Instance admins can now manage the expiry and character sets of invite codes via the Admin API.

Added FIPS 140-3 compliant build and runtime checks, including a separate build matrix for certified images.

Fixes a regression in v4.15.3 where Token Exchange flows using subject_token_type=user_id or id_token would fail with invalid_scope.

The Login V2 flow now correctly filters sessions by organization scope; if no eligible sessions exist, it redirects straight to the login name screen instead of an empty account selection.

Ensures that OIDC authorization requests using Prompt.LOGIN and loginHint correctly preserve the 'oidc_' prefix on the requestId, fixing broken redirects to /signedin.

Optimized the ListUser query by login name to perform case-insensitive searches more efficiently.

Restored support for custom protocol schemes (e.g., myapp://) for native apps by bypassing CSP prefetch restrictions.

Prevents IDP auto-creation failures when profile fields are missing required data by redirecting to the registration completion step.

Moved verification email triggering to server-side POST handlers to prevent race conditions that caused duplicate emails.

Updated Tailwind opacity utilities and fixed checkbox contrast by using CSS variables.