v0.8.0

0.8.0 (2026-10-01)

⚠ BREAKING CHANGES

• sts: a role must set required_audiences and subject_conditions (use ["*"] to accept any subject); RoleConfig gains allow_missing_exp_from, which struct-literal constructors must add.

Features

• sts: fail closed on empty trust fields, check token type, require exp, log successes (#146) (8c86e73)
• sts: GetCallerIdentity + real configure-aws-credentials integration test (#126) (05f9e60)

Bug Fixes

• cf-workers: mark forwarded object responses no-transform (#150) (662314b)