What changed, and when.

Each scope on a connection can now carry its own expiry date.

Fixes from the September outside penetration test, and the 90-day key rotation.

First syncs over 5,000 transactions now arrive in pages as they load.

Pending card transactions no longer appear twice after they settle at three UK banks.

consent.revoked now says who revoked access and from where.

Failed webhook deliveries are retried for 24 hours with exponential backoff.

API v3 brings connect sessions, one connection object and signed webhooks.