9.9.1-alpha.3 (2026-05-27) Bug Fixes Server option routeAllowList is bypassable through batch sub-requests (GHSA-p84r-h6rx-f2xr) (#10482) (552c6dd)