- Breaking: ACME finalization with default sign verbatim policy now rejects CSRs containing URI, email, or other SAN types; unsafe mode can be enabled to retain previous behavior.
- Security: Fixed multiple ACL bypasses, added plugin catalog path validation, enforced policy name segment checks, and normalized case‑insensitive matching for role and policy names.
- Feature & bugfixes: Added SPIFFE login CLI handler, extra OID subject name field for PKI roles, corrected token bound CIDR validation for /128 blocks, and fixed UI billing request header regression.