GHSA-f44p-c7w9-7xr7

## Summary The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget. ## Impact An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients. ## Affected Component `src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts` ## Fixed Versions - Affected: `<= 2026.3.24` - Patched: `>= 2026.3.28` - Latest stable `2026.3.28` contains the fix. ## Fix Fixed by commit `cb5f7e201f` (`gateway: cap concurrent pre-auth websocket upgrades`). Discovered by：Topsec AlphaLab (wang dong)