[devolutionsbot]

🤖 New release

• ironrdp-pdu: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-svc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-dvc: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-cfg: 0.3.0 -> 0.4.0 (⚠ API breaking changes)
• ironrdp-cliprdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-cliprdr-format: 0.3.0 -> 0.3.1 (✓ API compatible changes)
• ironrdp-cliprdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-displaycontrol: 0.10.0 -> 0.10.1 (✓ API compatible changes)
• ironrdp-dvc-pipe-proxy: 0.7.0 -> 0.7.1 (✓ API compatible changes)
• ironrdp-graphics: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-egfx: 0.5.0 -> 0.5.1 (✓ API compatible changes)
• ironrdp-mstsgu: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• ironrdp-rdpadrv: 0.0.0
• ironrdp-rdpdr: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-rdpsnd: 0.11.0 -> 0.11.1 (✓ API compatible changes)
• ironrdp-rdpeci: 0.0.0
• ironrdp-rdpemsc: 0.0.0
• ironrdp-session: 0.13.0 -> 0.13.1 (✓ API compatible changes)
• ironrdp-rdpdr-native: 0.9.0 -> 0.9.1 (✓ API compatible changes)
• ironrdp-rdpegt: 0.2.0 -> 0.2.1
• ironrdp-rdpel: 0.0.2 -> 0.0.3
• ironrdp-rdpevor: 0.2.0 -> 0.2.1
• ironrdp-rdpecam: 0.2.0 -> 0.2.1

⚠ ironrdp-cfg breaking changes

--- failure trait_method_added: pub trait method added ---

Description:
A non-sealed public trait added a new method without a default implementation, which breaks downstream implementations of the trait
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/trait_method_added.ron

Failed in:
  trait method ironrdp_cfg::PropertySetExt::remote_guard_mode in file /tmp/.tmprAvn31/IronRDP/crates/ironrdp-cfg/src/lib.rs:618
  trait method ironrdp_cfg::PropertySetExt::set_remote_guard_mode in file /tmp/.tmprAvn31/IronRDP/crates/ironrdp-cfg/src/lib.rs:621
  trait method ironrdp_cfg::PropertySetExt::clear_remote_guard_mode in file /tmp/.tmprAvn31/IronRDP/crates/ironrdp-cfg/src/lib.rs:623

Changelog

ironrdp-pdu

[0.11.1] - 2026-11-08

Security

• Withhold licensing secrets from Debug output (#2344) (5c4dcfa7b1)

  The licensing PDUs derived Debug, so a log at the debug or trace level
  printed the premaster secret, the MAC salt and license keys, the client
  and server randoms, the encrypted HWID, the platform challenge and its
  response, and the license itself, as the server sent it, byte by byte;
  also the user and machine names the client announces. Such a log can't
  be handed to anyone.

  Those fields now print as their length only (<48 bytes withheld>), in
  Debug implementations of their own. The server certificate's material
  (chain, modulus, signature) is public but prints the same way, for a
  different reason: a derived Debug writes its kilobytes as a decimal list
  that buries the rest of the exchange, while the lengths tell the key
  size and the chain's shape. What tells an exchange apart stays: the
  security and license headers (message type, flags, version, size), the
  product and scope, the public exponent, error codes and state
  transitions. The connector also logs the Server License Request, the
  client's reply to it, and the error message that ends an exchange
  without one at the debug level, as it already did the later PDUs, so
  that a debug log shows the whole exchange.

Bug Fixes

• Read the DWT variant from REGION flags (#2085) (43d75cd48e)

  The Progressive decoder chose the DWT variant from bit 0 of the
  RFX_PROGRESSIVE_CONTEXT flags. MS-RDPEGFX 2.2.4.2.1.4 defines that bit
  as RFX_SUBBAND_DIFFING; the variant is bit 0 of each
  RFX_PROGRESSIVE_REGION's flags (RFX_DWT_REDUCE_EXTRAPOLATE,
  2.2.4.2.1.5). Tiles decoded correctly only while a server set both bits
  to the same value.

  Each REGION now selects its own variant. The decoder kept the CONTEXT
  value only for this choice, so its per-surface fallback and the
  MissingBlock("CONTEXT") error are removed; CONTEXT is optional per
  2.2.4.2.1.4. A stream without CONTEXT for an unseen codec context now
  decodes instead of failing.

ironrdp-svc

[0.10.1] - 2026-11-08

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

• Tag reassembly with recipient context (#2271) (5a919df846)

  Add SvcProcessor::message_context and
  SvcProcessor::process_with_context so static virtual channels with
  replaceable recipients can discard inbound data when no recipient is
  attached and drop partial fragment sequences when the recipient changes
  mid-message.

  ChunkProcessor continues counting received fragment bytes against both
  the declared message length and the configured maximum message size even
  after discarding buffered bytes, preserving framing validation across
  recipient changes.

ironrdp-dvc

[0.10.1] - 2026-11-08

Features

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

Bug Fixes

• Harden channel lifecycle and pipe proxy (#2275) (a28a57e4f1)

  Emit a single DATA PDU for empty and 1,590-byte DVC messages instead
  of dropping zero-length payloads or starting 1,590-byte payloads with
  DATA_FIRST.

  Add DrdynvcServer::is_ready and
  DrdynvcServer::create_channel_boxed_with, suppress ClosePdu for
  pending or failed server channels, discard late in-flight data and
  cancelled CreateResponse PDUs for retired channel IDs, and close only
  the offending dynamic channel when a server processor's
  max_message_size limit is exceeded.

  Add DvcNamedPipeProxy::new_async, cancel pending pipe writes and
  reconnect sleeps on proxy drop without blocking the Tokio I/O driver,
  and register client DVC pipe proxies through a channel factory with
  async backpressure on the RDP input queue.

ironrdp-cfg

[0.4.0] - 2026-11-08

Features

• Support AVD gateway orchestration, WAM, and OAuth2 auth (#2247) (c58f568711)

  Azure Virtual Desktop connections using gatewaybrokeringtype:i:1
  negotiate session placement and gateway routing through an HTTPS
  orchestration endpoint (/api/v2/connections or
  /api/arm/v2/connections) before upgrading to a WebSocket gateway
  transport and authenticating the target session host with Entra RDS AAD
  Proof-of-Possession tokens.

  Add AVD gateway orchestration, WWW-Authenticate: Claims:... challenge
  parsing, Windows Web Account Manager (WebAuthenticationCoreManager)
  silent and interactive token acquisition, and a cross-platform
  OAuthAvdTokenProvider supporting silent refresh-token exchange,
  loopback PKCE browser login, OAuth2 device-code fallback, persistent
  per-user refresh-token caching, and refresh-to-PoP host token minting.
  Decode redirectedServerCert and redirectedAuthBlob payloads, wire
  Shortpath UDP peer endpoints (GatewayConnectionInfo::udp_peer),
  preserve load_balance_info and target_certificate across mid-session
  AVD redirections, and add companion <rdp_file>.json UserName lookup
  and --prop KEY:TYPE:VALUE overrides in ironrdp-daemon,
  ironrdp-agent, and ironrdp-viewer.

• Support Remote Credential Guard over RDPEAR (#2256) (376eb8f566)

  Remote Credential Guard redirects Kerberos and NTLMv2 operations over
  the Microsoft::Windows::RDS::AuthRedirection dynamic virtual channel
  (MS-RDPEAR) so TGT keys and password hashes remain client-owned instead
  of delegating credentials through CredSSP TSTicketCreds.

  Add ironrdp-rdpear with no_std/alloc outer envelope framing,
  strict ASN.1 DER TSRemoteGuardInnerPacket codecs, and portable NDR32
  type-serialization codecs for all 23 MS-RDPEAR Kerberos and NTLM
  request/response calls under both the published IDL profile and the
  Windows-native wire profile. Bound inbound static and dynamic channel
  reassembly before fragment retention via
  SvcProcessor::max_message_size, DvcProcessor::max_message_size, and
  DrdynvcClient::with_max_transport_message_size.

  Wire the opt-in remote-guard feature through ironrdp-connector, the
  async/blocking/Tokio drivers, ironrdp-cfg, ironrdp-client,
  ironrdp-daemon, and ironrdp-agent (--remote-guard and
  ironrdp_remote_guard with Disabled, Negotiate, Ntlm, and
  Kerberos modes) backed by sspi 0.23.1. RCG requires HYBRID or
  HYBRID_EX with REDIRECTED_AUTHENTICATION_MODE_SUPPORTED, strict TLS
  validation, and a completed CredSSP context handoff, and omits
  passwords, smart-card PINs, and auto-reconnect cookies from Client Info.

ironrdp-cliprdr

[0.9.1] - 2026-11-08

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-cliprdr-format

[0.3.1] - 2026-11-08

Bug Fixes

• Decode standard CF_DIB bitfields (#2374) (4134dc272f)

  Windows commonly supplies 32-bit CF_DIB clipboard images with
  BI_BITFIELDS compression and standard BGR masks. Rejecting that layout
  prevents clipboard image pastes.

  Validate and skip the three masks before decoding pixels, and include
  them in the validated logical length. Keep non-standard masks and 24-bit
  bitfields unsupported, and preserve RGB and DIBV5 decoding.

ironrdp-cliprdr-native

[0.9.1] - 2026-11-08

Bug Fixes

• Harden Windows native clipboard and file lock lifetime (#2267) (3f9a1149b3)

  Retain incoming locked file-list snapshots until the peer sends
  \UnlockClipboardData\ per [MS-RDPECLIP]\ §3.1.5.3.2 instead of expiring
  them on upload inactivity (evicting the oldest lock and notifying
  \on_unlock\ if \MAX_LOCKED_FILE_LISTS\ is exceeded), and reject unknown
  or released lock IDs instead of falling back to the current unlocked
  clipboard.

  On Windows, omit synthesized \CF_DIBV5\ when \CF_DIB\ precedes it in
  \EnumClipboardFormats\ to avoid Windows' corrupting \BI_BITFIELDS
  DIB-to-DIBV5 conversion, fail displaced \FormatDataRequest\ entries when
  retry coalescing replaces a deferred event or a newer
  \FormatDataRequest\ arrives, initialize \window_is_active\ from the
  foreground window process so background clipboard hosts report clipboard
  changes without waiting for an activation message, and clear
  \SetLastError(ERROR_SUCCESS)\ before registering delayed rendering with
  \SetClipboardData(format, None).

ironrdp-displaycontrol

[0.10.1] - 2026-11-08

Bug Fixes

• Wait for new caps on a reopened channel (#2296) (06cdca22f3)

  A display control channel the server closes and reopens could send a
  monitor layout before the server's new capabilities arrived.

  Keep pre-registered channel processors available for reopening, but
  clear DisplayControl capabilities on close so layouts wait for fresh
  server capabilities. Custom listeners and factories retain control over
  subsequent opens. Release EGFX graphics state when the channel closes,
  after saving its persistent bitmap cache, and wait for pipe proxy
  workers and pending filesystem operations to finish before starting a
  replacement.

ironrdp-dvc-pipe-proxy

[0.7.1] - 2026-11-08

Bug Fixes

• Harden channel lifecycle and pipe proxy (#2275) (a28a57e4f1)

  Emit a single DATA PDU for empty and 1,590-byte DVC messages instead
  of dropping zero-length payloads or starting 1,590-byte payloads with
  DATA_FIRST.

  Add DrdynvcServer::is_ready and
  DrdynvcServer::create_channel_boxed_with, suppress ClosePdu for
  pending or failed server channels, discard late in-flight data and
  cancelled CreateResponse PDUs for retired channel IDs, and close only
  the offending dynamic channel when a server processor's
  max_message_size limit is exceeded.

  Add DvcNamedPipeProxy::new_async, cancel pending pipe writes and
  reconnect sleeps on proxy drop without blocking the Tokio I/O driver,
  and register client DVC pipe proxies through a channel factory with
  async backpressure on the RDP input queue.

ironrdp-graphics

[0.11.1] - 2026-11-08

Bug Fixes

• Fix RemoteFX quantization, DWT rounding, and pointer alpha (#2263) (cf15d041c3)

  Round RemoteFX wavelet coefficients during quantization using (value + (1 << (factor - 1))) >> factor with widened i32 intermediates as
  specified in [MS-RDPRFX] 3.1.8.1.5 instead of unrounded arithmetic
  right-shifting, which floored negative coefficients in [-(scale / 2), -1] to -1 and produced color speckles on smooth gradients and icons.

  Use ceiling average (a + b + 1) >> 1 in forward DWT low-pass sub-bands
  to match the [MS-RDPRFX] 3.1.8.2.4 inverse DWT lifting step.

  Premultiply software pointer RGB channels by normalized alpha instead of
  squaring each color component.

• Read the DWT variant from REGION flags (#2085) (43d75cd48e)

  The Progressive decoder chose the DWT variant from bit 0 of the
  RFX_PROGRESSIVE_CONTEXT flags. MS-RDPEGFX 2.2.4.2.1.4 defines that bit
  as RFX_SUBBAND_DIFFING; the variant is bit 0 of each
  RFX_PROGRESSIVE_REGION's flags (RFX_DWT_REDUCE_EXTRAPOLATE,
  2.2.4.2.1.5). Tiles decoded correctly only while a server set both bits
  to the same value.

  Each REGION now selects its own variant. The decoder kept the CONTEXT
  value only for this choice, so its per-surface fallback and the
  MissingBlock("CONTEXT") error are removed; CONTEXT is optional per
  2.2.4.2.1.4. A stream without CONTEXT for an unseen codec context now
  decodes instead of failing.

ironrdp-egfx

[0.5.1] - 2026-11-08

Bug Fixes

• Drop AVC444 updates whose views cannot combine (#2286) (f01f9b5aab)

  Follow-up to feat(client)!: use H.264 and AVC444 graphics by default #2199, carrying over two guards from feat(egfx)!: decode AVC444v2 #2112.

  A chroma-only AVC444 update for a surface with no picture yet created a
  black picture and painted the chroma over it. An update whose main and
  auxiliary views differ in size combined two pictures into one, painting
  the wrong chroma over the main view.

  Both now return an error from decode_avc444, so they count as dropped
  updates with the usual rate-limited warning, and paint nothing. A
  mismatched update is dropped whole, main view included, rather than
  degraded to its main view.

  Frames are only cleared where the surface itself goes away (capability
  reset, ResetGraphics, create and delete surface), so a legitimate
  chroma-only update never arrives without a picture.

• Wait for new caps on a reopened channel (#2296) (06cdca22f3)

  A display control channel the server closes and reopens could send a
  monitor layout before the server's new capabilities arrived.

  Keep pre-registered channel processors available for reopening, but
  clear DisplayControl capabilities on close so layouts wait for fresh
  server capabilities. Custom listeners and factories retain control over
  subsequent opens. Release EGFX graphics state when the channel closes,
  after saving its persistent bitmap cache, and wait for pipe proxy
  workers and pending filesystem operations to finish before starting a
  replacement.

ironrdp-mstsgu

[0.1.1] - 2026-11-08

Features

• Use the KdcResolution enum instead of KDC url (#1987) (d23348621a)

  This PR adds the KdcResolution enum, which specifies how Kerberos
  should resolve the KDC, either by using IAKERB proxy or by connecting
  directly to an external KDC specified by URL.

Performance

• Disable Nagle on gateway sockets (#2302) (bc3c09f6d4)

  Set TCP_NODELAY before TLS and proxy negotiation on gateway sockets so
  small writes are not held by Nagle buffering. Share the connector across
  direct and proxied RPCH/HTTP connections, matching the existing AVD and
  RDCleanPath socket policy.

  Propagate socket-option failures. Disabling this buffering can increase
  the number of small TCP packets.

  Add a loopback regression for numeric and hostname endpoints, and run it
  from the standard CI test commands.

ironrdp-rdpadrv

[0.0.0] - 2026-11-08

Features

• Add MultiPoint audio level and drive letter persistence channels (#2322) (8301ee04d3)

  Implements [MS-RDPADRV] (Audio Level and Drive Letter Persistence
  Virtual Channel Extension), which Windows MultiPoint Server uses to have
  the client remember the session's master volume levels and the drive
  letters assigned to redirected USB storage, and restore them on the next
  connection.

ironrdp-rdpdr

[0.9.1] - 2026-11-08

Bug Fixes

• Announce drive names as 8-bit characters (#2342) (4cd9d45060)

  Windows shows a redirected drive under the first letter of its name: on
  Windows 11 (build 26300), a drive named trd rw is \\tsclient\t, and
  \\tsclient\trd rw is not found; Windows Server 2022 and 2025 do the
  same. The client announces the drive's full name in DeviceData as a
  null-terminated UTF-16 string, as MS-RDPEFS 2.2.3.1 asks with
  DRIVE_CAPABILITY_VERSION_02, but Windows reads the field as 8-bit
  characters, so the zero byte after the first letter ends the name.

  The name now goes as 8-bit characters, null-terminated. FreeRDP's client
  writes it this way too, also with DRIVE_CAPABILITY_VERSION_02, and so
  does rdesktop's. Characters outside ASCII become _, and so do a NUL,
  which would end the name early, and the characters MS-RDPEFS 2.2.1.3
  forbids in PreferredDosName (<, >, ", /, \, |, and a colon
  before the end), for which Windows refuses an 8-bit name; FreeRDP
  replaces those too. A trailing colon stays: a drive announced as C: is
  \\tsclient\C. Names that differ only outside ASCII are announced
  alike. A server that decodes the field as UTF-16, as the specification
  says, would misread the name; xrdp names drives from PreferredDosName,
  which is unchanged.

ironrdp-rdpsnd

[0.11.1] - 2026-11-08

Bug Fixes

• Echo the server's wPackSize in the Training Confirm (#2294) (f86e3c49f3)

  GNOME Remote Desktop sends IronRDP no audio, because the client's
  Training Confirm carries the wrong wPackSize.

  The Training Confirm must echo the Training PDU's wPackSize, the size of
  the whole PDU ([MS-RDPEA] 2.2.3.2). The client sent the length of the
  data after the fields instead, 8 bytes short. The FreeRDP server library
  hands the value to its TrainingConfirm callback, and GNOME Remote
  Desktop's rejects it.

ironrdp-rdpeci

[0.0.0] - 2026-11-08

Features

• Add MS-RDPECI core input dynamic channel (#2319) (fbf2599863)

  Add the ironrdp-rdpeci crate with the MS-RDPECI PDUs and a client
  processor for the Microsoft::Windows::RDS::CoreInput dynamic channel.
  Input events reuse the fast-path input event type, since MS-RDPECI packs
  events in the same format.

  The client can opt in with the core-input feature and
  ChannelConfig::core_input. Once the server opens the channel and selects
  version 1.0, keyboard and mouse input is sent over it; otherwise input
  stays on fast-path.

ironrdp-rdpemsc

[0.0.0] - 2026-11-08

Features

• Add the MS-RDPEMSC mouse cursor dynamic channel (#2321) (bbd1b879ce)

  Implements [MS-RDPEMSC] (the Microsoft::Windows::RDS::MouseCursor
  dynamic channel) and connects it to the client's existing pointer
  handling.

  The channel is off by default because it hasn't been run against a
  real Windows or AVD server yet. With it off, the client declines the
  channel as before, and pointer updates stay on the fast path. To turn it
  on, call ConfigBuilder::with_mouse_cursor_channel(true):

  let builder = builder.with_mouse_cursor_channel(true);

  You can also set ChannelConfig::mouse_cursor = true directly.

ironrdp-session

[0.13.1] - 2026-11-08

Features

• Expose display control readiness and capabilities (#2285) (851747a1c7)

  ActiveStage.EncodedResize returns null until the Display Control
  channel has received the server's capabilities, and the .NET binding
  gave a client no way to tell when that happens, so clients polled or
  retried blindly.

  Add ActiveStage.DisplayControlState (Unavailable, Pending,
  Ready) and ActiveStage.DisplayControlCapabilities (MaxNumMonitors,
  MaxMonitorArea), wrapping
  ironrdp_session::ActiveStage::display_control_ready and
  display_control_capabilities. A client checks the state after each
  Process call and sends its first resize once it becomes Ready.

  display_control_ready now takes &self, which Diplomat requires for a
  getter; it never needed &mut self.

• Encode fast-path input without the active stage (#2288) (cd6c224335)

  ActiveStage.ProcessFastpathInput was the only way for a .NET client to
  turn input events into wire bytes, and it takes the stage and the image,
  so input handlers had to share the lock that the PDU decode loop holds.
  On a busy screen the UI thread waited on frame decoding for every mouse
  move.

  Encoding needs no session state:
  ironrdp_session::encode_fastpath_input chunks the events into
  Fast-Path Input PDUs, and ActiveStage::process_fastpath_input reuses
  it, so its output is unchanged. The .NET binding exposes it as
  FastPathInputEventIterator.Encode(), which returns the PDUs for one
  InputDatabase.Apply as a VecU8 ready for Framed.Write, without
  touching an ActiveStage or DecodedImage. ProcessFastpathInput
  stays for clients with software pointer rendering, which also redraws
  the pointer in the image.

  The Avalonia example sends input through Encode() unless software
  pointer rendering is on, and the README states which calls no longer
  need the stage lock.

• Add the MS-RDPEMSC mouse cursor dynamic channel (#2321) (bbd1b879ce)

  Implements [MS-RDPEMSC] (the Microsoft::Windows::RDS::MouseCursor
  dynamic channel) and connects it to the client's existing pointer
  handling.

  The channel is off by default because it hasn't been run against a
  real Windows or AVD server yet. With it off, the client declines the
  channel as before, and pointer updates stay on the fast path. To turn it
  on, call ConfigBuilder::with_mouse_cursor_channel(true):

  let builder = builder.with_mouse_cursor_channel(true);

  You can also set ChannelConfig::mouse_cursor = true directly.

ironrdp-rdpdr-native

[0.9.1] - 2026-11-08

Bug Fixes

• Announce drive names as 8-bit characters (#2342) (4cd9d45060)

  Windows shows a redirected drive under the first letter of its name: on
  Windows 11 (build 26300), a drive named trd rw is \\tsclient\t, and
  \\tsclient\trd rw is not found; Windows Server 2022 and 2025 do the
  same. The client announces the drive's full name in DeviceData as a
  null-terminated UTF-16 string, as MS-RDPEFS 2.2.3.1 asks with
  DRIVE_CAPABILITY_VERSION_02, but Windows reads the field as 8-bit
  characters, so the zero byte after the first letter ends the name.

  The name now goes as 8-bit characters, null-terminated. FreeRDP's client
  writes it this way too, also with DRIVE_CAPABILITY_VERSION_02, and so
  does rdesktop's. Characters outside ASCII become _, and so do a NUL,
  which would end the name early, and the characters MS-RDPEFS 2.2.1.3
  forbids in PreferredDosName (<, >, ", /, \, |, and a colon
  before the end), for which Windows refuses an 8-bit name; FreeRDP
  replaces those too. A trailing colon stays: a drive announced as C: is
  \\tsclient\C. Names that differ only outside ASCII are announced
  alike. A server that decodes the field as UTF-16, as the specification
  says, would misread the name; xrdp names drives from PreferredDosName,
  which is unchanged.

---

This PR was generated with release-plz.

[Copilot]

🟡 Changes recommended

Unresolved changelog issues omit the breaking trait migration, secret-key handling, and reassembly hardening details while attributing features to the wrong crates.

4 open issues

• Document AVD secret keys recognized by is_secret_key · New
• Document PropertySetExt breaking change and migration requirement · New
• Correct KdcResolution feature entry for the affected crate · New
• Describe compressed-fragment length overflow hardening · New

What changed in this PR

Prepares IronRDP’s crate releases by updating package versions, dependency requirements, lockfiles, and generated release notes.
This PR packages previously merged functionality rather than changing Rust implementations.

Changes:

• Advances release versions, including ironrdp-cfg 0.4.0 for its breaking trait change.
• Updates dependent crates and refreshes workspace and fuzz lockfiles.
• Adds release notes for security fixes, channel improvements, graphics corrections, and three initial channel-crate releases.

File	Description
fuzz/​Cargo.lock	Updates fuzz dependencies and released crate versions.
crates/​ironrdp/​Cargo.toml	Updates the gateway dependency requirement.
crates/​ironrdp-w365/​Cargo.toml	Updates channel and PDU dependencies.
crates/​ironrdp-vmconnect/​Cargo.toml	Updates the Windows DVC dependency.
crates/​ironrdp-viewer/​Cargo.toml	Adopts cfg 0.4.
crates/​ironrdp-svc/​CHANGELOG.md	Documents reassembly limits and recipient context.
crates/​ironrdp-svc/​Cargo.toml	Bumps svc to 0.10.1.
crates/​ironrdp-session/​CHANGELOG.md	Documents session APIs, input handling, and rendering fixes.
crates/​ironrdp-session/​Cargo.toml	Bumps session to 0.13.1.
crates/​ironrdp-rdpsnd/​CHANGELOG.md	Documents the audio training confirmation fix.
crates/​ironrdp-rdpsnd/​Cargo.toml	Bumps rdpsnd to 0.11.1.
crates/​ironrdp-rdpevor/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpevor/​Cargo.toml	Bumps rdpevor and updates dependencies.
crates/​ironrdp-rdpetxt/​Cargo.toml	Updates optional channel dependencies.
crates/​ironrdp-rdpet/​Cargo.toml	Updates channel and PDU dependencies.
crates/​ironrdp-rdpepnp/​Cargo.toml	Updates channel and PDU dependencies.
crates/​ironrdp-rdpemsc/​CHANGELOG.md	Adds initial mouse cursor channel release notes.
crates/​ironrdp-rdpemsc/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-rdpel/​CHANGELOG.md	Adds the 0.0.3 release heading.
crates/​ironrdp-rdpel/​Cargo.toml	Bumps rdpel and updates dependencies.
crates/​ironrdp-rdpegt/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpegt/​Cargo.toml	Bumps rdpegt and updates dependencies.
crates/​ironrdp-rdpeci/​CHANGELOG.md	Adds initial core input channel release notes.
crates/​ironrdp-rdpeci/​Cargo.toml	Updates channel and PDU dependencies.
crates/​ironrdp-rdpecam/​CHANGELOG.md	Adds the 0.2.1 release heading.
crates/​ironrdp-rdpecam/​Cargo.toml	Bumps rdpecam and updates dependencies.
crates/​ironrdp-rdpear/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-rdpdr/​CHANGELOG.md	Documents redirected drive-name compatibility fixes.
crates/​ironrdp-rdpdr/​Cargo.toml	Bumps rdpdr to 0.9.1.
crates/​ironrdp-rdpdr-native/​CHANGELOG.md	Records the drive-name compatibility fix.
crates/​ironrdp-rdpdr-native/​Cargo.toml	Bumps rdpdr-native to 0.9.1.
crates/​ironrdp-rdpadrv/​CHANGELOG.md	Adds initial MultiPoint persistence release notes.
crates/​ironrdp-rdpadrv/​Cargo.toml	Updates DVC and PDU dependencies.
crates/​ironrdp-pdu/​CHANGELOG.md	Documents licensing-secret redaction and REGION flag fixes.
crates/​ironrdp-pdu/​Cargo.toml	Bumps pdu to 0.11.1.
crates/​ironrdp-mstsgu/​CHANGELOG.md	Records authentication adaptation and gateway socket improvements.
crates/​ironrdp-mstsgu/​Cargo.toml	Bumps mstsgu to 0.1.1.
crates/​ironrdp-graphics/​CHANGELOG.md	Documents RemoteFX and pointer rendering corrections.
crates/​ironrdp-graphics/​Cargo.toml	Bumps graphics to 0.11.1.
crates/​ironrdp-egfx/​CHANGELOG.md	Documents AVC444 validation and decoder lifecycle fixes.
crates/​ironrdp-egfx/​Cargo.toml	Bumps egfx to 0.5.1.
crates/​ironrdp-dvc/​CHANGELOG.md	Documents channel lifecycle and reassembly improvements.
crates/​ironrdp-dvc/​Cargo.toml	Bumps dvc to 0.10.1.
crates/​ironrdp-dvc-pipe-proxy/​CHANGELOG.md	Documents proxy cancellation and reopening behavior.
crates/​ironrdp-dvc-pipe-proxy/​Cargo.toml	Bumps dvc-pipe-proxy to 0.7.1.
crates/​ironrdp-displaycontrol/​CHANGELOG.md	Documents fresh capability negotiation after reopening.
crates/​ironrdp-displaycontrol/​Cargo.toml	Bumps displaycontrol to 0.10.1.
crates/​ironrdp-daemon/​Cargo.toml	Adopts cfg 0.4.
crates/​ironrdp-cliprdr/​CHANGELOG.md	Documents clipboard and file-lock hardening.
crates/​ironrdp-cliprdr/​Cargo.toml	Bumps cliprdr to 0.9.1.
crates/​ironrdp-cliprdr-native/​CHANGELOG.md	Documents native Windows clipboard fixes.
crates/​ironrdp-cliprdr-native/​Cargo.toml	Bumps cliprdr-native to 0.9.1.
crates/​ironrdp-cliprdr-format/​CHANGELOG.md	Documents standard CF_DIB bitfield decoding.
crates/​ironrdp-cliprdr-format/​Cargo.toml	Bumps cliprdr-format to 0.3.1.
crates/​ironrdp-client/​Cargo.toml	Updates configuration, location, and gateway requirements.
crates/​ironrdp-cfg/​CHANGELOG.md	Adds AVD and Remote Credential Guard release notes.
crates/​ironrdp-cfg/​Cargo.toml	Bumps cfg to 0.4.0.
crates/​ironrdp-capture-replay/​Cargo.toml	Updates replay-related IronRDP dependencies.
crates/​ironrdp-agent/​Cargo.toml	Updates configuration and gateway requirements.
crates/​ironrdp-activex/​Cargo.toml	Updates configuration and clipboard-format requirements.
Cargo.lock	Records release versions and refreshed external dependencies.

_{Review effort: Balanced}