- Updated Go runtime to 1.27.3 with CVE‑2026‑111943 mitigation and refreshed key dependencies.
- Fixed authentication and queue handling bugs: allowed connection types, queue sub weight amplification, and correct OCSP response binding to certificate serial numbers.
- Restored v1 stream snapshot limits and corrected leafnode ACL behavior for MQTT, ensuring proper permission enforcement.