9.11.0

9.11.0 (2026-11-03)

Bug Fixes

• Dot notation operation on a missing field reveals whether the field is stored to a caller without read access (GHSA-4m87-fqwv-2m8v) (#10842) (d88efed)
• Installation update rejects a changed device type or installation ID before checking the caller's write permission (#10847) (3373ee2)
• LiveQuery subscriptions can receive installations and objects of other internal classes without the master key (GHSA-q2gf-q36j-h978) (#10848) (3a1595b)
• Schema migration deletes internal indexes created on server start (#10861) (d067fca)
• Security upgrade Docker image from Node.js 20 to 24 (#10851) (3bc3ba5)

Features

• Add support for Node.js 26 (#10860) (53f85c4)