- Derive cookie signing key from KMS root key for stronger security
- Introduce INFISICAL RUN MODES and add a global command menu UI
- Multiple UI/UX and bug fixes: duplicate secret sync detection, safe GitHub org sync, provider logo fixes, cross‑project secret sharing read support, PKI license gating, and frontend component updates