- Introduced a configurable, spec-compliant CORS implementation
- Added explicit support for wildcard origins (*) in read-only, non-credentialed setups
- Enforced strict separation between wildcard origins and credentialed requests (fail-fast on invalid configs)
- Improved preflight handling and cache safety (Vary: Origin)
- Safer, more predictable CORS defaults for public and session-based APIs
No breaking API changes; infrastructure hardening and correctness improvements.