- Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2).
- Enforces dashboard session expiry at verification time (GHSA-w9fp-wv6g-pqv8).
- Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc).
- Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c).
Full Changelog: v11.1.3...v11.1.4