Slash-separated tags with unquoted event handlers could bypass the markup sniff, filesystem-destination uploads skipped the validation applied during storage migration, and Meteor-Files could serve executable stored metadata inline from its original route. Upload validation now recognizes those handler and JavaScript-URI forms for every destination. Filesystem, GridFS and cloud downloads share one response policy that forces HTML, SVG, XML and JavaScript types or filenames to an opaque attachment with nosniff, frame denial and a sandboxed CSP. Rejected uploads remain visible as MimeBleed events in Admin Panel → Problems; ordinary file views are transformed safely rather than logged because the response path cannot distinguish an attack from a legitimate view. Mocha covers the reported payload and negative samples, Node coverage pins all storage shapes, and Chromium, Firefox and WebKit exercise the full download route.

The profile was updated on the server, but the popup, pagination and board grid continued reading a current-user document that was not guaranteed to be republished after the click. The chosen mode now has an immediate reactive client value, is shared by every sorting consumer, and rolls back if persistence fails. Browser coverage verifies both visible A→Z ordering and the stored profile choice, including the selected state when the popup is reopened.

A client’s ordinary sorted find can express no practical limit as 2147483647. FerretDB used that number as a Go slice’s initial capacity and could immediately request about 16 GiB, causing high CPU, out-of-memory crashes, connection resets and temporarily missing boards while the database restarted. The bounded top-k heap now starts small and grows only for documents that exist. A maximum-limit regression test verifies correct ordering without the eager allocation, while the finite-limit test keeps the bounded behavior covered.

The multi-user stability test opened both users in one browser context, where Meteor’s origin-scoped resume token necessarily made the second login replace the first. It now uses a separate context per user, matching real independent sessions and removing the false timeout while still verifying both board views.