v0.4.0

0.4.0 (2026-10-21)

Features

• a native app asks for a fresh two-factor proof with acr_values=mfa and max_age (#143) (d89d2c5), closes #142
• a role taken away signs the User out of that Client by back-channel logout (#141) (ec19a6c), closes #138
• the flow-conformance suite native sign-in kits are held to (#145) (42668eb)

Bug Fixes

• identity's in-memory limiter forgets keys whose hits all expired, and holds at most 50 000 (#137) (201f839), closes #117