• GHSA-9p4p-3p2f-q7h8 — Only deliver presence to presence subscribers
  • Fixes an issue where ops on a collection named $presence.<channel> reached that channel's presence subscribers, so a client could read a collection it isn't allowed to read
• #770 — Reject presence whose version is ahead of the doc
  • Fixes an issue where a client could send presence with a version far ahead of the doc, making every other subscriber fetch the doc again on every op
  • Doc presence must now carry an integer v
  • Presence leaves no longer run 'op' middleware, so the server can clear presence for a client that has lost read access