9.6.0-alpha.28 (2026-03-16) Bug Fixes Password reset token single-use bypass via concurrent requests (GHSA-r3xq-68wh-gwvh) (#10216) (84db0a0)