v0.3.0

0.3.0 (2026-10-25)

Added

• recovery sessions and account notice delivery, with parity hardening (6e8750f)
• recovery sessions and account notice delivery, with parity hardening (09acec5), closes #11

Fixed

• cap cookie lifetimes at 400 days and require an http or https AuthServerURL (09acec5)
• console: keep the API's framing and content-type headers (94f9af8), closes #10
• expire the JWKS cache, back off failed fetches and cap the key set size (09acec5)
• refuse placeholder cookie and service secrets outside insecure local mode (09acec5)
• refuse upstream redirects and keep upstream URLs out of logs (09acec5)
• require exp, clear cookies on a rejected logout and never pick tokens into a body (09acec5)

Documentation

• link the governance document and license pledge (fa4a70f)
• link the governance document and license pledge (73f03a1)