- Object identity is now GA and default RBAC no longer grants create on serviceaccounts/token; SPIFFE mTLS is enabled for inter‑controller communication, tightening security.
- Adds new notification providers (Zoom, incident.io, Mastodon), promotes Alert/Provider APIs to v1, introduces OCIRepository as a HelmRelease chart source, SOPS decryption for comment‑regex files, image update batching, and makes the Flux...
- Breaking changes require updating RBAC (bind a ClusterRole for token creation), handling the default artifact storage switch (which clears the local tag DB), and applying hardened RBAC for controllers.