0.5.0

What's Changed

• Multi-arch (amd64+arm64) images for auth/central/edge/gateway/tools by @goshacodes in #217
• feat: add iss to authorization response (RFC 9207) #191 by @Lekerr in #219
• Revocable access tokens: jti/sid/sub keys, LISTEN/NOTIFY propagation, edge cache by @goshacodes in #205
• Fix: accessTokenTtl missing from GET /configuration/clients response by @BKJN1 in #228
• util: detect a notification connection that goes silent without failing by @goshacodes in #226
• docs(central): add admin API OpenAPI specification by @goshacodes in #229
• feat: MIGRATE_ONLY mode for standalone migrations by @BKJN1 in #187
• feat: self-service account settings page (sessions + passkeys) by @goshacodes in #224
• central-ui: runtime console-mode instead of build-time CONSOLE_PREFIX by @goshacodes in #223
• k8s: Helm chart skeleton (Deployments, Services, values.yaml) by @goshacodes in #218
• k8s: controller-agnostic Ingress + gateway/console split by @goshacodes in #230
• build(deps-dev): bump browserslist from 4.28.2 to 4.28.9 in /central-ui by @dependabot[bot] in #232
• k8s: shared secrets.existingSecret + secretKeyRef env injection by @goshacodes in #231
• edge: add non-prod config-sync endpoint; fix revocation e2e flakiness by @goshacodes in #240
• test: raise backend statement coverage from 75.6% to 81.1% by @goshacodes in #241
• auth: bound requested scope by the client registration and by the grant by @goshacodes in #235
• edge, util: fail closed on CEL evaluation failures, drop the tenant map by @goshacodes in #236
• test: cover previously-untested sync clients/services/repos; fix coverage badge (Phase 1 of 91% push) by @goshacodes in #243
• fix(auth): jwt kid privatekey mismatch (#104) by @BKJN1 in #154

Full Changelog: 0.4.0...0.5.0