Features
- per-workspace cloud identity is one token per provider configuration (#2003)
- per-workspace cloud identity — Terrapod as an OIDC issuer for runs (#2001)
Bug Fixes
- the review's hardening tier — the phase chain, the mint's bounds, and a gate for the class (#2030)
- the review's false-statement tier, and a dead clause's other half (#2029)
- roll the API on an OIDC signing key rotation, and drop nine dead ConfigMap keys (#2027)
- the issuer could not recover a failed startup, plus eight correctness and safety fixes (#2026)
- Go 1.26.9 for two HIGH stdlib CVEs before the v1.10.0 tag (#2024)
- the bulk-update filters fit a phone, and the audience editors are tested there again (#2002)
Documentation
- correct what the phase claim and stale-plan guards say, fix the DAST template, add the audience-catalogue MCP tool (#2025)
- the OIDC examples name the OIDC callback, not the SAML ACS path (#1959)
Tests
- cover the issuer surfaces that had none, and drop a guard clause that could never fire (#2028)
Maintenance
- default to OpenTofu 1.13 (#2005)
Full Changelog: v1.9.0...v1.10.0