• fix: Reduce false positives across XSS, SQL, NoSQL, SSTI, and XXE injection fuzzers
• fix: Do not flag 4XX JSON error responses that echo rejected input as reflected XSS
• feat: Support default lengths for #(numeric), #(alpha), #(alphabetic), #(alphanumeric), and #(ascii) shorthands
• feat: Report cross-family status mismatches as errors, preserve schema validation, and unwrap root JSON arrays in FunctionalFlowFuzzer
• feat: Support nested discriminators, unquoted error field names, and executable generators in TriageCommand correlation synthesis
• fix: Improve nested sub-resource correlation, DELETE producer refill, inactive lifecycle state eviction, and date/enum fuzzer handling
• feat: Add --checkFieldInResponse option (default false) to guard 4XX fuzzed-field name checking
• fix: Prefer POST top-level response string identifiers over GET and request-body candidates when target example has digits
• feat: Support root JSON array payloads in FieldCorrelationEvaluator.applyRequestCorrelations
• feat: Add --allowDifferentCaseEnumValues option (default true) for EnumCaseVariantFieldsFuzzer
• feat: Add two-pass DELETE wave execution, on-demand producer pool refill, and WFC session recovery