What's Changed
- fix: block internal REST targets by default by @melohagan in #18236
- Fix plugin upload temp path traversal by @melohagan in #18240
- Fix bash automation command injection by @melohagan in #18238
- Remove transitive deps, update clouseau in the database image by @calexiou in #18282
- Disable REST blacklist in local development by @melohagan in #18286
Full Changelog: 3.33.3...3.33.4