What's Changed

• feat: block certificate deletion until expiry by @carlosmonastyrski in #8213
• fix: prevent renewal identity bypass via ambiguous DN comparison by @carlosmonastyrski in #8223
• feature(gateway): gcp enrollment by @bernie-g in #8143
• docs(audit-logs): audit audit logs by @adkah in #8240
• chore: add upgrade impact for v0.165.12 by @github-actions[bot] in #8176
• chore: add upgrade impact for v0.165.14 by @github-actions[bot] in #8232
• fix(ci): skip open upgrade-impact PRs and alert when review is blocked by @victorvhs017 in #8256
• improvement(secrets): simplify resource creation menu by @andrewhuhh in #8206
• chore: add upgrade impact for v0.165.15 by @github-actions[bot] in #8252
• improvement(ui): simplify secret name sort trigger by @andrewhuhh in #8260
• fix(secrets): use eye icon for generated credentials by @andrewhuhh in #8258
• improvement(ui): show root slash in folder breadcrumb by @andrewhuhh in #8259
• improvement(secret-sync): surface Include All Subfolders in the UI and docs by @lobocv in #8210
• feat: secret scanning batching by @mathnogueira in #8186
• feat(analytics): track add resource menu usage by @andrewhuhh in #8262
• fix(cron): spread pickup with derived jitter and concurrency cap by @victorvhs017 in #8254
• fix: resovled an bug in secret fetch by @akhilmhdh in #8264
• fix(ui): remove extra gap from create secret sheet by @andrewhuhh in #8266
• feat(auth): add signup flow experiment by @andrewhuhh in #7915
• fix: require the OCI signature to belong to the supplied user OCID by @Thiago-AS in #8215
• docs(cli): document named login profiles by @scott-ray-wilson in #8263
• improvement(dynamic-secret): add validations to ssh by @adilsitos in #8177
• feat(pam): clickhouse by @lb-vn in #8185
• chore: remove banner by @varonix0 in #7728
• docs(api): add get started section by @adkah in #8267
• feat: fixed ca bug in ssh dynamic secret by @akhilmhdh in #8276
• docs(syncs): audit daytona sync and app connection guide by @adkah in #8277

Full Changelog: v0.165.15...v0.165.16

What's Changed

• fix(agent-vault): expose agent vault routes in the openapi spec by @saifsmailbox98 in #8224
• docs: drop redundant "sync" from Secret Syncs sidebar labels by @claude[bot] in #8234
• feat: removed license deprecation banner from usage and billing by @akhilmhdh in #8236
• fix: return 204 from delete and resolve users by any alias by @Thiago-AS in #8154
• feat(ui): add card explaining that additional privileges were moved by @adilsitos in #8095
• fix(auth): enforce dark mode on auth pages by @andrewhuhh in #8238
• feat: built-in PAM masking by @sheensantoscapadngan in #8196
• feat(ui): add navbar theme toggle by @andrewhuhh in #8244
• feat: remove stuck timeout env var by @mathnogueira in #8241
• fix(ui): focus alert dialog inputs on open by @andrewhuhh in #8243
• fix(frontend): align expanded secret manager rows by @andrewhuhh in #8242
• fix(ui): match Anthropic and OpenAI logos across themes by @andrewhuhh in #8248
• fix(audit-logs): apply secret filters to folder read events by @jakehulberg in #8250
• improvement(sso): stop duplicating surnames when OIDC omits given_name by @victorvhs017 in #8214

Full Changelog: v0.165.14...v0.165.15

What's Changed

• chore: add upgrade impact for v0.165.13 by @github-actions[bot] in #8217
• feat(api): implement billing v2 usage breakdown and organization listing by @victorvhs017 in #8099
• feat: add PowerDNS as a DNS-01 provider for ACME certificate authorities by @carlosmonastyrski in #8139
• fix(ui): remove autofill seams around rounded inputs by @andrewhuhh in #8219
• fix(ui): improve Agent Vault contrast in light mode by @andrewhuhh in #8220
• feat(agent-vault): method and path rules, custom headers, and substitutions by @saifsmailbox98 in #8130
• fix(ui): prevent detail cards from collapsing by @andrewhuhh in #8216
• improvement(secrets): simplify bulk selection and add clipboard copying by @andrewhuhh in #8189
• feat: add transactional event outbox and event-triggered alerts by @Thiago-AS in #8072
• fix(storybook): support app themes and product accents by @andrewhuhh in #8227

Full Changelog: v0.165.13...v0.165.14

What's Changed

• feat(analytics): track paywall-to-billing funnel by @andrewhuhh in #8144
• docs(style): migrate icons to lucide by @adkah in #8175
• feat(pki-syncs): choose sync certificates by filter by @carlosmonastyrski in #8107
• fix: truncate long custom extensions by @carlosmonastyrski in #8173
• feat(project): limit secret scanning to one project per organization by @claude[bot] in #8174
• docs(agent-vault): fit into product model by @adkah in #8178
• fix(ldap-auth): enforce bind password when changing LDAP URL by @victorvhs017 in #8160
• improvement(agent-vault): collapse proxy settings under advanced options by @saifsmailbox98 in #8138
• feat(agent-vault): add product intro modal by @saifsmailbox98 in #8141
• fix(api): allow non-uuid project IDs in projectId validators by @claude[bot] in #8180
• fix(frontend): drop removed showSlugField prop from ProjectOverviewChangeSection call site by @claude[bot] in #8188
• fix(agent-vault): serve intro diagram from public so CSP allows it by @saifsmailbox98 in #8190
• docs: remove the Agent Vault preview callout by @claude[bot] in #8192
• fix(helm): default autoBootstrap secretDestination.namespace to release namespace by @devin-ai-integration[bot] in #8191
• chore(frontend): upgrade build tooling to Vite 8 by @andrewhuhh in #8161
• improvement(ui): refine secrets overview header by @andrewhuhh in #8201
• docs(agent-vault): dynamic agent vault quickstart by @adkah in #8193
• fix(secrets): keep folder description tooltip inline by @andrewhuhh in #8203
• fix(billing): prevent duplicate mutation error toasts by @andrewhuhh in #8198
• improvement(secrets): align remaining expanded resource rows by @andrewhuhh in #8195
• fix(secrets): clarify copy preview access errors by @andrewhuhh in #8184
• improvement(ui): migrate Certificate Manager pages to v3 headers by @andrewhuhh in #8159
• fix(frontend): discover all frontend tests by @andrewhuhh in #8164
• feat(ui): add light mode by @andrewhuhh in #7708
• docs: update supported Redis versions in Linux package installation by @AbhiPra24 in #8187
• feat(secret-sync): recursive secret syncs, stage one by @lobocv in #8087
• chore: deprecate gateway v1 by @sheensantoscapadngan in #8127
• docs(agent-vaut): improve agent vault quickstart style by @adkah in #8211
• chore(ci): scan released images with Trivy by @Vligai in #8162
• feat: add validation rule unique values across the whole project by @mathnogueira in #8094
• improvement(admin): align server console surfaces with v3 by @andrewhuhh in #8158
• improvement(ui): progressively render notifications by @andrewhuhh in #8205

New Contributors

• @AbhiPra24 made their first contribution in #8187

Full Changelog: v0.165.12...v0.165.13

What's Changed

• feat(pam): restore Oracle Database account support by @carlosmonastyrski in #8035
• fix(cert-management): fix dupe member issue by @lb-vn in #8147
• fix: oracle cli version by @carlosmonastyrski in #8152
• improvement(frontend): migrate server admins modal to v3 components by @claude[bot] in #8045
• improvement(admin): migrate remaining server console UI to v3 by @andrewhuhh in #8149
• docs(agent-vault): revamp agent vault docs by @adkah in #8128
• improvement(ui): modernize secrets overview and project list by @andrewhuhh in #7748
• fix: point MFA and Google SSO enforcement upgrade gates at the Advanced plan by @Thiago-AS in #8156
• fix(project-roles): unblock duplicating the built-in Admin role by @claude[bot] in #8157
• feat: add PostHog trial events for cloud billing trials by @0xArshdeep in #8145
• fix(identity-gcp-auth): enforce GCE project and zone restrictions by @victorvhs017 in #8148
• docs: add minimum requirements for relay and gateway by @sheensantoscapadngan in #8146
• feat: support AWS US ISO and ISOB regions for external KMS by @Thiago-AS in #8170
• fix(agent-vault): audit product copy by @adkah in #8172
• feat(pki): certificate audit log details by @bernie-g in #8117
• docs(cli): update Cloudsmith cutoff to past tense and drop install-page warning by @victorvhs017 in #8171
• improvement(auth): make signup hCaptcha invisible by @andrewhuhh in #8163
• fix: enforce privilege boundary on auth method changes on legacy system by @Thiago-AS in #8061
• fix: avoid lockout when removing a lost factor and honor org enforcement from any org by @Thiago-AS in #8105

Full Changelog: v0.165.11...v0.165.12

What's Changed

• improvement(frontend): migrate kmip server details page to v3 by @claude[bot] in #8067
• improvement(secret-sync): pin sync behaviour with end-to-end tests and a runnable test harness by @lobocv in #8062
• fix(queue): log job failures and make PINO_LOG_LEVEL work by @lobocv in #8089
• improvement(frontend): test secrets activation modal versus card by @claude[bot] in #8060
• chore(ui): add semantic z-index registry by @andrewhuhh in #8082
• fix(auth): preserve password autofill styling and signup username targeting by @andrewhuhh in #8084
• improvement(secret-syncs): modernize forms and harden destination selection by @andrewhuhh in #7902
• fix(ui): disable autocomplete for resource names by @andrewhuhh in #8086
• chore(auth): revert grouped input autofill styling and signup form restructure by @scott-ray-wilson in #8102
• feat(gateways): make relay optional by @bernie-g in #7992
• feat(agent-vault): agents that run without credentials by @saifsmailbox98 in #8000
• chore: resolved personal override failure by @akhilmhdh in #8106
• docs(get-started): overhaul get started section by @adkah in #8098
• docs(get-started): remove dupe heading by @adkah in #8113
• improvement(agent-vault): mark agent vault as preview by @saifsmailbox98 in #8111
• feat: support custom X.509 extensions on certificate policies and profiles by @carlosmonastyrski in #7943
• fix(ui): render project access errors during route loading by @andrewhuhh in #8103
• fix(kms): block cross-project key deletion via project cleanup by @bernie-g in #8112
• feat: added support for self serve upgrade by @akhilmhdh in #8088
• fix(pki-sync): enforce project boundary when resolving app connections by @carlosmonastyrski in #8118
• feat(ui): track command menu usage by @andrewhuhh in #8115
• feat(pam): snowflake account by @lb-vn in #8044
• patch(pam): snowflake cli version by @lb-vn in #8119
• fix(auth): move invalid credentials to password field by @andrewhuhh in #8114
• improvement(ui): adopt shared z-index values across v3 primitives by @andrewhuhh in #8083
• improvement(frontend): migrate org settings headers and tabs to v3 by @claude[bot] in #8070
• fix: allow group-derived project members as approval policy approvers and bypassers by @claude[bot] in #8075
• feat(secrets): implement copy secrets workflow by @andrewhuhh in #7951
• fix(auth): restore signup form ownership and autofill by @andrewhuhh in #8101
• improvement(frontend): focus dominant search inputs with the / hotkey by @claude[bot] in #8069
• improvement(admin): migrate server console headers to v3 by @andrewhuhh in #8131
• improvement(project): redesign general settings by @andrewhuhh in #8116
• fix(api): preserve glob braces in identity auth claims by @andrewhuhh in #8096
• docs(readme): refresh hero image, fix broken links, move community to forum by @jakehulberg in #8135
• docs(trim-suffix): enhance-docs by @adilsitos in #7892
• chore: add upgrade impact for v0.165.10 by @github-actions[bot] in #8090
• feat(refac): move old modal to v3 by @adilsitos in #8133
• fix(secret-rotation): retry Azure client secret revoke and clean up on failure by @claude[bot] in #8048
• fix(webhook): prevent webhook events from being lost during long runs by @lobocv in #8122
• fix: resolved loosing invoice on losing sub by @akhilmhdh in #8142
• chore(deps): refresh Debian security pins and update socks to 2.8.10 by @Vligai in #8140
• fix: webhook registration when github radar is not configured by @mathnogueira in #8136
• feat: add time units to secret scanning env variables by @mathnogueira in #8132

Full Changelog: v0.165.10...v0.165.11

What's Changed

• fix(group-service): block sub-org membership changes on parent-owned groups by @victorvhs017 in #8030
• fix(pki): issue only policy-validated subject and SAN values by @carlosmonastyrski in #8056
• fix(pam): atomic recording secret mint by @bernie-g in #8043
• docs(nav): restore Agent Vault as an external link by @claude[bot] in #8077
• feat: validation rule api revamp by @varonix0 in #8046
• improvement(frontend): migrate kmip servers page to v3 components by @claude[bot] in #8066
• improvement(signup): streamline onboarding and workspace navigation by @claude[bot] in #8007
• fix(announcements): stabilize modal height and image loading by @andrewhuhh in #8042
• chore: add upgrade impact for v0.165.9 by @github-actions[bot] in #8071
• feat(pki): manage imported certificates by attaching a certificate profile by @carlosmonastyrski in #7961
• chore(dep): node base and npm bump by @Vligai in #8051
• feat(vault-migration): add support for folder creation by @adilsitos in #7928

Full Changelog: v0.165.9...v0.165.10

What's Changed

• chore: add upgrade impact for v0.165.8 by @github-actions[bot] in #8039
• fix(dynamic-secrets): add missing provider logos by @andrewhuhh in #8032
• chore(deps): bump the bundled CLI to 0.43.129 by @Vligai in #8026
• improvement(security): derive cookie signing key from KMS root key by @victorvhs017 in #8029
• feat(secret-sync): detect duplicate Daytona syncs by organization by @lobocv in #7994
• improvement(frontend): upgrade framer-motion to motion by @claude[bot] in #8033
• improvement(ui): point onboarding CTA to community instead of Slack by @claude[bot] in #8009
• fix(github-org-sync): safely sync teams for large orgs by @scott-ray-wilson in #7998
• fix(secrets-access-requests): auto open review sheet when request ID present by @varonix0 in #8041
• feat(ui): add global command menu by @andrewhuhh in #7877
• docs(integrations): poc for app connections and integrations format revamp by @adkah in #8028
• improvement(frontend): flatten pki sidebar general section into top-level items by @claude[bot] in #8049
• improvement(frontend): render server console banners inside sidebar inset by @claude[bot] in #8050
• feat: add pki license gating by @sheensantoscapadngan in #7939
• improvement(frontend): migrate add machine identity to project dialog to v3 by @claude[bot] in #8047
• improvement(frontend): lower bulk action bar and add shadow by @claude[bot] in #8059
• chore(project-cleanup): clarify concurrent worker deletion log message by @victorvhs017 in #8053
• feat: introduce INFISICAL_RUN_MODES by @mathnogueira in #8031
• improvement(frontend): rename v3 switch component to toggle by @claude[bot] in #8065
• fix: allow read operations in cross project secret sharing by @mathnogueira in #7966
• improvement(frontend): use Alert and Combobox in Doppler import modal by @andrewhuhh in #8058
• fix(pki): set intermediate CA parentCaId to null instead of cascading on parent delete by @carlosmonastyrski in #8063

Full Changelog: v0.165.8...v0.165.9

What's Changed

• chore: add upgrade impact for v0.165.7 by @github-actions[bot] in #8027
• fix(telemetry): bound HTTP metric cardinality and add core request counter by @victorvhs017 in #7995
• docs(pam): rework postgres discovery guide by @adkah in #8034
• fix(secret-rotation): accept iLO 7 "hpeiLO->" prompt in HP iLO rotation by @claude[bot] in #7977

Full Changelog: v0.165.7...v0.165.8

What's Changed

• fix: make many-to-one aws sm sync only target one secret by @mathnogueira in #7999
• chore: add upgrade impact for v0.165.6 by @github-actions[bot] in #8004
• docs(platform): additional screenshot pass by @adkah in #7997
• improvement(frontend): reduce mobile padding on overview and dashboard pages by @claude[bot] in #8005
• feat: allow one LDAP connection to back many Linux and Windows syncs by @carlosmonastyrski in #7867
• fix: coalesce concurrent secret reference folder loads by @maidul98 in #8011
• fix: split query into 3 ones to reduce duplicate alloc by joins by @mathnogueira in #8012
• improvement(audit-log): tag stale-claim drops with stream provider by @victorvhs017 in #8001
• fix(app-connections): standardize add sheet discard handling by @andrewhuhh in #7942
• improvement(approvals): add create-policy CTA to change requests empty state when no policies exist by @claude[bot] in #8008
• fix(frontend): match secret row hover actions to standard ghost icon buttons by @claude[bot] in #8020
• feat(pam): break-glass for access requests by @lb-vn in #7930

Full Changelog: v0.165.6...v0.165.7