delmaredigital payload-puck

• CVE-2026-39397 Critical 9.4 @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections 0.4%