- Admin auth cookie name is now configurable via admin.auth.cookie.name, allowing custom token cookie names.
- Status attribute is reserved for Draft & Publish mode; custom status fields now trigger a warning instead of boot failure (breaking change).
- ws dependency upgraded to 8.21.0 fixing CVE‑2026‑48779 (security).