Release v0.6.0

[stsepelin]

Stamps ## [Unreleased] as ## [0.6.0] - 2026-08-22 and adds the compare links. No code changes.

What ships

• Abilities / scopes (Abilities / scopes #29) — coarse stateless authorization in the scope claim, lukk.ability: / lukk.abilities: gates, $user->tokenCan(), pinned grants.
• Account erasure & export (Account erasure and export (GDPR Art. 17 / Art. 15) #30) — GDPR Art. 17 / Art. 15, step-up confirmed and gated on lukk.account.delete.
• Step-up confirmations bound to the earning session (Account erasure and export (GDPR Art. 17 / Art. 15) #30).
• PHPStan level 8 on src/, enforced in CI (PHPStan level 8: src clean and gated in CI #31) — plus the two-factor guard-awareness and unreadable-secret fixes found reviewing it.

⚠️ Two breaking changes

Both are in UPGRADE.md.

1. A nullable guard column on passkeys. Fresh installs and single-guard apps need no action. A multi-guard install that already ran the passkeys migration must add the column and backfill it — until then lukk:prune deliberately sweeps no passkeys rather than risk deleting a credential it cannot attribute. Removing a guard needs the opposite cleanup and fails open.
2. features.account_deletion defaults to true, so upgrading adds an irreversible DELETE /auth/account. Turn it off where deletion is owned elsewhere.

Pre-1.0, so per SemVer §4 these belong in a minor bump — the same shape as 0.4.0, which added the refresh_tokens guard column.

Verification

532 tests + 5 concurrency (real PostgreSQL and MySQL) · 100% coverage · Pint · PHPStan level 8 on src/ · PHP 8.3/8.4/8.5 × Laravel 12/13.

Release order: this tag must reach Packagist before lukk-js 0.11.0 publishes — its conformance fixture builds against the published package.

Greptile Summary

Stamps the accumulated changelog entries as the v0.6.0 release dated 2026-08-22.

• Updates the Unreleased comparison target to start at v0.6.0.
• Adds the v0.6.0 comparison link covering changes since v0.5.0.

Confidence Score: 5/5

The PR appears safe to merge with no actionable issues identified.

The changelog stamp and comparison links are internally consistent and follow the repository’s established release format without affecting runtime code or release-note extraction.

Important Files Changed

Filename	Overview
CHANGELOG.md	The release heading and comparison links consistently advance the changelog from v0.5.0 to v0.6.0.

_{Reviews (1): Last reviewed commit: "Release v0.6.0" | Re-trigger Greptile}