Headless Server: Persisted-query cache poisoning fixed

The Headless Server now rejects persisted-query requests whose body does not match the query registered under the supplied queryId or sha256Hash. Previously, a request that combined a known persisted-query ID with a foreign query body was executed and the resulting document was pinned under that ID in the per-instance in-memory cache, replacing the effective query on that JVM until the container was restarted. Behind a load balancer this could cause the same client request to return alternating responses depending on which instance handled it.

On mismatch the server now responds with PersistedQueryIdInvalid and does not update the cache. Marker-only requests (PersistedQueryMarker), empty bodies, and Automatic Persisted Query (APQ) registrations with a matching hash continue to work unchanged. No API or configuration changes are required.

(CMS-31338)

Upgraded Node.js to 24.18.0

Upgraded Node.js to 24.18.0 in studio-client and frontend workspace

(CMS-31124)

Fixed Publisher removing empty Struct Lists during blob conversion

The Publisher no longer removes empty Struct Lists from Struct properties during blob conversion. Previously, when resolving blobs on the MLS, the conversion logic erroneously skipped empty Struct Lists, causing Struct properties to differ between CMS and MLS/RLS. This could lead to unexpected behavior in application code that relies on the presence of empty lists within Struct properties.

(CMS-30789)