9.10.0-alpha.2

9.10.0-alpha.2 (2026-06-25)

Bug Fixes

• Stored XSS via malformed Content-Type bypassing file upload extension blocklist (GHSA-r899-h629-j84r) (#10521) (cce91e5)

8.6.84

8.6.84 (2026-06-25)

Bug Fixes

• Stored XSS via malformed Content-Type bypassing file upload extension blocklist (GHSA-r899-h629-j84r) (#10523) (55eab32)

9.10.0-alpha.1

9.10.0-alpha.1 (2026-06-19)

Features

• Add option to disallow aggregation pipelines for the read-only master key (#10517) (816078f)

9.9.1-alpha.13

9.9.1-alpha.13 (2026-06-19)

Bug Fixes

• LiveQuery discloses object data to a subscriber across an ACL read-access change (GHSA-97pr-9hgg-3p8r) (#10515) (e9c85df)

8.6.83

8.6.83 (2026-06-19)

Bug Fixes

• LiveQuery discloses object data to a subscriber across an ACL read-access change (GHSA-97pr-9hgg-3p8r) (#10516) (c9b24ce)

9.9.1-alpha.12

9.9.1-alpha.12 (2026-06-17)

Bug Fixes

• Denial of service via exponential-time processing of deeply nested query operators (GHSA-cgxm-vr2f-6fj8) (#10511) (1103c7a)

8.6.82

8.6.82 (2026-06-17)

Bug Fixes

• Denial of service via exponential-time processing of deeply nested query operators (GHSA-cgxm-vr2f-6fj8) (#10512) (0f5d2ad)

9.9.1-alpha.11

9.9.1-alpha.11 (2026-06-16)

Bug Fixes

• Stored XSS via non-standard file extension bypassing file upload extension blocklist (GHSA-v8x7-r927-cc93) (#10505) (be12a60)

8.6.81

8.6.81 (2026-06-16)

Bug Fixes

• Stored XSS via non-standard file extension bypassing file upload extension blocklist (GHSA-v8x7-r927-cc93) (#10506) (97c6a78)

9.9.1-alpha.10

9.9.1-alpha.10 (2026-06-12)

Bug Fixes

• Middleware route checks do not match routing-equivalent path variants (trailing slash, case) (#10501) (f861210)