Release v2.54.0

Added

• Opt-in fresh authentication for protected paths: AuthProxy can require a recent sign-in, challenges the upstream provider for re-authentication, and forwards the validated authentication time in the signed principal. It refuses requests whose freshness cannot be proven, including non-cookie, on-behalf and method-override requests.
• Cratis Identity provider profile with a documented stable provider key. (#260)
• Opt-in verified upstream claims in the signed sign-in notification, sourced from the validated access token. (#286)
• Revoked bearer tokens are refused at the edge through issuer introspection, with caches isolated per cache window. (#285)
• Per-path opt-in to authorization passthrough on anonymous routes, so the caller's own credentials reach the backend. (#283)

Changed

• A bearer route can share its path prefix with the client-credentials route; AuthProxy dispatches by credential kind without fallback. (part of #257)
• Every bearer-route refusal is answered with machine-readable JSON and a profile-aware challenge. (part of #256)
• Passthrough routes select their disposition before any token inspection and skip bearer authentication.

Security

• Fresh authentication closes bearer and query-based method-override bypasses, and the verified authentication time is checked before upstream claims are captured. (#259)