- Patched Brotli library (CVE‑2026‑111497) and updated runtime to a secure version, fixing out‑of‑bounds write in the decoder.
- Tightened auth and API‑key security: keys can no longer grant unauthorized scopes or longer expiries, JWTs cannot manage keys, and added rate‑limits, constant‑time MFA checks, and stricter session validation for realtime and GraphQL.
- Broad hardening across services: enforced permission checks in databases, validated outbound/internal hosts, removed secret exposure in APIs, added TLS verification for Git providers, storage path sanitization, and introduced APP_MEMORY_...