0.7.1 — 2026-09-30 Release hardening: rate limits key on the real client, and release jobs wait for e2e. - Self-service rate limits key on the client address, trusting `X-Forwarded-For` only from private-range proxies. - The SBOM and release jobs run only after e2e passes. - Pipeline components pin to 4.8.0, the reference docs to `v0.6.0`, and the portal runtime image to a digest. - Leftover source-comment headers are trimmed, and the unused `axe-core` e2e dependency is removed. - Renovate: lock file maintenance, and the `ubi10/nodejs-22` 10.2 image digest.