- Escape user-provided labels in enrollment scripts and add JSON response support to the public‑certificate export API.
- Update go‑jose/v4, x/crypto and x/oauth2 to newer versions, addressing several CVEs.
- Fix multiple issues: app public address from Kubernetes annotations, Spacelift runner exec error, Azure SQL connectivity, Postgres privilege handling, and improve Okta app resource usage.