CVE-2026-56852

Implemented an SSRF protection mechanism with a configurable allow-list in settings (off / audit / enforce modes); Changed a default setting to enforce server-side EdgeID on first…

Add counter for blocked namespace requests; Fix flaky namespace test due to eventual consistency; Match colon-containing user/group ids literally for global callers in namespaces…

Bump golang.org/x/text to v0.39.0 (CVE-2026-56852) and google.golang.org/grpc to v1.82.1 (GHSA-hrxh-6v49-42gf); PromQL: Preallocate the active query tracker file to avoid SIGBUS…

Remove support for restoring old backup formats; Fix KagomeJa custom-dict throttle release without acquire; Route shard access through Index.withShardOrRemote; Allocate per-tenant…

Fix empty range results served after enable-rangeable reindex with INDEXRANGEABLEINMEMORY=true; Remove SyncShards in favour of node local Shard.drop; Fix namespace regexp; Make…

Do not load all lazy shards for property add; Abort in-flight usage scan when its collection is dropped; Do not load lazy loaded shards on backup restore; Stop commit log churn…