v0.4.0

⚠️ Breaking changes

• Sibling-app tokens now rejected — aud is narrowed to client_id only, and a new client_id claim check enforces claims["client_id"] == app_client_id. Tokens for app B in the same Zitadel project no longer pass app A. (#157)
• token_leeway capped at 30 s (#159)

What's Changed

• fix: authorize scopes only on verified token claims (#148) by @davidhuser in #155
• fix: harden JWKS refresh against unknown-kid DoS (#149) by @davidhuser in #156
• fix: reject tokens issued for sibling apps in the same Zitadel project by @davidhuser in #157
• fix: validate OIDC discovery issuer matches configured issuer_url (#152) by @davidhuser in #158
• fix: cap token_leeway at 30s and validate issuer_url by @davidhuser in #159
• feat: add user-agent and connect timeout to httpx Client by @davidhuser in #160
• chore: upgrade dependencies by @davidhuser in #161
• chore: bump version to rc by @davidhuser in #162
• chore: bump version by @davidhuser in #163

Full Changelog: v0.3.3...v0.4.0