• Security fix: Cross-Collection authorization bypass via Collection privacy settings (xutao, Rajesh Murthy, Matt Westcott)
• Security fix: Formula injection via XLSX export (Matt Westcott)
• Security fix: Improper restriction handling on Pages admin API for ancestor pages (Nguyen Dang Khoi, Matt Westcott)
• Security fix: Stored XSS attack via third-party HTML editors (ma4ter0x22, Alberto Fernandez-de-Retana, Matt Westcott)
• Maintenance: Fix erroneous workflow creation test failing on Django 5.2.18 / 6.0.9 (Sage Abdullah)