- Fixed a CredentialContainer error for Web UI logins with hardware keys on Firefox and patched an Azure OIDC IdP role‑mapping issue (bugfix, security).
- Added several new CLI and helm capabilities: delete cluster alerts via `tctl alerts rm`, export additional trusted keys, PID file flag for tbot systemd install, configurable kubeconfig for tbot Kubernetes secrets, `tctl get cert authorit...
- Updated OpenSSL to 3.0.19, refreshed indirect dependencies, improved DynamoDB query performance, and introduced SCIM PATCH audit events and Entra ID group‑owner import support (security, minor).