- Fixed numerous bugs and race conditions across authentication, routing, monitoring, JetStream, Raft, and MQTT, preventing panics, memory leaks, and stream desynchronisation.
- Applied security hardening: refreshed JWT permissions on account updates, corrected external auth handling, fixed proxy/TLS sniffing, and addressed OCSP loop issues.
- Made functional tweaks: writer options now consistently applied with s2 fast compression, service import replies now work over cluster routes, and removed deprecated Monitoring JSONP callback support (potential breaking change).