What shipped this week — and the week before.

Improvements

• refactor(ui): eliminate prop drilling in editor, home, sidebar, and logs dashboard

Bug Fixes

• fix(attribution): workspace id attr should be best-effort for self hosted users
• fix(security): neutralize CSV formula injection in logs export

View changes on GitHub

Features

• feat(codepipeline): add AWS CodePipeline integration with tools and block
• feat(workflows): sim trigger, logs v2 block, toolbar renaming
• feat(realtime): preflight schema-compatibility check on startup

Improvements

• improvement(mothership): smooth streamed text reveal + dropdown z-index fix
• improvement(chat-voice): modernize ElevenLabs TTS to Flash v2.5

Bug Fixes

• fix(billing): prevent deadlock with timeout
• fix(file-preview): gate streaming animation to prevent file patch issue with scroll based re-render
• fix(security): authz, IDOR, and abuse-prevention fixes
• fix(secrets): keep readonly secret names legible instead of dimming them
• fix(db): serialize concurrent migrations with a Postgres advisory lock

View changes on GitHub

Features

• feat(slack): assistant thread ops, paginated history/replies, and permalink
• feat(integrations): add AWS AppConfig integration with tools, block, and docs
• feat(integrations): expand tool coverage, audit integrations, regen docs
• feat(models): add Claude Fable 5
• feat(tables): stable column ids for metadata-only rename
• feat(emcn/toast): toast redesign — intent variants, stacking, hover reveal, dismiss-all
• feat(sendblue): add Sendblue iMessage/SMS integration with tools and triggers
• feat(auth): dynamic signup/login ban lists via AWS AppConfig
• feat(integrations): suggest curated skills per integration with one-click add
• feat(enrichment): add ZeroBounce, NeverBounce, and MillionVerifier email verification
• feat(tables): row-gutter drag-select, Cmd+F find, and select-all polish

Improvements

• improvement(tools): validate integrations, add Gong activity tools, regenerate docs
• improvement(emcn): consolidate chip chrome, enforce ChipModalField, paint real chrome in loading fallbacks
• improvement(mothership): v0.2
• refactor(emcn): make ChipModal footer/header props-driven and migrate all consumers
• improvement(metrics): emit hosted-key metrics to CloudWatch instead of OTel
• refactor(mothership-chats): rename task feature to chat, move route, add redirect
• improvement(perms): member removal reassignment policies
• improvement(platform): remove tour, simplify sidebar/header, drop loading skeletons

Bug Fixes

• fix(mothership): clear chat input after sending a message mid-conversation
• fix(agent): unique tool ids for multi-instance tools + icon updates
• fix(tables): key filter UI by stable column id; show column name in delete confirm
• fix(modal): preserve spacing in workspace delete confirmation label
• fix(tables): route large CSV imports to the background job instead of 413
• fix(terminal): truncate console values by size and cycles, not nesting depth
• fix(tables): stop insert-row flicker and return order_key from rows list
• fix(home,integrations): optical-center home input + integrations page render fix
• fix(user-input): atomic chip selection, modifier-key handling, and stale overlay ghost
• fix(tables): compare order_key bytewise (COLLATE "C") to stop insert collation errors
• fix(security): SSRF pinning, Twilio webhook auth, copilot token leak, audit-log tenant scoping

Other Changes

• chore(tables): own fractional-indexing in-house, drop runtime dep

View changes on GitHub

Features

• feat(tables): fractional order keys for O(log n) row insert/delete (flag-gated, default off)
• feat(tables): workflow version selection (live/deployed) and not-found/no-output badges
• feat(metrics): emit hosted-key metrics to Grafana via OTel
• feat(integrations): add ClickHouse block and expand Dagster + Tinybird tools
• feat(connectors): add 7 knowledge base connectors (Google Forms, Typeform, Azure DevOps, YouTube, JSM, S3, Sentry)
• feat(tables): background import for large CSVs with live progress

Improvements

• refactor(tables): consolidate row data-access in service.ts

Bug Fixes

• fix(clickhouse): harden read-only query enforcement and centralize WHERE-clause validation
• fix(otel): make service.instance.id unique per process
• fix(autolayout): relocate notes that overlap blocks after layout
• fix(polling-tools): pass plan execution timeout to internal polling tool routes
• fix(mcp): enforce tool name validation in deploy modal
• fix(security): chat attachment XSS, MCP OAuth SSRF guards, Teams clientState verification

Other Changes

• chore(db): drop legacy copilot_chats.messages JSONB column
• chore(skills): mirror model/enrichment/hosted-key/council skills into .agents/skills and expand add-model touchpoints
• chore(readme): refresh demo GIFs from docs, lead with Mothership
• chore(api-key): remove legacy scan+decrypt auth fallback

View changes on GitHub

Features

• feat(gitlab): sync repository files (code/docs)
• feat(storage): support S3-compatible endpoints (R2, MinIO, B2) for file storage

Bug Fixes

• fix(tables): surface real error causes on cell-execution failures (diagnostics)
• fix(storage): percent-encode object key in multipart fallback URL
• fix(gitlab): pin pagination cursor to configured host + consolidate isSameOrigin
• fix(dev): use globalThis for singleton state to prevent HMR memory leaks
• fix(mothership): run client-routed workflow tools server-side in headless execution
• fix(auth): link SSO sign-in to existing same-email accounts
• fix(env): schema treatment of empty string
• fix(background): recategorize user/recovery failures as errors, not trigger faults

Other Changes

• docs(slack): remove archival reference from Download files per Slack Marketplace guidelines

View changes on GitHub

Features

• feat(connectors): add 11 knowledge base connectors

Bug Fixes

• fix(fathom): skip getDocument when header cache is missing instead of emitting a degraded, un-refreshable record
• fix(slack): request reactions:read in OAuth URL, drop im:history
• fix(auth): show "account already exists" on duplicate email signup
• fix(schedules): count usage lim error schedule as failed run

View changes on GitHub

Features

• feat(apify): add run task, get dataset items, and get run tools
• feat(landing): add AI-generated content disclaimer to integration landing page

Bug Fixes

• fix(tables): count dispatcher pre-stamps in "X running" during active dispatch
• fix(mothership): connect integrations from chat without state_mismatch
• fix(hubspot): remove unused scopes
• fix(mothership): scope mothership block tool permissions to the executing user

Other Changes

• chore(auth): remove deprecated OAuth MCP provider plugin and backing tables

View changes on GitHub

Features

• feat(tables): add PostHog events for table-workflow run/stop gestures
• feat(linq): add Linq iMessage/SMS/RCS integration (34 tools, block, attachment upload)
• feat(providers): add Together AI, Baseten, and Ollama Cloud model providers
• feat(tables): expand filter operators (not-contains, starts/ends-with, not-in, empty)

Improvements

• improvement(kbs): ownership bindings
• improvement(copilot): stop persisting tool-call result outputs in transcripts
• improvement(copilot): make copilot_messages the sole transcript store, remove JSONB dual-write

Bug Fixes

• fix(tables): reliable stop-all, accurate "X running", and rate/usage gating for cell runs
• fix(misc): keep block-tool params selected across store replace, perms parity for delete
• fix(tables): enforce plan limits in mothership user_table tool
• fix(deps): upgrade vitest to ^4.1.0 to patch critical Vitest UI advisory (GHSA-5xrq-8626-4rwp)
• fix(table): preserve workflow groups on CSV column-add and dispatch after tx commit

Other Changes

• chore(access): helper cleanup

View changes on GitHub

Features

• feat(google-sheets): add row filtering to read with numeric operators

Improvements

• improvement(enrichments): limit company-info to fields both providers return
• improvement(integrations): validate and expand devin, cursor, and greptile
• perf(copilot): read chat transcripts from copilot_messages (R+1 cutover)

Bug Fixes

• fix(sso): re-check domain conflict before write and reject IP-address domains
• fix(selectors): fetch all pages for paginated dropdown list routes
• fix(files): don't reject external URLs containing '..' in file parse validation
• fix(search-replace): don't auto-navigate when content edits invalidate the active match
• fix(security): block private/reserved IPs for hosted 1Password Connect SSRF
• fix(security): harden SSO domain registration, webhook path isolation, and CSV export
• fix(wait): resume live/draft async waits and preserve cell context on chained waits
• fix(tables): serialize schema mutations to prevent parallel column clobber
• fix(icons): repair broken integration icon rendering
• fix(tables): right-align run/stop in embedded toolbar; workflow cells format like normal cells

Other Changes

• chore(db): drop redundant idx_webhook_on_workflow_id_block_id index

View changes on GitHub

Bug Fixes

• fix(copilot): seq migration

View changes on GitHub