- Read‑only users can no longer access the `/dags` endpoint without additional permissions, requiring role updates for DagAccessEntity.RUN, HITL_DETAIL, and TASK_INSTANCE (breaking change).
- UI theme can now be overridden with simple CSS or cleared to defaults, and the tokens field in the theme config is optional (new feature).
- Extensive bug‑fixes: corrected default logging config, session leaks, N+1 query patterns, UI glitches, OpenSearch log support, and added JWT authentication docs.