[github-actions]

Release

---

0.6.0 (2026-11-03)

Added

• let verify-only resource servers require a user (cee15df)
• let verify-only resource servers require a user (5cfebe1)

Fixed

• check Origin on unsafe methods whatever the SameSite setting (d8e5a40), closes #23
• keep a completed refresh for cookie transport for five seconds (eb9524f), closes #21
• let body-less refresh and logout through the content type gate (5447b2e), closes #23
• no refresh replay after rotation, and origin check whatever the SameSite setting (0d7fbe8)
• refuse a null Origin before checking Sec-Fetch-Site (a4d4708), closes #23
• run refresh rotation detached and keep cookies on transport errors (e8ba2f0), closes #22
• share a refresh rotation only while it is in flight (a569544), closes #21
• sync the bundled adapter manifest with API 0.22.0 (61514c5)
• sync the bundled adapter manifest with API 0.22.0 (6b4e343)
• sync the bundled manifest with seamless-auth-api 0.22.0 (6bf02d7)

---

Merging this PR tags the release and creates the GitHub release.