0.7.0 - 2026-07-14

Use python native logging configuration to make sure backtraces are sane(r) (#22)
Bundle frpc licence in release wheel (#40)
Add -r/--role option to pf login/pfa login (#43)
Avoid garbage on stdout/stderr upon webbrowser.open() (#44)

0.6.0 - 2026-07-10

create pf-api-rotate binary on install (#24)
handle PF_API_KEK_FILENAME in pf-api-rotate (#25)
Use absolute paths for pf binaries (#26)
setup bastion register service in script generated by "openssh host-init" (#27)
Update pfat Bastion screens: connect/register urls are replaced with a single url field (#28)
auto-login for non-interactive headless authentication on "bastion register" (#29)
Use a single source of truth for changelog entries (#30)
add --version option (#31)
Make bastion HTTP CONNECT protocol RFC compliant (#32)
Allocate socat port number dynamically to avoid test failures due to port collisions (#33)
Subtenants are not allowed to have ssh-style permissions (#34)
Use frpc/frps instead of custom bastion protocol to improve robustness (#36)
Run pf-host-refresh automatically when the network comes back up via network manager dispatcher script (#37)
Use auth.tokenSource.type=exec to allow reconnections after the initial token expiration (#38)

CHANGELOG.md
Add "pfa initialize --transient-key" (#9)
Track client_type on a per-auth basis (#12)
Ask user to choose which authentication to use to accept an invitation if there is ambiguity
Add a ping command to verify connectivity (#20)
Attempt to open automatically in user's browser device code flow url (#21)

Split main package provablyfine (AGPLv3) in two packages, provablyfine (AGPLv3) and provablyfine-client (MIT)