v0.165.17

## What's Changed
* chore: add upgrade impact for v0.165.16 by @github-actions[bot] in https://github.com/Infisical/infisical/pull/8279
* fix(org): limit users to one self-created organization by @Vligai in https://github.com/Infisical/infisical/pull/8239
* docs(style): update style guide and skill by @adkah in https://github.com/Infisical/infisical/pull/8281
* fix(ui): restore secrets activation experiment variant routing by @andrewhuhh in https://github.com/Infisical/infisical/pull/8284
* docs(cli): rename [profile new] to [profile create] by @scott-ray-wilson in https://github.com/Infisical/infisical/pull/8285
* improvement(ui): make secret reference tree read-only (no rename) by @Vligai in https://github.com/Infisical/infisical/pull/8286
* feat(agent-vault): add a members/available endpoint so the add dialogs offer only unassigned actors by @scott-ray-wilson in https://github.com/Infisical/infisical/pull/8246
* docs(syncs): refresh snowflake sync and app connection by @adkah in https://github.com/Infisical/infisical/pull/8282
* fix(frontend): use card surface for project tiles by @andrewhuhh in https://github.com/Infisical/infisical/pull/8299
* feat(table): add opt-in sticky header by @andrewhuhh in https://github.com/Infisical/infisical/pull/8288
* improvement(secret-sharing): overhaul sharing UX across surfaces by @andrewhuhh in https://github.com/Infisical/infisical/pull/8165
* improvement(frontend): dim inactive secret rows by @andrewhuhh in https://github.com/Infisical/infisical/pull/8230
* feat(ui): add inline and dialog creation to v3 combobox by @andrewhuhh in https://github.com/Infisical/infisical/pull/8225
* fix(frontend): unify project manager layout padding by @andrewhuhh in https://github.com/Infisical/infisical/pull/8302
* fix: refine create secret form layout and controls by @andrewhuhh in https://github.com/Infisical/infisical/pull/8301
* improvement(ui): use shadow-xs as default Card shadow by @andrewhuhh in https://github.com/Infisical/infisical/pull/8298
* fix(identity-auth): redact outgoing request headers and JWTs by @victorvhs017 in https://github.com/Infisical/infisical/pull/8295
* docs(agent-vault): audit 2 by @adkah in https://github.com/Infisical/infisical/pull/8290
* improvement(ui): soften shell navigation borders by @andrewhuhh in https://github.com/Infisical/infisical/pull/8308
* feat: disabled posthog auto mode things by @akhilmhdh in https://github.com/Infisical/infisical/pull/8272
* improvement(ui): centralize wide sheet sizes by @andrewhuhh in https://github.com/Infisical/infisical/pull/8312
* improvement(cron): spread per-pod refresh timers with startLocalRefresh by @victorvhs017 in https://github.com/Infisical/infisical/pull/8291
* fix(ui): keep secrets toolbar controls together at narrow widths by @andrewhuhh in https://github.com/Infisical/infisical/pull/8309
* feat: token auth credential expiry and multiple alerts per machine identity by @Thiago-AS in https://github.com/Infisical/infisical/pull/8270
* fix: addressed alerting on pki issuance by @sheensantoscapadngan in https://github.com/Infisical/infisical/pull/8304
* docs(pam): remove enumerated account types from templates overview by @claude[bot] in https://github.com/Infisical/infisical/pull/8319
* fix: accept native SPIFFE bundle format from spire-server by @Thiago-AS in https://github.com/Infisical/infisical/pull/8287
* feat(ui): pin combobox creation to dropdown footer by @andrewhuhh in https://github.com/Infisical/infisical/pull/8305
* improvement(ui): align embedded audit log cards with v3 by @andrewhuhh in https://github.com/Infisical/infisical/pull/8222
* fix(ui): keep create secret value in keyboard tab flow by @andrewhuhh in https://github.com/Infisical/infisical/pull/8310
* fix(frontend): keep long secret values from stretching the secrets table by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8320
* improvement: simplify resolved secret value popover by @andrewhuhh in https://github.com/Infisical/infisical/pull/8314
* fix(pki): surface why a CA cannot be deleted by @claude[bot] in https://github.com/Infisical/infisical/pull/8326
* fix(pki): name the certificate profiles blocking a CA delete by @claude[bot] in https://github.com/Infisical/infisical/pull/8327
* feat: record external CA issued values and drop issuer-written extensions on renewal by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/8249
* chore: deprecation notice for subscribers and templates by @sheensantoscapadngan in https://github.com/Infisical/infisical/pull/8253
* feat(gateway): terraform support by @bernie-g in https://github.com/Infisical/infisical/pull/8257
* fix(frontend): complete cli login for signups by @adkah in https://github.com/Infisical/infisical/pull/8322
* improvement(kms): migrate project KMIP clients to v3 by @andrewhuhh in https://github.com/Infisical/infisical/pull/8306
* improvement(ui): align secret update confirmation with v3 dialog by @andrewhuhh in https://github.com/Infisical/infisical/pull/8325
* fix(secret-sync): keep hyphens in imported Azure Key Vault secret names by @adilsitos in https://github.com/Infisical/infisical/pull/8268
* docs: align v3 design guide with current contracts by @andrewhuhh in https://github.com/Infisical/infisical/pull/8317
* docs(azure): oauth permissions by @adilsitos in https://github.com/Infisical/infisical/pull/8335
* fix(secret-sync): digital ocean enhancements by @adilsitos in https://github.com/Infisical/infisical/pull/8333
* feat: upgrade CLI version to 0.43.136 for scanning by @mathnogueira in https://github.com/Infisical/infisical/pull/8293
* feat(secrets): redesign move destination picker by @andrewhuhh in https://github.com/Infisical/infisical/pull/7554
* feat(agent-vault): offer only ungranted members in the access bundle grant picker by @scott-ray-wilson in https://github.com/Infisical/infisical/pull/8292
* fix: hide all endpoints from secret scanning by @mathnogueira in https://github.com/Infisical/infisical/pull/8330
* improvement(ui): let secrets name column rebalance by @andrewhuhh in https://github.com/Infisical/infisical/pull/8316
* fix(ui): refresh secret list variants after mutations by @andrewhuhh in https://github.com/Infisical/infisical/pull/8336
* feat: add OCSP responder for internal certificate authorities by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/8265
* feat: fix on secret paths (pit and dashboard routes) by @adilsitos in https://github.com/Infisical/infisical/pull/8296
* feat(pam): terminate sessions on user removal from org by @lb-vn in https://github.com/Infisical/infisical/pull/8155
* fix(gateway): impersonation by @lb-vn in https://github.com/Infisical/infisical/pull/8315
* improvement(secrets): reduce CPU on recursive secret fetches by @victorvhs017 in https://github.com/Infisical/infisical/pull/8331
* feat: remove secret scanning config by @mathnogueira in https://github.com/Infisical/infisical/pull/8323
* fix: enforce conditional forbid rules on member privilege grants and assume privileges by @Thiago-AS in https://github.com/Infisical/infisical/pull/8280
* fix: resolved org auth enforcement failing in auth0 selected saml by @akhilmhdh in https://github.com/Infisical/infisical/pull/8342
* fix: revert "feat: remove secret scanning config" by @mathnogueira in https://github.com/Infisical/infisical/pull/8343
* feat(api): agent friendly api by @varonix0 in https://github.com/Infisical/infisical/pull/8271
* fix: batch findings in secret scanning by @mathnogueira in https://github.com/Infisical/infisical/pull/8345
* chore: replace infisical.com/slack links with community.infisical.com by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8347
* feat(secret-rotation): add Stripe app connection and API key rotation by @lobocv in https://github.com/Infisical/infisical/pull/8194
* fix: focus secret key with environments first by @andrewhuhh in https://github.com/Infisical/infisical/pull/8321
* docs(cli): refresh section by @adkah in https://github.com/Infisical/infisical/pull/8344
* fix(frontend): keep '#' inside unquoted pasted/imported secret values by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8359
* fix(ui): restore fixed secret key column width by @andrewhuhh in https://github.com/Infisical/infisical/pull/8361
* fix(rbac): warn about unknown policy environment and tag slugs by @andrewhuhh in https://github.com/Infisical/infisical/pull/8338
* fix(pki-sync): cleanup handling by @bernie-g in https://github.com/Infisical/infisical/pull/8297
* fix: allow deleting a sub-org from its own settings page by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8360
* fix(pki): include imported/external certificates in certificate dashboard by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8358
* improvement(secret-input): add warning message for unicode by @adilsitos in https://github.com/Infisical/infisical/pull/8355
* fix(membership): block individual project assignment for group-only identities by @victorvhs017 in https://github.com/Infisical/infisical/pull/8362
* chore: stripe whitelisting by @varonix0 in https://github.com/Infisical/infisical/pull/8365
* fix(scim): enforce privilege boundary on external group org role mappings by @victorvhs017 in https://github.com/Infisical/infisical/pull/8350
* feat(agent-vault): session logs by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/8275
* docs(style): full style audit by @adkah in https://github.com/Infisical/infisical/pull/8368
* chore(aws-auth): remove unused sts endpoint by @bernie-g in https://github.com/Infisical/infisical/pull/8363
* improvement(pam): move to global approvals by @lb-vn in https://github.com/Infisical/infisical/pull/8269
* feat(ui): resize secrets table columns by @andrewhuhh in https://github.com/Infisical/infisical/pull/8349
* improvement(ui): remove configurable tooltip hoverable content by @andrewhuhh in https://github.com/Infisical/infisical/pull/8374
* feat(agent-vault): add access bundle variables by @scott-ray-wilson in https://github.com/Infisical/infisical/pull/8352
* fix(pki): allow revoking imported certs under a DigiCert profile by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/8381
* chore(db): add agent vault tables to sanitized schema by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/8383
* fix(auth): enforce org membership on refresh and sub-org tokens by @victorvhs017 in https://github.com/Infisical/infisical/pull/8366
* docs(app-connections): add integration picker and revamp aws connection by @adkah in https://github.com/Infisical/infisical/pull/8379
* chore: upgraded package in openssl  by @akhilmhdh in https://github.com/Infisical/infisical/pull/8390
* fix(ui): remove announcement card focus ring by @andrewhuhh in https://github.com/Infisical/infisical/pull/8388
* improvement(secrets): add environment-scoped recency sorting by @andrewhuhh in https://github.com/Infisical/infisical/pull/8022
* improvement(secrets): distinguish root breadcrumb with home icon by @andrewhuhh in https://github.com/Infisical/infisical/pull/8395
* fix(auth): improve verification code focus and retry feedback by @andrewhuhh in https://github.com/Infisical/infisical/pull/8386
* fix: open policy sheet from approval empty states by @andrewhuhh in https://github.com/Infisical/infisical/pull/8334
* feat(ui): use IBM Plex Sans with Alliance headings and JetBrains Mono by @andrewhuhh in https://github.com/Infisical/infisical/pull/8283
* docs(agent-vault): audit session logs by @adkah in https://github.com/Infisical/infisical/pull/8387
* fix(projects): return kmsSecretManagerKeyId on project reads by @peter-manton in https://github.com/Infisical/infisical/pull/8382
* feat: move application alerts to the shared alerting module and by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/8369
* feat(ui): add organization ID copy button by @andrewhuhh in https://github.com/Infisical/infisical/pull/8385
* fix(ui): preserve routes and reset caches when switching organizations by @andrewhuhh in https://github.com/Infisical/infisical/pull/8377
* improvement(ui): render page notices above global navigation by @andrewhuhh in https://github.com/Infisical/infisical/pull/8396
* fix(ui): scope navigation plan badges to products by @andrewhuhh in https://github.com/Infisical/infisical/pull/8389
* feature: support for 3ds card payment by @akhilmhdh in https://github.com/Infisical/infisical/pull/8337
* docs: use circle-question-mark icon for self-hosting FAQ card by @adkah in https://github.com/Infisical/infisical/pull/8409
* fix: add uuid validation in secret approval requests by @mathnogueira in https://github.com/Infisical/infisical/pull/8412
* fix(ui): restrict sub-organization creation to root context by @andrewhuhh in https://github.com/Infisical/infisical/pull/8413
* fix(ui): improve personal override foreground contrast by @andrewhuhh in https://github.com/Infisical/infisical/pull/8410
* feat: let machine identities link root groups to sub-orgs by @Thiago-AS in https://github.com/Infisical/infisical/pull/8384
* feat(ui): allow leaving projects from the project list by @andrewhuhh in https://github.com/Infisical/infisical/pull/8418
* fix(ui): enable moving bulk-selected folders by @andrewhuhh in https://github.com/Infisical/infisical/pull/8411
* chore(ui): remove unused v2 component families by @andrewhuhh in https://github.com/Infisical/infisical/pull/8422
* chore(ui): remove secret sharing relocation banner by @andrewhuhh in https://github.com/Infisical/infisical/pull/8444
* chore(ui): remove orphan legacy features and v2 menu by @andrewhuhh in https://github.com/Infisical/infisical/pull/8425
* docs(sdk): fix typo in Go SDK docs by @AleksaMCode in https://github.com/Infisical/infisical/pull/7924
* docs: correct "wether" to "whether" in SDK and Jenkins docs by @akshatgg in https://github.com/Infisical/infisical/pull/8274
* feat(insights): org-wide secret value search and duplicate detection by @lobocv in https://github.com/Infisical/infisical/pull/8278
* docs: use single quotes in ABAC template helper examples by @claude[bot] in https://github.com/Infisical/infisical/pull/8447
* feat(clickhouse): native protocol support by @bernie-g in https://github.com/Infisical/infisical/pull/8332
* fix(ui): preserve hover and selection parity in v3 tooltips by @andrewhuhh in https://github.com/Infisical/infisical/pull/8427
* fix(ui): contain alert dialog confirmation overflow by @andrewhuhh in https://github.com/Infisical/infisical/pull/8416
* feat: migrate certificate export modals to v3 with compact PEM blocks by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/8404
* feat: remove vault migration code by @varonix0 in https://github.com/Infisical/infisical/pull/8417
* docs(agent-vault): add hermes guide by @adkah in https://github.com/Infisical/infisical/pull/8393
* improvement(ui): migrate secret scanning picker loading to v3 by @andrewhuhh in https://github.com/Infisical/infisical/pull/8435
* improvement(ui): recover scanning status tooltip migration on main by @andrewhuhh in https://github.com/Infisical/infisical/pull/8449
* fix(ui): support owned Select portal containers by @andrewhuhh in https://github.com/Infisical/infisical/pull/8437
* fix(ui): forward v3 Toggle refs to the native switch by @andrewhuhh in https://github.com/Infisical/infisical/pull/8432
* improvement(ui): observe effective combobox popup state by @andrewhuhh in https://github.com/Infisical/infisical/pull/8440
* improvement(ui): replace startup v2 Lottie with v3 Loader by @andrewhuhh in https://github.com/Infisical/infisical/pull/8423
* chore: revert stripe whitelisting by @varonix0 in https://github.com/Infisical/infisical/pull/8448
* improvement(kms): migrate MAC operation form controls to v3 by @andrewhuhh in https://github.com/Infisical/infisical/pull/8431
* feat: revamp secret scanning db tables by @mathnogueira in https://github.com/Infisical/infisical/pull/8367
* fix: update openrouter logo by @claude[bot] in https://github.com/Infisical/infisical/pull/8453
* improvement(ui): make page header spacing plug and play by @andrewhuhh in https://github.com/Infisical/infisical/pull/8424

## New Contributors
* @peter-manton made their first contribution in https://github.com/Infisical/infisical/pull/8382
* @AleksaMCode made their first contribution in https://github.com/Infisical/infisical/pull/7924
* @akshatgg made their first contribution in https://github.com/Infisical/infisical/pull/8274

**Full Changelog**: https://github.com/Infisical/infisical/compare/v0.165.16...v0.165.17