v1.23.0

Changelog

Features

• 9fe9804 feat: add a proto-only forwarded-header mode so DPoP works safely behind AWS ALB (#375)
• de166af feat: trusted issuers accept ES384, which AWS STS signs with (#463)

Bug Fixes

• bca10e5 fix: federated client assertion tokens live 15 minutes (#460)
• fb9664c fix: federated client assertions need a scope limit, and a 5xx releases the assertion (#462)

DevOps

• c96236c devops: point nested-module pins at v1.23.0