v0.7.1

0.7.1 (2026-10-09)

Bug Fixes

• agents: read CA and material through the open transaction and bound OnVersion (c851946)
• api: require keys:export to re-enrol a client holding key-bearing grants (4dd3f88)
• backup: include ca_crls in the backup manifest (8d5295d)
• challenge: keep legacy rfc2136 and oraclecloud field names after lego bump (adcb741)
• crl: persist signed CRLs and re-sign only on revocation or near expiry (e984191)
• crl: take a fresh crl_number for every signed CRL (806ac8c)
• db: make ca_crls foreign key deferrable (3f785bd)
• deploy: per-row deploy_seq so a re-armed server deployment is not dropped or overwritten by a stale job (866e724)
• dnscreds: allow only AZURE_AUTH_METHOD=env for non-admins and force it on build (159a460)
• dnscreds: restrict ambient cloud identity to global settings:write (ab17286)
• issuance: never reuse a private key shared with a revoked version (44d3c89)
• issuance: record vault revocation and renewal trigger atomically (0e2959b)
• issuance: renew a managed certificate immediately when its current version is revoked (dcb9e6d)
• monitor: scale expiring threshold to short-lived leaf lifetime (3e83e6c)
• notify: record a delivery as failed when its send never runs on the final attempt (b5b9f8c)
• review round 3 (Go, security, certificates, web) (a829cbe)
• web: add IconButton so every icon-only button has a tooltip (d6e2e51)
• web: Enter on a DataTable row falls back to onRowClick (492e82c)
• web: keep download sheet open after a generated-password export (e3ea881)
• web: single tooltip for disabled row Delete; clear download notice on password change (177bb8a)