Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Ash.Reactor change step fails open, skipping a change when its where guard raises

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash