0.11.0

What's Changed

Breaking Changes

• fix!: wire up or remove config keys nothing reads by @markshust in #520
• fix!: render layouts innermost so route middleware headers and cookies survive by @markshust in #522
• feat!: add a destructive marker to #[Command] and refuse marked commands in mcp by @markshust in #524
• feat!: pin webhook connections to the ip the url policy validated by @markshust in #525

New Features

• feat: ship a shared FakeEncryptor in marko/testing by @markshust in #523
• feat: per-device remember-me tokens by @markshust in #527

Bug Fixes

• fix: pass csrf token when re-rendering the admin login form after failed credentials by @markshust in #519
• fix: run a dummy bcrypt check before rejecting unhashable values in BcryptHasher::verify by @markshust in #521

Documentation

• docs: update mcp allow_destructive config comment for the destructive marker by @markshust in #526

Full Changelog: 0.10.0...0.11.0