Clarify jsonpath breaking change in v9

content/releases/9.0.0.md

@@ -23,11 +23,13 @@ Mockoon is an open-source project built by volunteer maintainers. If you like ou
 
 ## ⚠️ Breaking changes
 
-- Many new features were added (new rule types, new WebSocket routes, etc.) which resulted in modifications of the [data files](https://mockoon.com/docs/latest/mockoon-data-files/data-storage-location/) schema. If you are using your data files with the CLI or serverless package, or if you are sharing your setup with your team, we recommend you migrate every application to the new version at the same time to avoid any compatibility issues.
+- Many new features were added (new rule types, new WebSocket routes, etc.) which resulted in **modifications of the [data files](https://mockoon.com/docs/latest/mockoon-data-files/data-storage-location/) schema**. If you are using your data files with the CLI or serverless package, or if you are sharing your setup with your team, we recommend you migrate every application to the new version at the same time to avoid any compatibility issues.
 
   _Note for teams using our Cloud_: We recommend that all team members update their application to the new version at the same time to ensure a smooth transition ([more information](https://mockoon.com/docs/latest/mockoon-cloud/data-synchronization-team-collaboration/#major-versions-migrations)). API deployed in our Cloud instances will continue running following the old schema (v8) until they are redeployed ([more information](https://mockoon.com/docs/latest/mockoon-cloud/api-mock-cloud-deployments/#major-versions-migrations)).
 
-- We updated the libraries and application dependencies to their latest versions. The most notable change is the migration to Faker.js version 9, which includes numerous function removals and some modifications to signatures and parameters. However, this should have minimal impact on your templates, as most functions were already deprecated in version 8 and have been automatically migrated to the new syntax (see Faker.js v9 [migration guide](https://fakerjs.dev/guide/upgrading.html)).
+- We **updated the libraries and application dependencies** to their latest versions.
+  - The most notable change is the **migration to Faker.js version 9**, which includes numerous function removals and some modifications to signatures and parameters. However, this should have minimal impact on your templates, as most functions were already deprecated in version 8 and have been automatically migrated to the new syntax (see Faker.js v9 [migration guide](https://fakerjs.dev/guide/upgrading.html)).
+  - Another potential breaking change is the **fix of a JSONPath RCE vulnerability**. If you were using JSONPath in your templates, some advanced filters might not work as expected anymore. We whitelisted the most common and safe filters, like `$[?(@.status==='enabled' && @.id===1)]`. If you encounter any issues, please let us know.
 
 ## WebSocket support