- Breaking change: Kubernetes API server proxy endpoints now require the "proxy" verb; roles must add it to allowed verbs.
- Security fixes: patched an SSRF vulnerability in AWS app access, capped AWS STS AssumeRole session duration to Teleport TTL, and sanitized AWS console federation errors to prevent credential leakage.
- Various bug fixes: corrected empty file uploads, prevented path separators in SCP filenames, fixed role impersonation logic, stopped cross‑cluster remote‑port‑forward cancellation, and upgraded golang.org/x/crypto to v0.53.0.