v2.1.4

Security

• Bump Go to 1.25 – resolves 9 stdlib vulnerabilities (crypto/tls, net/http, net/url, html/template, encoding/asn1, net/textproto, crypto/x509) (#392)
• Bump golang.org/x/crypto 0.43 → 0.55 – resolves 15 Dependabot alerts (critical/high/medium) (#392)
• Bump golang.org/x/net 0.45 → 0.58 – resolves Punycode label validation issue (#392)
• Bump github.com/go-jose/go-jose/v4 4.1.3 → 4.1.4 (#392)
• Migrate from dgrijalva/jwt-go to golang-jwt/jwt/v5 (#382)
• Bump npm dependencies across all UIs – resolves esbuild, postcss, nanoid, js-yaml, brace-expansion, mermaid, dompurify alerts (#393)

Features

• Batch user lookup endpoint for ABAC integration (#380)

Fixes

• Inject version from git tag instead of hardcoding (#378)
• Replace Ant Design copyable+ellipsis with CopyText component (#379)
• Use correct input type tel for phone number styling (#387)

Chores

• Bump Go dependencies to latest stable versions – go-oidc, jwt, testify, swag, oauth2, time (#394)
• Bump npm dependencies in functional tests and docs-web – vitest 3→4, astro 5→7 (#395)
• Migrate tests/browser from npm to pnpm (#396)
• Bump Node.js to 24, centralize version in .node-version (#397)
• Add default CodeRabbit config (#391)

Docs

• Add docs/audits/ – central record of security audits (#381)
• Add acknowledgments section for security contributors (#383)
• Add demo video to README (#389, #390)