This is a security release with important security updates. All users are recommended to update to v12.0.9 or later versions.

New functionality

• Apply and patch on schemaless (raw_json) documents in #2571
• Canonical ISO8604 interval semantics, timezone offsets, and typecasting with xdd:dateRange #2574

Security

• Fix an issue (CVSS 7.5/6.5) that allowed users with read access to a database to use apply API, reported by @Santoshkumarpuppala
• Require read access on at least one database for the path-less api_patch/6 and api_diff/6 endpoints, preventing anonymous resource exhaustion
• Harden JWT claim validation against type confusion (CVE-2026-25537) by @dfrnt-hoijnet in #2597

Bugfixes

• Intervals handling improvements by @hoijnet in #2569
• Denied JWT-scoped authorization now returns 403 access_not_authorised instead of crashing; the caller falls back to anonymous capabilities

Maintenance

• Remove dead anonymous guard from api_info: community serves the info payload to any caller including anonymous, enterprise redacts it for anonymous instead
• Pin terminus-store to v0.21.8 for forward-compatible pack import (to prepare for faster intervals) #2568
• Neat starting experience: quieter GC plugin logging and JWT opt-in at runtime #2573
• Bump follow-redirects from 1.16.0 to 1.16.1 in /tests #2581
• Bump qs from 6.16.0 to 6.17.0 in /tests in #2599
• Bump serialize-javascript from 7.0.7 to 7.1.4 in /tests in #2600
• Bump rustls from 0.23.45 to 0.23.46 in /src/rust in #2598

Full Changelog: v12.0.8...v12.0.9