Changelog

Improvements

• improvement(copilot): drop unused columns from mothership chat detail reads

Bug Fixes

• fix(security): KB fileUrl LFI, MCP/Agiloft SSRF pinning, form OTP, KB authz
• fix(redis): apply TLS SNI override to pub/sub clients

View changes on GitHub

Features

• feat(redis): TLS SNI override for IP-based REDIS_URL + zod schema fixes

View changes on GitHub

Bug Fixes

• fix(migrations): remove duplicate column add

View changes on GitHub

Features

• feat(mship): make mship block stream output
• feat(wait): Async toggle, chained-wait resume fix, execution status API
• feat(files): folders, multiselect, vfs update

Improvements

• improvement(executor): faster, more responsive workflow cancellation
• improvement(copilot): trim copilot_chats reads to lean projections
• improvement(redis): strip idempotency body and cap mothership stream zsets
• improvement(providers): align attachment dispatch to vendor SDK types
• improvement(files): validations
• improvement(agent, file-block): files in agent block, file block v4

Bug Fixes

• fix(workflows): exclude block locked from diff detection
• fix(mcp): map validation and conflict orchestration errors to 400/409
• fix(cloudwatch): use PutAlarmMuteRule for mute/unmute with duration window
• fix(files): fixed resource spacing on files directories pages
• fix(logs,workspace): prevent cancelled status overwrite on race and move impersonation banner

Other Changes

• chore(utils): migrate to shared random/ID utilities and add enforcement linting
• chore(deps): bump mermaid to 11.15.0 for GHSA-ghcm-xqfw-q4vr

View changes on GitHub

Features

• feat(cloudwatch): add mute and unmute alarm operations

Improvements

• improvement(gmail): replace custom html-to-text regex with library
• improvement(scheduler): drain due schedules in chunks
• Revert "improvement(db): add session statement/lock timeouts; simplify KB doc tx"
• improvement(db): add session statement/lock timeouts; simplify KB doc tx

Bug Fixes

• fix(gmail): send emails as multipart/alternative so they render full-width
• fix(date-picker): eliminate infinite re-render crash on re-open with existing selection
• fix(security): supabase rpc path validation, ssh stream byte cap, storage quota coverage
• fix(security): harden file access controls, webhook auth, and input bounds
• fix(integrations): gdrive trashed search, slack blocks-with-file, slack get_message ts
• fix(seo): use canonical SITE_URL for robots and sitemap

Other Changes

• chore(deps): bump next to 16.2.5 for CVE-2026-44578 SSRF fix

View changes on GitHub

Improvements

• improvement(billing): move overage calculations out of txes
• improvement(db): reduce connection saturation and egress hotspots

Bug Fixes

• fix(vfs): make copilot message ordering deterministic via WITH ORDINALITY
• fix(tables): eliminate checkbox flicker on rapid cell toggle
• fix(rate-limit): close rate-limit bypass and tighten public route limits

View changes on GitHub

Improvements

• improvement(file-block): add get operation

Bug Fixes

• fix(mothership): persist @-mentioned resources across send
• fix(file-block): fix get op

View changes on GitHub

Features

• feat(observability): export Trigger.dev telemetry to Grafana Cloud OTLP
• feat(mothership): add files to mship block
• feat(mothership): pin tasks to keep them at the top of the sidebar

Improvements

• improvement(mothership): allow mship to send function execute timeout

Bug Fixes

• fix(otel): address staging pr comments for trigger otel

View changes on GitHub

Features

• feat(mothership): Add conversationId to mship block
• feat(execution): payload size bottlenecks with lazy execution value hydration, safer materialization, and batched parallel execution

Improvements

• improvement(grafana): align tools and block with Grafana API spec
• improvement(workflow-block): support manual workflow ID via advanced mode

Bug Fixes

• fix(event-buffer): re-compact the event with preserveUserFileBase64: false
• fix(mothership): reconcile stuck conversation_id against Redis lock to clear stuck-yellow task tiles
• fix(console): match child-workflow inner blocks by instanceId when reconciling dropped SSE events
• fix(security): harden findings — path traversal, SSRF, IDOR, file auth, credential access
• fix(docs): restore media centering and full-width intro image
• fix(helm): preserve STS serviceName + networkPolicy.egress back-compat

View changes on GitHub

Improvements

• improvement(scheduler): raise per-tick claim budget to drain backlog
• improvement(helm): helm chart updates with security, ESO, and docs overhaul
• improvement(mothership): align markdown blockquote, img, em, del with design tokens

View changes on GitHub