v0.30.1

Bug Fixes

• Idlewatcher: Proxmox idle watches now recover from transient status errors, initialize their baseline before emitting transitions, and terminate cleanly when provider streams close. (8e6e309, 7a5c7d6)
• Rules: Path rules now canonicalize dot segments and escaped URL paths while preserving trailing-slash semantics. (8c76b37)
• WebSocket: Concurrent WebSocket connection failures now preserve the first reported concrete error. (yusing/goutils@e4c7e97)

New Features

• CI/Release: Tagged releases now build and publish Linux amd64 and arm64 server binaries as GitHub release assets. (dee145d)

Security

• Middleware: Forward-auth middleware now removes client-supplied default and configured identity headers before applying authoritative values from the auth server. (0ee75b6)

Full Changelog

• dee145d feat(ci): build and publish server binaries on tags
• 8e6e309 fix(idlewatcher): recover Proxmox watches from transient errors
• 7a5c7d6 fix(idlewatcher): terminate when provider watch streams close
• 8c76b37 fix(rules): canonicalize URL paths before matching
• 0ee75b6 fix(middleware): prevent client header spoofing in forward auth

goutils

• e4c7e97 fix(websocket): preserve first concurrent connection error