Patch Releases Deserve Real Analysis When They Touch Auth Paths

The version number says patch, but a change to authentication or permission logic carries major-release risk regardless of what the semver arithmetic claims.

Semver measures API compatibility, not operational risk. A one-line fix in permission evaluation can change who is allowed to do what, which is the definition of a big release.

When a patch is not minor

• It alters authentication, authorization, or trust evaluation.
• It changes denial semantics or policy defaults, however slightly.
• It patches the code path your incident playbooks depend on.

Use the changelog, AuthGuardian, and security docs to review by what the change touches, not what the version claims.