- Upgrade Go builder to 1.26.7 and address critical security issues: JWT auth bypass, XSS via metric relabel debug, and proper escaping of server‑side errors.
- Fix numerous bugs across components: hide sensitive header values in logs/metrics, resolve insert request deadlock, correct metric status aggregation, drop estimator metrics, and allow deleteAuthKey usage without extra httpAuth.
- Continue LTS support for the v1.148.x line with at least 12 months of maintenance.