[General]: Repeated failed authentication attempts are now throttled. Once an account has failed authentication too many times from the same address, further requests from that address for that account receive HTTP 429 Too Many Requests until the block expires, including requests that carry valid credentials. The response includes the X-RateLimit-Retry-At and X-RateLimit-Retry-After-Seconds headers, and error.message starts with Too many failed authentication attempts. Integrations must stop retrying on HTTP 401 Unauthorized and correct the credentials instead: retrying a rejected password in a loop is what triggers the block. See the Rate Limiting guide for details.
[General]: Reduced per-request overhead on every endpoint by no longer creating server-side session state for stateless API calls.
[General]: Various internal improvements and under-the-hood tweaks.