0.4.0 (2026-05-16)

Bug Fixes

• add subject to resource access logs, add missing GroupBinding e2e tests (cc7f4d5)
• address code review feedback (fbed2bb)
• copy full server package and build with '.' in Dockerfile (b17550e)
• correct gitignore pattern for server binary (90d5dc3)
• remove compiled binary from git tracking (5c9f99d)
• remove stale backward-compat note from oidc.md (c6745bb)
• remove stray binary from git tracking (f22191d)
• require groups claim for OIDC access; no bypass path (596db28)
• sort GroupBindings by name for deterministic first-match semantics (5926001)

Features

• add * wildcard for providerResources; use exact-name matching for providers (2025106)
• add Dex-backed OIDC authentication and terraform login support (3704d54)
• add GroupBinding CRD for fine-grained OIDC access control (2889f36)
• add OIDC client credentials auth support with GroupBinding integration (199e503)
• Merge pull request #55 from tonedefdev/refactor/split-server-main (c5de573)
• server: add OIDC ServiceAccount fallback auth mode (d86b07d)