chore: release

[github-actions]

🤖 New release

• pg-core: 0.6.1 -> 0.6.2 (✓ API compatible changes)
• pg-cli: 0.3.6 -> 0.3.7
• pg-pkg: 0.5.11 -> 0.6.0
• pg-ffi: 0.1.2 -> 0.1.3

Changelog

pg-core

0.6.2 - 2026-07-16

Added

• (api) accept Yivi condiscon in IrmaAuthRequest (#198)

Fixed

• bound stream signature length (#228)

Other

• clear clippy warning backlog for the clippy CI job (#193) (#229)
• consume irmars from crates.io and bump reqwest to 0.12 (#192)
• bump bincode-next 3.0.0-rc.13 to 3.0.0-rc.14 (#191)

pg-cli

0.3.7 - 2026-07-16

Added

• (api) accept Yivi condiscon in IrmaAuthRequest (#198)

Other

• (pg-cli) drop useless borrow in decrypt eprintln (clippy) (#231)
• bump reqwest 0.12 → 0.13 and inquire 0.6 → 0.9 (#196)
• consume irmars from crates.io and bump reqwest to 0.12 (#192)

pg-pkg

0.6.0 - 2026-07-16

Added

• (pkg) proxy IRMA /statusevents SSE endpoint (#200)
• (api) accept Yivi condiscon in IrmaAuthRequest (#198)

Fixed

• (pkg) fetch the IRMA JWT verification key lazily instead of at startup (#240)
• (pg-pkg) rate-limit on real client IP (X-Forwarded-For) behind a trusted proxy (#230)
• (pg-pkg) add per-IP rate limiting to /v2 API endpoints (#224) (#226)
• (pg-pkg) validate session token path param before upstream URL (#225)
• (pg-pkg) mask internal error details in HTTP responses (#221)
• (pg-pkg) [breaking] require explicit --allowed-origins for CORS (#216) (#219)

Other

• clear clippy warning backlog for the clippy CI job (#193) (#229)
• bump reqwest 0.12 → 0.13 and inquire 0.6 → 0.9 (#196)
• consume irmars from crates.io and bump reqwest to 0.12 (#192)
• bump bincode-next 3.0.0-rc.13 to 3.0.0-rc.14 (#191)
• address cargo audit advisories

pg-ffi

0.1.3 - 2026-07-16

Other

• clear clippy warning backlog for the clippy CI job (#193) (#229)

---

This PR was generated with release-plz.

[dobby-coder]

Clean release-plz bump for pg-pkg (0.5.11 → 0.5.12). Diff is limited to Cargo.toml version, Cargo.lock workspace entry, and the CHANGELOG entry; no source changes. The 'address cargo audit advisories' note corresponds to the audit allowlist additions previously merged. LGTM.