- Added several features: access lists can now grant roles and traits, proxy can host a version server for automatic agent upgrades, access list caching to improve performance, new certificate extensions for Machine ID bots, and an insecur...
- Fixed multiple critical bugs: goroutine leak per SSH session, refresh‑identity handling that blocked Access Plugins with TLS routing, cache state causing spurious access‑denied errors, incorrect user IP reporting in Kubernetes audit logs...
- Breaking change: resources named "." or ".." are now disallowed; existing resources with these names must be renamed before upgrading.