What's Changed
- fix(security): evict stale entries from the OIDC rate limiter by @aussierk in #10
- fix(security): validate OIDC picture-claim URL before fetching (SSRF) by @aussierk in #11
- fix(security): block disabled providers during an active session-token window by @aussierk in #12
- fix(security): close DNS-rebinding TOCTOU gap in AuthorityGuard by @aussierk in #13
Full Changelog: v1.0.6.0...v1.0.6.1