[pull] master from apache:master#757

Merged

pull[bot] merged 6 commits into

code:masterfrom

Jun 3, 2026

Commits on Jun 3, 2026

fix(plugin-chart-ag-grid-table): validate filter values/operators in state converter (#40623)

rusackas
and
claude
authored
fix(ssh-tunnel): validate server_address format (SSRF defense-in-depth) (#40665)

rusackas
and
claude
authored
fix(mcp): honor AUTH_ROLE_ADMIN and warn on permission-less protected tools (#40659)

rusackas
and
claude
authored
fix(jinja): apply consistent escaping to url_param values from request args (#40633)

rusackas
and
claude
authored
chore(mcp): return a generic error from the webdriver pool-stats endpoint (#40559)

rusackas
and
claude
authored
fix(embedded): enforce configured allowed domains for postMessage origin (#40629)

rusackas
and
claude
authored