9.10.6 (2026-10-22)
Bug Fixes
- Object create returns field values to a caller without read access (GHSA-qq3r-ppqq-rh6m) (#10813) (d95b14d)
- Object update returns stored field values to a caller without read access (GHSA-2rcp-jc67-vq74) (#10798) (4f110a9)
- Object update with a dot notation key below a pointer field can terminate the server process (GHSA-wc3c-6843-q7mv) (#10802) (946b670)
- Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery (GHSA-95hp-82c6-25q5) (#10810) (9e3da78)
- Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB (GHSA-655c-2xf3-77x9) (#10804) (b405b63)
- Session upgrade endpoint creates an additional session from an already revocable session token (GHSA-2j2x-c587-q33g) (#10808) (5bcb56b)