- Workload ID attestors for Kubernetes, Podman, and Docker now capture container image digests.
- Introduced a proxy protocol "allow downgrade" field for IPv6‑to‑IPv4 connections (incompatible with IP pinning).
- Fixed SAML metadata timeout UI/tsh issue and Azure VM auto‑discovery bug; upgraded Go runtime to 1.23.8.