[cluckwork-lockfix]

🤖 I have created a release beep boop

1.2.0 (2026-11-14)

Features

• access: require two-factor for every Owner after a per-Owner grace period (#1402) (572ff20)
• auth: ask an enrolled user for a code at step-up and change-password (#1384) (a1a46fc)
• auth: ask an enrolled user for an authenticator code at login (#1380) (da362b9)
• auth: give AspNetUserTokens a tenant guard and store two-factor secrets protected (#1345) (34d00f6)
• auth: TOTP enrolment endpoints and logout hardening (#1396) (58aabee)
• auth: turn off and reset two-factor, and clear it in recover-admin (#1388) (abfeb42)
• data-protection: keep reading keys encrypted with previous certificates (#1419) (d4daa9a)
• data-protection: re-encrypt stored keys so a previous certificate can be retired (#1432) (0cf41e2)
• web: ask an enrolled user for a code at step-up, consent and change-password (#1385) (9073073)
• web: lead every Owner to two-factor setup, with a deadline before it and a setup screen after it (#1403) (732cf06)
• web: let an Owner reset another user's two-factor authentication (#1389) (fe2033b)
• web: turn on TOTP two-factor from Account › Security (#1395) (1aa3f51)

Bug fixes

• api: redact credential records and discover them automatically (#1412) (f637574)
• ci: read each lockfix pipe status on its own (#1416) (938e218)
• web: let a user's name wrap so the Users table fits at 1024 px (#1400) (0d5b060)
• web: one proof block in every step-up dialog, usted in Spanish, and unsaved recovery codes dropped on another tab's sign-in or sign-out (#1413) (276241b)

Documentation

• lockfix: document @dependabot recreate for conflicted Dependabot NuGet PRs (#1411) (0fbda97)

Dependencies

• bump Aspire to 13.6.5 for GHSA-f7vh-h5g3-7jrh (#1406) (79af98e)
• Bump the nuget-minor-patch group with 1 update (#1382) (a22c08f)
• Bump the nuget-minor-patch group with 3 updates (#1429) (2ee1d2a)
• Bump the nuget-minor-patch group with 7 updates (#1394) (0248492)
• docker: bump node from 26.12.1-alpine to 26.13.0-alpine in /src/Cluckwork.Api in the docker-base-images group (#1422) (faaefb7)
• docker: bump the docker-base-images group in /src/Cluckwork.Api with 2 updates (#1390) (a26e24b)
• docker: refresh .NET base images to 10.0.15 to clear CVE-2026-109518 (#1415) (2d03981)
• web: bump lucide-react from 1.66.0 to 1.70.0 in /web in the production-minor-patch group (#1424) (8a04ca8)
• web: bump the production-minor-patch group in /web with 2 updates (#1381) (a26f634)
• web: bump the production-minor-patch group in /web with 4 updates (#1392) (8489ad7)

---

This PR was generated with Release Please. See documentation.