v5.51.4

What's Changed

• fix(core): backport f028133 — stop per-request ProviderBase event-bus subscription leak by @ct-bc in #4747
• fix(core): backport #4971 — metadata snapshot and telemetry retention (5.51.x) by @jordanfanapour in #4973
• fix: backport #5073 — open entity records from shared artifacts, type PG tsvector as a string (5.51.x) by @jordanfanapour in #5074
• [5.51] Query rendering and PostgreSQL provider fixes by @jordanfanapour in #5041
• [lts/5] fix(ai-gemini): stop sending sampling fields to Gemini 3.6+; remove unsent thinking config by @jordanfanapour in #5627
• [lts/5] fix(ai-gemini): make effortLevel control Gemini and Vertex thinking (#5171) by @jordanfanapour in #5655
• fix(ai): backport #5647 — a cancelled prompt stops failover (5.51.x) by @jordanfanapour in #5658
• [lts/5] fix(server): sandbox template rendering and authorize template runs (security C2) by @github-actions[bot] in #5587
• [lts/5] Security hardening: data-layer injection & read-authorization fixes, CI supply-chain, container image (#4782) by @cadam11 in #5695
• [lts/5] fix(sqlserver-dataprovider): InstanceConnectionString collapsed every connection to one identity (#4186) by @cadam11 in #5730
• [lts/5] fix(server): bind record-name keys, check key fields, apply RLS (security C5) (#5264) by @cadam11 in #5687
• [lts/5] fix(server): screen dataset ItemFilters and read datasets as the caller (security C6) (#5265) by @cadam11 in #5691
• [lts/5] fix(server): screen RunView aggregate expressions before they reach SQL (security C4) (#5269) by @CaelebB-BC in #5743
• [lts/5] fix(server): gate SQL data context items like ad-hoc SQL (security C7) (#5266) by @CaelebB-BC in #5744
• [lts/5] fix(server): screen every client RunView clause path, not only four GraphQL resolvers (security C8) (#5272) by @CaelebB-BC in #5745
• [lts/5] fix(server): require client filter fragments to be one balanced expression (security C9) (#5267) by @CaelebB-BC in #5746
• [lts/5] fix(server): read SQL the way the database does before screening it (security C10) (#5273) by @CaelebB-BC in #5747
• [lts/5] fix(global): SafeExpressionEvaluator AST allowlist, closes the expression RCE (#3542, evaluator only) by @cadam11 in #5732
• [lts/5] fix(server): authorize RunAction per action and stop its actions running caller code (security C1) (#5271) by @cadam11 in #5734
• [lts/5] fix(server): stop trusting the owner-editable realtime session Config (security C3) (#5270) by @cadam11 in #5694
• [lts/5] chore: version.generated.ts says 5.51.3 by @cadam11 in #5720
• [lts/5] fix(ng-conversations): read the tasks filter's conversation and message IDs with RunView (#5740) by @CaelebB-BC in #5771
• [lts/5] fix(ng-markdown): sanitize rendered HTML in the service with DOMPurify; keep code-block unwrapping inert (#4308) by @cadam11 in #5737
• [lts/5] fix(server): bind statusUpdates push delivery to authenticated connection identity (B49 session-hijack) (#3244) by @cadam11 in #5735
• [lts/5] fix(predictive-studio): deserialize model artifacts through an exact-allow-list unpickler with guarded object arrays (#4307) by @cadam11 in #5726
• [lts/5] fix(core): RLS filter collection honours the permission row's Can* flags (#4358) by @cadam11 in #5731
• [lts/5] fix(core): RLS exemption honours the permission row's Can* flags (#4352) by @cadam11 in #5733
• [lts/5] fix(realtime-client): record the agent's voice on Gemini and other PCM-playback drivers (#5155) by @SDesai-BC in #5761
• ci: run Check migrations on lts/** and key concurrency per ref (EX-2026-003) by @rkihm-BC in #4457
• [lts/5] fix(security): close the #4260 privilege-escalation path on MJ: Users (#4275) by @cadam11 in #5724
• [lts/5] fix(security): close the #4282 role-elevation path on MJ: Roles and MJ: User Roles (#4305) by @cadam11 in #5727
• [lts/5] fix(ai-vector-dupe): stop holding the whole run in memory so large detections can finish (#4693) by @rkihm-BC in #5231
• [lts/5] fix(ai-vector-dupe): query with the same template text vector sync stored (#5198) (#5204) by @rkihm-BC in #5606
• [lts/5] fix(ai-vector-sync, ai-vector-dupe): apply the entity document's record filter (#5199) (#5205) by @rkihm-BC in #5607
• [lts/5] fix(security): artifact iframe drops allow-same-origin, Gmail header CR/LF stripping, Nunjucks dev:false (#4253) by @cadam11 in #5725
• [lts/5] security: refuse ad-hoc SQL for scope-limited sessions, escape ResolverBase's own filters — and unbreak the integration tier (#4037) by @cadam11 in #5736
• [lts/5] fix(ng-artifacts): stop ArtifactsModule from preloading React/Babel from unpkg on construction by @github-actions[bot] in #5679
• [lts/5] fix(conversations-runtime): parse mentions in linear time (CodeQL #228, #231) by @github-actions[bot] in #5678
• [lts/5] security: pin JWT algorithms on MCP Azure AD v1 path; block path traversal in integration run-artifact reader by @github-actions[bot] in #5586
• [lts/5] fix: use the line's method names in the #5679 and #5678 backports by @cadam11 in #5790
• [lts/5] Don't broadcast row data on the unfiltered cache-invalidation subscription, and re-read it where consumers need it (#4595) by @cadam11 in #5699
• [lts/5] fix(server): withhold the record key from cacheInvalidation subscribers whose read is row-filtered (#5241) (#5242) by @cadam11 in #5700

Full Changelog: v5.51.3...v5.51.4