- Added Kubernetes Workload Attestation, SSO device‑trust support, VNet background item, and TERM_PROGRAM env vars in Teleport Connect.
- Fixed regressions: extra text in tsh aws, app launch access denial, Microsoft Teams plugin panic, SAML POST binding redirection, session recording race condition, and RBAC namespace blocking.
- Bot resources now honor metadata.expires and tbot warns when requested certificate TTL exceeds the maximum.