🚀 Features
- feat: support CI/CD login from Forgejo Actions (Codeberg) @Blacks-Army (#580)
- ssh-agent off by default @EthanHeilman (#626)
- feat: add GitLab CI provider support @cgroschupp (#559)
- fix(verify): Rejects unsafe principals in authorized_keys @EthanHeilman (#597)
- Warn when a policy row matches on an unverified email @arpitjain099 (#594)
- Support sshd_session_t SELinux domain in installer @ozan956 (#614)
- login: load certificate into ssh-agent with configurable lifetime @sini (#611)
- policy/plugins: marshal GROUPS and AUD env JSON with encoding/json @SashaMIT (#601)
🐛 Bug Fixes
- fix(verify): Rejects unsafe principals in authorized_keys @EthanHeilman (#597)
- fix: Policy footguns @EthanHeilman (#596)
- fix: Regression test for --private-key-file arg higher precedence over ~/.ssh/opkssh @EthanHeilman (#592)
- Accept a string email_verified claim in the plugin env vars @arpitjain099 (#595)
- Deny malformed oidc policy rows instead of panicking @arpitjain099 (#593)
Chores
- dep: Update to OpenPubkey v0.27.0 @EthanHeilman (#598)
- fix(deps): Update release-drafter/release-drafter action to v7.7.0 @renovate[bot] (#590)
- fix(deps): Update actions/setup-go action to v7 @renovate[bot] (#578)
- fix(deps): Update release-drafter/release-drafter action to v7.6.0 @renovate[bot] (#581)
- [fix] Windows linter errors @EthanHeilman (#577)
- fix(deps): Update zizmorcore/zizmor-action action to v0.6.0 @renovate[bot] (#575)
- fix(deps): Update Docker @renovate[bot] (#568)
- Bump testcontainers-go to 0.43.0 @EthanHeilman (#571)
- Update CLI documentation @github-actions[bot] (#627)
- fix(deps): Update dependency ubuntu to v26 @renovate[bot] (#616)
- chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 @dependabot[bot] (#608)
- fix: reject empty identity attributes in policy @SashaMIT (#603)
- fix(deps): Update go toolchain directive to v1.26.6 @renovate[bot] (#605)