Release 0.7.0

0.7.0 (2026-09-27)

⚠ BREAKING CHANGES

• oidc: /userinfo now answers 401 invalid_token for access tokens
  issued by the client_credentials grant. gty is a reserved claim name, so a
  profile custom claim called gty is no longer copied into tokens.
• oidc: a client_secret sent in a form or JSON body must now match
  the configured secret exactly. A client that encoded the secret a second time
  in the body now gets 401 invalid_client. The Authorization: Basic header still
  accepts encoded or raw credentials.
• config: a project config or hub.json containing an unrecognized
  key inside a client, signingKey, profile, branding, tenant or tls object
  now fails validation instead of loading with that key ignored. Remove or
  correct the key.

Bug Fixes

• admin: build profile mutations on the file, not the runtime snapshot (ba2d9f3)
• admin: guard percent-encoded admin paths (8a2b55d)
• bracket IPv6 listen hosts in every URL authority (46ab9a7)
• config: reject unknown keys in nested config objects (6c86358)
• deps: override esbuild to a non-vulnerable version (#25) (a5c884c)
• hub: apply reconciles and shutdown in call order (a7b424b)
• oidc: refuse client_credentials tokens at userinfo (e40f6e2)
• oidc: send no-store headers on token responses (f11d729)
• oidc: validate protocol parameters and accept POST /authorize (fcdfd36)

Documentation

• add the September review and correct stale docs (4f69f1b)