• GHSA-7vfr-354v-qmm7 — Stop ops that can't be coerced crashing the server
  • Fixes an issue where an op that can't be coerced to a primitive could crash a ShareDB server process
• GHSA-5h4c-qg46-x477 — Only deliver subscription ops for the subscribed doc
  • Fixes an issue where a pub/sub channel name collision could let a client read ops from a collection it isn't allowed to read
• GHSA-fv2v-f5r9-496g — Stop subscription streams outliving client disconnect
  • Fixes an issue where a client could leak pub/sub streams that outlive its disconnect, causing unbounded memory growth
• GHSA-7v53-4cxg-59q3 — Check the shape of ops submitted to projections
  • Fixes an issue where a malformed op submitted to a projection could crash a ShareDB server process
• GHSA-m8r5-f332-wqwg — Only look up own string keys in extraDbs
  • Fixes an issue where any client could crash a ShareDB server process with the query option db
• #731 — Bound getOps() by the current version in timestamp fetches