- Updated Go runtime to 1.26.10, adding mitigation for CVE‑2026‑111943 by distrusting eMudhra intermediate certificates.
- Fixed multiple bugs: auth callout allowed connection types, queue sub weight amplification, OCSP response binding, JetStream snapshot length limits, leafnode ACL handling, and MQTT OCSP verification.
- Bumped key dependencies (klauspost/compress, x/crypto, x/sys) and provided an upgrade guide for compatibility with 2.12.x.