chore: release

[github-actions]

🤖 New release

• pg-pkg: 0.6.3 -> 0.6.4
• cryptify: 0.1.32 -> 0.1.33

Changelog

pg-pkg

0.6.4 - 2026-09-01

Added

• (pg-pkg) count every /v2 request in postguard_clients and bound its labels (#384)

Fixed

• (pg-pkg) give each client its own client_version budget (#390)

cryptify

0.1.33 - 2026-09-01

Added

• (cryptify) move the upload limits and rolling window into config, and serve the default tier's on GET /limits (#392)
• (cryptify) split the notification email into attributed and neutral renderings (#383)

Fixed

• (docker) upgrade inherited base packages, and stop caching the layer that decides currency (#395)

---

This PR was generated with release-plz.

[rubenhensen]

Blocked by #394: Scan Docker image and Scan cryptify image fail on CVE-2026-63073 (OpenSSL 3.5.6-1~deb13u2, critical) in both images, off the debian:trixie-slim base.

Two notes for whoever picks this up.

The current sha has not been scanned. The failures are on d7500980; release-plz refreshed the branch to 946ec7cb at 09:19:51Z (picking up #382's COMPATIBILITY.md now that #393 merged), and that sha sits at action_required with 0 check-runs. Expect the same two failures once it runs — the base image is identical across the shas — but read the sha the PR points at now rather than this comment.

The vulnerable path looks unreachable from our binaries. CVE-2026-63073 is a format-string bug in OpenSSL's CMP client, reached only when validating a CMP response. OpenSSL is linked here (native-tls → openssl-sys), but nothing in the workspace uses CMP. That does not unblock the gate — grype does no reachability analysis — but it is the difference between a release to hold and a release to expedite. #394 carries the decision.