v2.23.0

2.23.0 (2026-07-13)

Features

• openapi: sync RL Muon optimizer API (95d5efc)

Bug Fixes

• avoid dual-stack OIDC callback collisions (c1fe1b5)
• bind OIDC SSH to trusted issuers (d4a2ffd)
• harden OIDC SSH cache handling (38a1cbc)
• harden OIDC SSH config file handling (d0f2b75)
• improve OIDC SSH caching and UX (19cc146)
• reduce CI token permissions (4bc2778)
• reduce OIDC SSH credential surface (85eb309)
• require OIDC SSH host confirmation (388179b)
• restore CI test runners (690d29e)
• restrict OIDC SSH hostnames (35ef3f4)
• secure OIDC token file handling (844f0a5)
• validate OIDC callback path (a17be62)
• validate OIDC callbacks before capture (c012014)
• validate OIDC discovery endpoints (bf9eeef)
• validate OIDC SSH destinations (541757e)
• verify OIDC SSH target host keys (04a69c3)

Chores

• Update cluster remediation CLI commands for new enums (0da582b)

Documentation

• clarify OIDC callback binding invariant (eb54dc2)
• clarify OIDC token verification boundary (015ba1c)