- - Added workload identity enhancements: predicate language in templates, X509 revocation support, and non‑FIPS AWS endpoints for IAM/STS.
- - Updated go‑jose, x/crypto, and x/oauth2 libraries to patched versions addressing several CVEs.
- - Fixed multiple issues: label escaping in enrollment scripts, tbot proxy port selection, Azure SQL connectivity on VM scale sets, and missing file errors in the Spacelift runner image.