v1.31 - 2026-06-03

Patch release. Two operator-impacting bugs fixed; no new features. Everything else queued for the v2.0 cut (LDAP/SAML SSO, plugin loader runtime, tool-level audit log, SIEM forwarder, /metrics Prometheus endpoint) stays on the release/v2.0.0 branch.

Fixed

• OAuth client revoke returned HTTP 500 (#48). oauth_clients.py referenced session.username on four lines but the session object exposes the attribute as session.user. Clicking Revoke against a registered OAuth client triggered an AttributeError and the operator never saw the success flash. Live-confirmed fixed on a Rocky 9 OAuth backend - response is now 200 + redirect to /oauth-clients, audit log carries the oauth_client.revoke row with the operator's username. The native window.confirm() popup was also swapped for the same showConfirm modal the rest of the portal uses (Restart MCP server, Delete token, ...) so the confirmation UX matches.
• verify_ssl = false was not enough to talk to legacy Zabbix HTTPS frontends (#51, reported by @letran3691). OpenSSL 3.0 on RHEL 9 / Ubuntu 22.04+ disables unsafe legacy TLS renegotiation by default, which surfaces as [SSL: UNSAFE_LEGACY_RENEGOTIATION_DISABLED] against older Zabbix frontends - even though the operator already opted out of cert verification. verify_ssl=false now disables cert checks AND sets OP_LEGACY_SERVER_CONNECT on the SSL context so the original "trust everything for this backend" intent works end-to-end. Affects both the primary ZabbixAPI client path and the user.checkAuthentication / user.logout direct urlopen path used by OAuth login.

Verified

• CRUD smoke 255/261 OK on release/v1.31 (1 environment error = graph_render needs frontend creds, 5 expected fixture-related skips)
• Installer matrix 18/18 PASS across alma 8/9/10, debian 12/13, fedora, oracle 8/9/10, rhel 8/9/10, suse 15, ubuntu 22/24, amazon 2023, minimal

Coming next

release/v2.0.0 is in flight with LDAP / Active Directory + SAML 2.0 SSO (#46), plugin loader discovery (#47), tool-level audit log with HMAC tamper chain (#49), SIEM / syslog forwarder, Prometheus /metrics endpoint, multi-arch Docker images, and the OAuth consent rebuild. Target: 2026-06.