- Migration sources now require public URLs and can be whitelisted via APP_MIGRATIONS_ALLOWED_HOSTS, preventing internal data leaks.
- JWTs are invalidated when their session expires, adding a security hardening alongside other auth and worker fixes.
- Console updated to 8.7.37 fixing row‑editor rendering, functions now correctly quote build directories, and the unused /v1/cards/cloud endpoint was removed.