What's new:
- Refactor/sanitize CallError details in case of Exception (#1959)
- increase stripe count for better distribution of locks (#1964)
- make profile assignment insert idempotent and warn on ignored duplicate (#1966)
- Fix for CVE-2026-28230: check chargeBoxId for ownership on StopTransaction (#1975 and GHSA-6x38-4w7h-cwr8)
- OCPP spec tightening: enforce inbound CALL messageId uniqueness per websocket session (#1972)
- OCPP spec tightening: (business sanity) validation for MeterValues, StartTransaction, StopTransaction, StatusNotification, SecurityEventNotification (#1960 #1975 #1988 #1991 #1993 #1995 #1997)
- Fix reservation not cancelled on connector Unavailable/Faulted (#1398)
- streamline and consolidate idTag validation in OCPP APIs (#1982)
- More REST APIs: implement additional transaction-controller APIs (#1994)
- Update dependencies and other refactors/cleanups
Thanks to all contributors!