- Backfill API endpoints no longer disclose backfill IDs across DAGs; unknown or unauthorized IDs now return 404, and auth is enforced only on the path ID (breaking change).
- Explicit credentials (Bearer/OAuth2) now override session cookies; mixed requests resolve to the explicit token and invalid tokens are rejected even if a valid cookie is present (security improvement).
- Various bug fixes and performance enhancements, including optimized task instance lookups, revoking all credentials on logout, proper 404 for missing DAG runs, XCom migration safety, UI stability fixes, and reduced memory/scan usage.