chore(release): prepare for publishing

[devolutionsbot]

🤖 New release

• sspi: 0.22.0 -> 0.22.1 (✓ API compatible changes)
• kdc: 0.1.0 -> 0.1.1 (✓ API compatible changes)

Changelog

sspi

[0.22.1] - 2026-09-29

Bug Fixes

• Preserve RC4 sealing state across mechListMIC (#753) (5b2b137e13)

  CredSSP can wrap pubKeyAuth after the initiator sends its mechListMIC
  but before it verifies the acceptor's MIC. Resetting both NTLM RC4
  handles during verification loses the advanced send state and breaks the
  next wrapped message.

  Snapshot and restore only the sealing handle used for each MIC,
  including when verification fails. Remove the obsolete reset helper and
  add regression coverage for both directions, the CredSSP ordering, and
  invalid signatures. Sequence numbers remain unchanged.

• Recover from KDC clock skew during AS exchange (#757) (24c9c52352)

  • When a KDC rejects encrypted AS pre-authentication with
    KRB_AP_ERR_SKEW, derive a per-context time offset from the error's
    stime/susec and retry once. Propagate a second skew error or any
    other error without additional retries.
  • Apply the offset to password, keytab, and smart-card
    pre-authentication timestamps and to subsequent TGS, AP, and
    password-change authenticators. Existing public generator calls still
    use local time unless invoked through the corrected client context.
  • Fix the built-in KDC's skew check so timestamps slightly ahead of
    or behind its clock are accepted within max_time_skew.

Please Sort

• Add musl native assets to the NuGet package (#756) (cad4428fb7)

kdc

[0.1.1] - 2026-09-29

Bug Fixes

• Recover from KDC clock skew during AS exchange (#757) (24c9c52352)

  • When a KDC rejects encrypted AS pre-authentication with
    KRB_AP_ERR_SKEW, derive a per-context time offset from the error's
    stime/susec and retry once. Propagate a second skew error or any
    other error without additional retries.
  • Apply the offset to password, keytab, and smart-card
    pre-authentication timestamps and to subsequent TGS, AP, and
    password-change authenticators. Existing public generator calls still
    use local time unless invoked through the corrected client context.
  • Fix the built-in KDC's skew check so timestamps slightly ahead of
    or behind its clock are accepted within max_time_skew.

---

This PR was generated with release-plz.

[Copilot]

Copilot review overview

🟢 Approval recommended

The release metadata is consistent and the dependency refresh matches the repository’s release-plz configuration.

Review effort: Balanced
Findings: None

What changed in this PR

Prepares the sspi 0.22.1 bug-fix release addressing NTLM RC4 sealing-state preservation.

Changes:

• Bumps sspi from 0.22.0 to 0.22.1.
• Adds the release changelog.
• Refreshes locked transitive dependencies as configured by release-plz.

File	Description
CHANGELOG.md	Documents the RC4 sealing-state fix.
Cargo.toml	Updates the crate version.
Cargo.lock	Synchronizes the version and dependency lock state.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.