Zowe CLI

Breaking: zowe zos-uss (ssh) commands now verify the z/OS SSH server's host key before sending credentials. On first connect you confirm the fingerprint and the key is saved to your ssh profile; a changed key is rejected. Use --insecure to skip verification or --host-key to pin a key. #2812
BugFix: Hardened temporary file handling for the zowe zos-files edit command: the etag-refresh step no longer uses a shared, fixed path, and edit temp directories are now scoped per user (so co-tenants on a shared temp location no longer conflict) with owner-only access enforced on all platforms. #2826
BugFix: Hardened daemon client authentication so that another local user cannot drive a daemon they do not own. #2805
BugFix: Fixed "Access is denied" error when running CLI commands on Windows if daemon mode is active. #2808
BugFix: Updated the zowe zos-files uss edit command to store temp files in a dedicated subdirectory with owner-only permissions (0o700). #2815

Core SDK

BugFix: Improved the handling of APIML service base paths in the Services.getServicesByConfig function. #2820

BugFix: Routed messages passed to the Logger.trace function through the LoggerUtils.censorRawData function, so secure config property values are redacted before written to the trace log. #2822
BugFix: Censored certain fields, and redacted token value from logs in AbstractRestClient. #2816
BugFix: Added a IO.hasOwnerOnlyAccess utility function to check whether a file or directory's access is restricted to the current user only, cross-platform (POSIX mode bits/owner; Windows icacls ACL). #2826

Breaking: SshSession now verifies the server's host key before sending credentials, using the hostKey and insecure session properties and an optional interactive hostVerifier hook; an unknown or changed key is rejected. #2812