an exchange
  without one at the debug level, as it already did the later PDUs, so
  that a debug log shows the whole exchange.

Bug Fixes

• Read the DWT variant from REGION flags (#2085) (43d75cd48e)

  The Progressive decoder chose the DWT variant from bit 0 of the
  RFX_PROGRESSIVE_CONTEXT flags. MS-RDPEGFX 2.2.4.2.1.4 defines that bit
  as RFX_SUBBAND_DIFFING; the variant is bit 0 of each
  RFX_PROGRESSIVE_REGION's flags (RFX_DWT_REDUCE_EXTRAPOLATE,
  2.2.4.2.1.5). Tiles decoded correctly only while a server set both bits
  to the same value.

  Each REGION now selects its own variant. The decoder kept the CONTEXT
  value only for this choice, so its per-surface fallback and the
  MissingBlock("CONTEXT") error are removed; CONTEXT is optional per
  2.2.4.2.1.4. A stream without CONTEXT for an unseen codec context now
  decodes instead of failing.

ironrdp-svc

[0.10.1] - 2026-11-07

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

• Tag reassembly with recipient context (#2271) (5a919df846)

  Add SvcProcessor::message_context and
  SvcProcessor::process_with_context so static virtual channels with
  replaceable recipients can discard inbound data when no recipient is
  attached and drop partial fragment sequences when the recipient changes
  mid-message.

  ChunkProcessor continues counting received fragment bytes against both
  the declared message length and the configured maximum message size even
  after discarding buffered bytes, preserving framing validation across
  recipient changes.

ironrdp-dvc

[0.10.1] - 2026-11-07

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

Bug Fixes

• Harden channel lifecycle and pipe proxy (#2275) (a28a57e4f1)

  Emit a single DATA PDU for empty and 1,590-byte DVC messages instead
  of dropping zero-length payloads or starting 1,590-byte payloads with
  DATA_FIRST.

  Add DrdynvcServer::is_ready and
  DrdynvcServer::create_channel_boxed_with, suppress ClosePdu for
  pending or failed server channels, discard late in-flight data and
  cancelled CreateResponse PDUs for retired channel IDs, and close only
  the offending dynamic channel when a server processor's
  max_message_size limit is exceeded.

  Add DvcNamedPipeProxy::new_async, cancel pending pipe writes and
  reconnect sleeps on proxy drop without blocking the Tokio I/O driver,
  and register client DVC pipe proxies through a channel factory with
  async backpressure on the RDP input queue.

ironrdp-cfg

[0.4.0] - 2026-11-07

Features

• Support AVD gateway orchestration, WAM, and OAuth2 auth (#2247) (c58f568711)

  Azure Virtual Desktop connections using gatewaybrokeringtype:i:1
  negotiate session placement and gateway routing through an HTTPS
  orchestration endpoint (/api/v2/connections or
  /api/arm/v2/connections) before upgrading to a WebSocket gateway
  transport and authenticating the target session host with Entra RDS AAD
  Proof-of-Possession tokens.

  Add AVD gateway orchestration, WWW-Authenticate: Claims:... challenge
  parsing, Windows Web Account Manager (WebAuthenticationCoreManager)
  silent and interactive token acquisition, and a cross-platform
  OAuthAvdTokenProvider supporting silent refresh-token exchange,
  loopback PKCE browser login, OAuth2 device-code fallback, persistent
  per-user refresh-token caching, and refresh-to-PoP host token minting.
  Decode redirectedServerCert and redirectedAuthBlob payloads, wire
  Shortpath UDP peer endpoints (GatewayConnectionInfo::udp_peer),
  preserve load_balance_info and target_certificate across mid-session
  AVD redirections, and add companion <rdp_file>.json UserName lookup
  and --prop KEY:TYPE:VALUE overrides in ironrdp-daemon,
  ironrdp-agent, and ironrdp-viewer.

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

ironrdp-cliprdr

[0.9.1] - 2026-11-07

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-cliprdr-format

[0.3.1] - 2026-11-07

Bug Fixes

• Decode standard CF_DIB bitfields (#2374) (4134dc272f)

  Windows commonly supplies 32-bit CF_DIB clipboard images with
  BI_BITFIELDS compression and standard BGR masks. Rejecting that layout
  prevents clipboard image pastes.

  Validate and skip the three masks before decoding pixels, and include
  them in the validated logical length. Keep non-standard masks and 24-bit
  bitfields unsupported, and preserve RGB and DIBV5 decoding.

ironrdp-cliprdr-native

[0.9.1] - 2026-11-07

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-displaycontrol

[0.10.1] - 2026-11-07

Bug Fixes

• Wait for new caps on a reopened channel (#2296) (06cdca22f3)

  A display control channel the server closes and reopens could send a
  monitor layout before the server's new capabilities arrived.

  Keep pre-registered channel processors available for reopening, but
  clear DisplayControl capabilities on close so layouts wait for fresh
  server capabilities. Custom listeners and factories retain control over
  subsequent opens. Release EGFX graphics state when the channel closes,
  after saving its persistent bitmap cache, and wait for pipe proxy
  workers and pending filesystem operations to finish before starting a
  replacement.

ironrdp-dvc-pipe-proxy

[0.7.1] - 2026-11-07

Bug Fixes

• Harden channel lifecycle and pipe proxy (#2275) (a28a57e4f1)

  Emit a single DATA PDU for empty and 1,590-byte DVC messages instead
  of dropping zero-length payloads or starting 1,590-byte payloads with
  DATA_FIRST.

  Add DrdynvcServer::is_ready and
  DrdynvcServer::create_channel_boxed_with, suppress ClosePdu for
  pending or failed server channels, discard late in-flight data and
  cancelled CreateResponse PDUs for retired channel IDs, and close only
  the offending dynamic channel when a server processor's
  max_message_size limit is exceeded.

  Add DvcNamedPipeProxy::new_async, cancel pending pipe writes and
  reconnect sleeps on proxy drop without blocking the Tokio I/O driver,
  and register client DVC pipe proxies through a channel factory with
  async backpressure on the RDP input queue.

ironrdp-graphics

[0.11.1] - 2026-11-07

Bug Fixes

• Fix RemoteFX quantization, DWT rounding, and pointer alpha (#2263) (cf15d041c3)

  Round RemoteFX wavelet coefficients during quantization using (value + (1 << (factor - 1))) >> factor with widened i32 intermediates as
  specified in [MS-RDPRFX] 3.1.8.1.5 instead of unrounded arithmetic
  right-shifting, which floored negative coefficients in [-(scale / 2), -1] to -1 and produced color speckles on smooth gradients and icons.

  Use ceiling average (a + b + 1) >> 1 in forward DWT low-pass sub-bands
  to match the [MS-RDPRFX] 3.1.8.2.4 inverse DWT lifting step.

  Premultiply software pointer RGB channels by normalized alpha instead of
  squaring each color component.

• Read the DWT variant from REGION flags (#2085) (43d75cd48e)

  The Progressive decoder chose the DWT variant from bit 0 of the
  RFX_PROGRESSIVE_CONTEXT flags. MS-RDPEGFX 2.2.4.2.1.4 defines that bit
  as RFX_SUBBAND_DIFFING; the variant is bit 0 of each
  RFX_PROGRESSIVE_REGION's flags (RFX_DWT_REDUCE_EXTRAPOLATE,
  2.2.4.2.1.5). Tiles decoded correctly only while a server set both bits
  to the same value.

  Each REGION now selects its own variant. The decoder kept the CONTEXT
  value only for this choice, so its per-surface fallback and the
  MissingBlock("CONTEXT") error are removed; CONTEXT is optional per
  2.2.4.2.1.4. A stream without CONTEXT for an unseen codec context now
  decodes instead of failing.

ironrdp-egfx

[0.5.1] - 2026-11-07

Bug Fixes

• Drop AVC444 updates whose views cannot combine (#2286) (f01f9b5aab)

  Follow-up to feat(client)!: use H.264 and AVC444 graphics by default #2199, carrying over two guards from feat(egfx)!: decode AVC444v2 #2112.

  A chroma-only AVC444 update for a surface with no picture yet created a
  black picture and painted the chroma over it. An update whose main and
  auxiliary views differ in size combined two pictures into one, painting
  the wrong chroma over the main view.

  Both now return an error from decode_avc444, so they count as dropped
  updates with the usual rate-limited warning, and paint nothing. A
  mismatched update is dropped whole, main view included, rather than
  degraded to its main view.

  Frames are only cleared where the surface itself goes away (capability
  reset, ResetGraphics, create and delete surface), so a legitimate
  chroma-only update never arrives without a picture.

• Wait for new caps on a reopened channel (#2296) (06cdca22f3)

  A display control channel the server closes and reopens could send a
  monitor layout before the server's new capabilities arrived.

  Keep pre-registered channel processors available for reopening, but
  clear DisplayControl capabilities on close so layouts wait for fresh
  server capabilities. Custom listeners and factories retain control over
  subsequent opens. Release EGFX graphics state when the channel closes,
  after saving its persistent bitmap cache, and wait for pipe proxy
  workers and pending filesystem operations to finish before starting a
  replacement.

ironrdp-mstsgu

[0.1.1] - 2026-11-07

Features

• Use the KdcResolution enum instead of KDC url (#1987) (d23348621a)

  This PR adds the KdcResolution enum, which specifies how Kerberos
  should resolve the KDC, either by using IAKERB proxy or by connecting
  directly to an external KDC specified by URL.

Performance

• Disable Nagle on gateway sockets (#2302) (bc3c09f6d4)

  Set TCP_NODELAY before TLS and proxy negotiation on gateway sockets so
  small writes are not held by Nagle buffering. Share the connector across
  direct and proxied RPCH/HTTP connections, matching the existing AVD and
  RDCleanPath socket policy.

  Propagate socket-option failures. Disabling this buffering can increase
  the number of small TCP packets.

  Add a loopback regression for numeric and hostname endpoints, and run it
  from the standard CI test commands.

ironrdp-rdpadrv

[0.0.0] - 2026-11-07

Features

• Add MultiPoint audio level and drive letter persistence channels (#2322) (8301ee04d3)

  Implements [MS-RDPADRV] (Audio Level and Drive Letter Persistence
  Virtual Channel Extension), which Windows MultiPoint Server uses to have
  the client remember the session's master volume levels and the drive
  letters assigned to redirected USB storage, and restore them on the next
  connection.

ironrdp-rdpdr

[0.9.1] - 2026-11-07

Bug Fixes

• Announce drive names as 8-bit characters (#2342) (4cd9d45060)

  Windows shows a redirected drive under the first letter of its name: on
  Windows 11 (build 26300), a drive named trd rw is \\tsclient\t, and
  \\tsclient\trd rw is not found; Windows Server 2022 and 2025 do the
  same. The client announces the drive's full name in DeviceData as a
  null-terminated UTF-16 string, as MS-RDPEFS 2.2.3.1 asks with
  DRIVE_CAPABILITY_VERSION_02, but Windows reads the field as 8-bit
  characters, so the zero byte after the first letter ends the name.

  The name now goes as 8-bit characters, null-terminated. FreeRDP's client
  writes it this way too, also with DRIVE_CAPABILITY_VERSION_02, and so
  does rdesktop's. Characters outside ASCII become _, and so do a NUL,
  which would end the name early, and the characters MS-RDPEFS 2.2.1.3
  forbids in PreferredDosName (<, >, ", /, \, |, and a colon
  before the end), for which Windows refuses an 8-bit name; FreeRDP
  replaces those too. A trailing colon stays: a drive announced as C: is
  \\tsclient\C. Names that differ only outside ASCII are announced
  alike. A server that decodes the field as UTF-16, as the specification
  says, would misread the name; xrdp names drives from PreferredDosName,
  which is unchanged.

ironrdp-rdpsnd

[0.11.1] - 2026-11-07

Bug Fixes

• Echo the server's wPackSize in the Training Confirm (#2294) (f86e3c49f3)

  GNOME Remote Desktop sends IronRDP no audio, because the client's
  Training Confirm carries the wrong wPackSize.

  The Training Confirm must echo the Training PDU's wPackSize, the size of
  the whole PDU ([MS-RDPEA] 2.2.3.2). The client sent the length of the
  data after the fields instead, 8 bytes short. The FreeRDP server library
  hands the value to its TrainingConfirm callback, and GNOME Remote
  Desktop's rejects it.

ironrdp-rdpeci

[0.0.0] - 2026-11-07

Features

• Add MS-RDPECI core input dynamic channel (#2319) (fbf2599863)

  Add the ironrdp-rdpeci crate with the MS-RDPECI PDUs and a client
  processor for the Microsoft::Windows::RDS::CoreInput dynamic channel.
  Input events reuse the fast-path input event type, since MS-RDPECI packs
  events in the same format.

  The client can opt in with the core-input feature and
  ChannelConfig::core_input. Once the server opens the channel and selects
  version 1.0, keyboard and mouse input is sent over it; otherwise input
  stays on fast-path.

ironrdp-rdpemsc

[0.0.0] - 2026-11-07

Features

• Add the MS-RDPEMSC mouse cursor dynamic channel (#2321) (bbd1b879ce)

  Implements [MS-RDPEMSC] (the Microsoft::Windows::RDS::MouseCursor
  dynamic channel) and connects it to the client's existing pointer
  handling.

  The channel is off by default because it hasn't been run against a
  real Windows or AVD server yet. With it off, the client declines the
  channel as before, and pointer updates stay on the fast path. To turn it
  on, call ConfigBuilder::with_mouse_cursor_channel(true):

  let builder = builder.with_mouse_cursor_channel(true);

  You can also set ChannelConfig::mouse_cursor = true directly.

ironrdp-session

[0.13.1] - 2026-11-07

Features

• Expose display control readiness and capabilities (#2285) (851747a1c7)

  ActiveStage.EncodedResize returns null until the Display Control
  channel has received the server's capabilities, and the .NET binding
  gave a client no way to tell when that happens, so clients polled or
  retried blindly.

  Add ActiveStage.DisplayControlState (Unavailable, Pending,
  Ready) and ActiveStage.DisplayControlCapabilities (MaxNumMonitors,
  MaxMonitorArea), wrapping
  ironrdp_session::ActiveStage::display_control_ready and
  display_control_capabilities. A client checks the state after each
  Process call and sends its first resize once it becomes Ready.

  display_control_ready now takes &self, which Diplomat requires for a
  getter; it never needed &mut self.

• Encode fast-path input without the active stage (#2288) (cd6c224335)

  ActiveStage.ProcessFastpathInput was the only way for a .NET client to
  turn input events into wire bytes, and it takes the stage and the image,
  so input handlers had to share the lock that the PDU decode loop holds.
  On a busy screen the UI thread waited on frame decoding for every mouse
  move.

  Encoding needs no session state:
  ironrdp_session::encode_fastpath_input chunks the events into
  Fast-Path Input PDUs, and ActiveStage::process_fastpath_input reuses
  it, so its output is unchanged. The .NET binding exposes it as
  FastPathInputEventIterator.Encode(), which returns the PDUs for one
  InputDatabase.Apply as a VecU8 ready for Framed.Write, without
  touching an ActiveStage or DecodedImage. ProcessFastpathInput
  stays for clients with software pointer rendering, which also redraws
  the pointer in the image.

  The Avalonia example sends input through Encode() unless software
  pointer rendering is on, and the README states which calls no longer
  need the stage lock.

• Add the MS-RDPEMSC mouse cursor dynamic channel (#2321) (bbd1b879ce)

  Implements [MS-RDPEMSC] (the Microsoft::Windows::RDS::MouseCursor
  dynamic channel) and connects it to the client's existing pointer
  handling.

  The channel is off by default because it hasn't been run against a
  real Windows or AVD server yet. With it off, the client declines the
  channel as before, and pointer updates stay on the fast path. To turn it
  on, call ConfigBuilder::with_mouse_cursor_channel(true):

  let builder = builder.with_mouse_cursor_channel(true);

  You can also set ChannelConfig::mouse_cursor = true directly.

ironrdp-rdpdr-native

[0.9.1] - 2026-11-07

Bug Fixes

• Announce drive names as 8-bit characters (#2342) (4cd9d45060)

  Windows shows a redirected drive under the first letter of its name: on
  Windows 11 (build 26300), a drive named trd rw is \\tsclient\t, and
  \\tsclient\trd rw is not found; Windows Server 2022 and 2025 do the
  same. The client announces the drive's full name in DeviceData as a
  null-terminated UTF-16 string, as MS-RDPEFS 2.2.3.1 asks with
  DRIVE_CAPABILITY_VERSION_02, but Windows reads the field as 8-bit
  characters, so the zero byte after the first letter ends the name.

  The name now goes as 8-bit characters, null-terminated. FreeRDP's client
  writes it this way too, also with DRIVE_CAPABILITY_VERSION_02, and so
  does rdesktop's. Characters outside ASCII become _, and so do a NUL,
  which would end the name early, and the characters MS-RDPEFS 2.2.1.3
  forbids in PreferredDosName (<, >, ", /, \, |, and a colon
  before the end), for which Windows refuses an 8-bit name; FreeRDP
  replaces those too. A trailing colon stays: a drive announced as C: is
  \\tsclient\C. Names that differ only outside ASCII are announced
  alike. A server that decodes the field as UTF-16, as the specification
  says, would misread the name; xrdp names drives from PreferredDosName,
  which is unchanged.

---

This PR was generated with release-plz.

[Copilot]

🟡 Changes recommended

The ironrdp-svc dependency range can break downstream compilation, and publication can halt unless the three new crates are bootstrapped and their trusted publishers configured.

7 open issues

• Raise the ironrdp-svc dependency to 0.10.1 · New
• Bootstrap new crates before enabling their publication · New
• Replace copied gateway notes with this crate’s security change · New
• Document the breaking PropertySetExt methods · New
• Document bounded dynamic-channel and carrier reassembly · New
• Replace the unsupported KdcResolution feature note · New
• Describe static-channel reassembly limits accurately · New

What changed in this PR

Prepares IronRDP crates for publication by updating release versions, dependency requirements, lockfiles, and generated changelogs.
The underlying features and fixes were implemented in earlier PRs; this PR packages their releases.

Changes:

• Advances crate versions, including the breaking ironrdp-cfg 0.4.0 release and three initial channel-crate releases.
• Adds release notes covering authentication, channel handling, graphics, clipboard, audio, and drive redirection.
• Updates dependent manifests and refreshes workspace and fuzz lockfiles.

File	Description
fuzz/​Cargo.lock	Synchronizes fuzz dependencies and released crate versions.
crates/​ironrdp/​Cargo.toml	Raises the gateway dependency minimum.
crates/​ironrdp-w365/​Cargo.toml	Updates channel dependency minimums.
crates/​ironrdp-vmconnect/​Cargo.toml	Updates the Windows DVC dependency.
crates/​ironrdp-viewer/​Cargo.toml	Adopts configuration crate 0.4.
crates/​ironrdp-svc/​CHANGELOG.md	Records reassembly limits and recipient-context handling.
crates/​ironrdp-svc/​Cargo.toml	Sets version 0.10.1.
crates/​ironrdp-session/​CHANGELOG.md	Records input, pointer, geometry, and rendering changes.
crates/​ironrdp-session/​Cargo.toml	Sets version 0.13.1.
crates/​ironrdp-rdpsnd/​CHANGELOG.md	Documents the audio Training Confirm fix.
crates/​ironrdp-rdpsnd/​Cargo.toml	Sets version 0.11.1.
crates/​ironrdp-rdpevor/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpevor/​Cargo.toml	Bumps version and channel dependencies.
crates/​ironrdp-rdpetxt/​Cargo.toml	Updates optional channel dependencies.
crates/​ironrdp-rdpet/​Cargo.toml	Updates channel dependency minimums.
crates/​ironrdp-rdpepnp/​Cargo.toml	Updates channel dependency minimums.
crates/​ironrdp-rdpemsc/​CHANGELOG.md	Introduces mouse-cursor channel release notes.
crates/​ironrdp-rdpemsc/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-rdpel/​CHANGELOG.md	Adds the 0.0.3 release heading.
crates/​ironrdp-rdpel/​Cargo.toml	Bumps version and channel dependencies.
crates/​ironrdp-rdpegt/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpegt/​Cargo.toml	Bumps version and channel dependencies.
crates/​ironrdp-rdpeci/​CHANGELOG.md	Introduces core-input channel release notes.
crates/​ironrdp-rdpeci/​Cargo.toml	Updates channel dependency minimums.
crates/​ironrdp-rdpecam/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpecam/​Cargo.toml	Bumps version and channel dependencies.
crates/​ironrdp-rdpear/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-rdpdr/​CHANGELOG.md	Documents redirected-drive name encoding.
crates/​ironrdp-rdpdr/​Cargo.toml	Sets version 0.9.1.
crates/​ironrdp-rdpdr-native/​CHANGELOG.md	Records drive-name compatibility changes.
crates/​ironrdp-rdpdr-native/​Cargo.toml	Sets version 0.9.1.
crates/​ironrdp-rdpadrv/​CHANGELOG.md	Introduces MultiPoint persistence release notes.
crates/​ironrdp-rdpadrv/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-pdu/​CHANGELOG.md	Records licensing-log redaction and REGION flag fixes.
crates/​ironrdp-pdu/​Cargo.toml	Sets version 0.11.1.
crates/​ironrdp-mstsgu/​CHANGELOG.md	Records authentication adaptation and socket tuning.
crates/​ironrdp-mstsgu/​Cargo.toml	Sets version 0.1.1.
crates/​ironrdp-graphics/​CHANGELOG.md	Documents RemoteFX and pointer-alpha fixes.
crates/​ironrdp-graphics/​Cargo.toml	Sets version 0.11.1.
crates/​ironrdp-egfx/​CHANGELOG.md	Records AVC444, lifecycle, and decoder-isolation fixes.
crates/​ironrdp-egfx/​Cargo.toml	Sets version 0.5.1.
crates/​ironrdp-dvc/​CHANGELOG.md	Records reassembly limits and channel-lifecycle fixes.
crates/​ironrdp-dvc/​Cargo.toml	Sets version 0.10.1.
crates/​ironrdp-dvc-pipe-proxy/​CHANGELOG.md	Documents asynchronous proxy and shutdown changes.
crates/​ironrdp-dvc-pipe-proxy/​Cargo.toml	Sets version 0.7.1.
crates/​ironrdp-displaycontrol/​CHANGELOG.md	Documents capability reset on channel reopening.
crates/​ironrdp-displaycontrol/​Cargo.toml	Sets version 0.10.1.
crates/​ironrdp-daemon/​Cargo.toml	Adopts configuration crate 0.4.
crates/​ironrdp-cliprdr/​CHANGELOG.md	Records clipboard lock-lifetime fixes.
crates/​ironrdp-cliprdr/​Cargo.toml	Sets version 0.9.1.
crates/​ironrdp-cliprdr-native/​CHANGELOG.md	Records Windows clipboard hardening.
crates/​ironrdp-cliprdr-native/​Cargo.toml	Sets version 0.9.1.
crates/​ironrdp-cliprdr-format/​CHANGELOG.md	Documents standard CF_DIB bitfield support.
crates/​ironrdp-cliprdr-format/​Cargo.toml	Sets version 0.3.1.
crates/​ironrdp-client/​Cargo.toml	Updates configuration, location, and gateway dependencies.
crates/​ironrdp-cfg/​CHANGELOG.md	Adds authentication-related configuration release notes.
crates/​ironrdp-cfg/​Cargo.toml	Sets breaking release version 0.4.0.
crates/​ironrdp-capture-replay/​Cargo.toml	Updates protocol, graphics, and session dependencies.
crates/​ironrdp-agent/​Cargo.toml	Updates configuration and gateway dependencies.
crates/​ironrdp-activex/​Cargo.toml	Updates clipboard-format and configuration dependencies.
Cargo.lock	Synchronizes release versions and refreshes external dependencies.

_{Review effort: Balanced}