v1.28.0

1.28.0 (2026-09-12)

Added

• accounts: the account flows an end user touches (#531) (1285529)
• accounts: TOTP, recovery codes and step-up re-authentication (#532) (5ed158e)
• apikeys: the credential a program uses to call an API (#533) (115a1b9)
• auth: roles as a list, and revocation for tokens and sessions (#530) (babf2e0)
• authz: permissions on an object, and the helpers a handler reaches for (#534) (a00072a)
• mail: HTML, attachments, templates and transactional delivery (#537) (82c78a0)
• oidc: an OpenID Connect provider for the federated seam (#535) (dd541ca)
• security: the posture, mapped to ASVS L2 control by control (#536) (e6ac389)