Security
- Fixes an argument access-boundary bypass where bulk destroy/update accepted private (
public?: false) action arguments from user parameters (CVE-2026-93477, GHSA-c2p4-p7q6-hr2j).
Bug Fixes:
- enforce public? on argument matching in bulk destroy/update (CVE-2026-93477)