- Serf downgraded to v0.7 and TLS 1.0 support removed, which may break existing setups but improves security
- Added Admin API endpoints to list active upstream targets and disable targets via DELETE, plus stricter handling of unsupported HTTP methods (returns 405)
- Extended plugins: CORS now supports multiple origins, HMAC auto‑generates secrets, LDAP can’t be bound to a single consumer, and AWS Lambda adds us‑west‑2 region; many internal bug fixes (LRU cache, deadlock avoidance, multipart parsing,...