release: v0.5.0

[y1o1]

Cuts ## [Unreleased] as ## [0.5.0] — 2026-09-06. CHANGELOG only.

What 0.5.0 contains

• Security — introspection cache entries respect token expiration (including expiry during the provider call, TTL zero bypassing the cache); validation rejects sender-constrained tokens on its Bearer-only path; injection maps a rejected session grant to 401 session_required.
• Fixed — graceful shutdown had no drain deadline, so one stuck in-flight request meant SIGTERM never completed and SIGKILL cut the process mid-flight. It now drains for drainTimeoutMs, bounds cleanup by cleanupTimeoutMs, force-closes past the deadline and exits non-zero. Separately, the deployed proxy had no pino — auth.utils took it as an optional peer, this repo satisfied it from devDependencies, and the Dockerfile prunes those before the runtime stage, so every production line was a console fallback rather than NDJSON (fix: internalize @o3co/auth.utils, restoring the shutdown deadline and NDJSON logs #81).
• Changed — @o3co/auth.utils is no longer a dependency; its five helpers live here with their own tests (fix: internalize @o3co/auth.utils, restoring the shutdown deadline and NDJSON logs #81).

Note on the preceding tag

v0.4.0 was never tagged: its release: v0.4.0 commit (a5669b6) merged to develop on 2026-09-04, but no tag was pushed, so no GitHub Release was ever cut for it while the CHANGELOG advertises it. v0.4.0 is being tagged at a5669b6 first so the release list has no hole; this repo is private: true, so neither tag publishes to npm.

Merge this PR, then push v0.4.0 before v0.5.0.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The newly cut 0.5.0 section includes placeholder/redacted text that should be corrected before tagging/publishing the release notes.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the project changelog to cut a 0.5.0 release entry dated 2026-09-06, transitioning the current release notes out of Unreleased.

Changes:

• Adds a new ## [0.5.0] — 2026-09-06 section header directly after ## [Unreleased].

File summaries

File	Description
CHANGELOG.md	Cuts the release notes into a new 0.5.0 dated section.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.