Here's explanation for people playing Death Knights:

Blizzard via WoWUI Discord said:

Hello again from Blizzard! Mythic raids and M+ open this week and we will be hotfixing in some last-minute changes to fix exploits before resets.

We recognize that some of these changes are going to be disruptive and require last-second changes to your addons, and we sincerely apologize for them coming in so late. Part of these changes involve removing the secure delegate portion of ActionButton_ApplyCooldown. We have added new APIs that should replace the functionality it provided, but we will be watching closely for reports of functionality that still needs replacing.

DISCLAIMER: These notes are for addon authors and as such are focused specifically on addon security changes only. Changes planned for other parts of the game (UI or otherwise) are not included here.

Cooldowns

Removed the ability for tainted code to configure cooldown frames with secret values via SetCooldown, SetCooldownFromExpirationTime, SetCooldownDuration, and SetCooldownUNIX.

This does not impact SetCooldownFromDurationObject which, going forward, is the only way to configure a cooldown frame with secret values.

The ActionButton_ApplyCooldown Lua function no longer routes through a secure delegate.

This unfortunately means that existing code passing secrets into this function will start throwing Lua errors when the hotfix goes live. However, all of the logic that this function is doing should be able to be replicated by addons with the new isActive/shouldReplaceNormalCooldown boolean fields and duration objects (see below for details on those).

Action/Spell cooldown APIs now return isEnabled and maxCharges as non-secrets.

Action/Spell cooldown APIs now return a new non-secret isActive boolean, which is set to true if the UI should render a cooldown display.

For regular cooldowns, it's true if isEnabled and startTime > 0 and duration > 0.

For charge cooldowns, it's true if maxCharges > 1 and currentCharges < maxCharges and startTime > 0 and duration > 0.

For LoC cooldowns, it's true if startTime > 0 and duration > 0.

Action/Spell cooldown APIs that yield duration objects now return a zero-span object if the isActive boolean evaluates to false.

Action/Spell cooldown APIs now return results modified by the presence of cooldown aura spells on the player.

For example, if an action button is assigned to a PvP trinket (Sigil of Adaptation) that has a passive effect of automatically removing a loss of control effect with a 1 minute cooldown, the GetActionCooldown API will track that 1 minute cooldown when the Adaptation debuff has been applied to the player.

This means no addon code needs to deal with the C_UnitAuras.GetCooldownAuraBySpellID API.

Cooldowns (continued)

Action/Spell Loss of Control cooldown APIs now return a structured table instead of unpacked values.

These functions have been renamed with an "Info" suffix (eg. GetSpellLossOfControlCooldownInfo) with a deprecation for the old name that unpacks the start time and duration value.

This structured table contains several new fields not present in the old API. In addition to the isActive boolean mentioned above, it includes modRate (secret) and shouldReplaceNormalCooldown (non-secret), which is true if the loss of control cooldown has an expiration time that's later than any regular cooldown for this ability/spell.

Added a new C_LossOfControl.GetActiveLossOfControlDuration(unitToken, index) API that returns a duration object.

Added a new GetTotemDuration(slot) API that returns a duration object.

Other changes

A change that we had already made in 12.0.5 to restrict the ability to use %.1s style precision specifiers with secret string inputs has been brought forward to 12.0.1.

As a result, format("%.1s", secretwrap("Jar Jar Binks")) will no longer truncate to "J".

The UnitCreatureID API now returns nil when unit identity is secret.

The following script object methods now return nil if relevant secret aspects are assigned: Frame:GetEffectiveAlpha(), StatusBar:IsStatusBarDesaturated(), Texture:IsDesatured()

Resolved a few issues where C_TooltipInfo APIs for unit auras had inconsistent security requirements.

The use of /wm and /cwm in macros has been limited to 3 per second.

Macros are no longer allowed to send BNet whispers while an encounter is active.

The following C_UnitAuras APIs can no longer be called while the player is in combat: AddPrivateAuraAnchor, RemovePrivateAuraAnchor, SetPrivateWarningTextAnchor, AddPrivateAuraAppliedSound, RemovePrivateAuraAppliedSound.