2026.09.58 — 2026-09-29

Added

• List the clusters a caller may read through StudioInfo (34236a39)

  StudioInfo.clusters() maps the id of every cluster the current caller holds cluster:read on to its display name, ordered by name. A plugin can now let its documents name clusters and store their ids; clusterName(id) already gave the reverse.

Security

• Update Jackson 2 to 2.21.6 and pin the template's Jackson (c6bc43f9)

  Studio's Jackson 2 (2.21.5, managed by Spring Boot 4.1.1) carries the same three advisories as Jackson 3.1.5 (GHSA-gx83-3vf8-gh7j, GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf); it is now 2.21.6. The plugin template imports Jackson's 3.1.6 and 2.21.6 BOMs ahead of Spring Boot's, so a new plugin builds against the versions Studio runs.

• Update Jackson to 3.1.6 and undici to 7.29.1 (40cac3a5)

  Jackson 3.1.5, which Spring Boot 4.1.1 manages, carries three advisories (GHSA-gx83-3vf8-gh7j, GHSA-q4xh-88c3-wmh7, GHSA-wjgm-6hv5-3cvf); Studio now runs 3.1.6. The plugin build tooling's undici (through Module Federation's type plugin) moves to 7.29.1 (GHSA-3wwx-pv8p-q78v). The plugin template carries the same npm overrides, so a new plugin starts without either advisory.