Merge branch 'main' into detect-critical-extensions

CHANGELOG.md

@@ -8,6 +8,21 @@ to 0.3.0 are beta releases.
 
 ## [Unreleased]
 
+### Added
+- Support for the native non-hybrid tagged recipient type (`age1tag1..`).
+  - Encryption requires making the `age-plugin-yubikey` binary available on the
+    `PATH` as `age-plugin-tag`, or upgrading to a client version that builds in
+    support for this new native recipient type.
+
+### Changed
+- MSRV is now 1.70.0.
+- Encryption to an identity now uses the preferred recipient type supported for
+  that identity.
+- `age-plugin-yubikey` now prints `age1tag1..` recipients in its CLI and
+  identity files instead of `age1yubikey1..` recipients. The latter is now only
+  shown in comments for identities generated with `age-plugin-yubikey 0.5.0` or
+  earlier.
+
 ## [0.3.4], [0.4.1], [0.5.1] - 2026-04-08
 ### Fixed
 - `age-plugin-yubikey` now completely ignores any identity that has unrecognised