Breaking changes
- infra!: Move WAF ownership out of the Fargate stack (#4145)
Security
- security(infra): Support workload IAM boundaries on Fargate (#4142)
Case management
- feat(cases+actions): Let workspace admins delete any case comment (#4172)
- feat(cases): Close sub-cases when parent case closes (#4166)
- fix(cases): Tidy case filters, search copy, and sub-cases panel (#4165)
- feat(cases+actions): Add sub-case actions for case deduplication (#4160)
- fix(cases): Create a case and its tags in one transaction (#4155)
Tables
- fix(tables): Import CSV into the current folder (#4158)
- feat(tables): Add folders to organize workspace tables (#4019)
Agents
- fix(agents): Attribute direct-route LLM read timeouts to the user (#4173)
- fix(engine+agents): Scope tier and channel-sink reads to their tenant (#4141)
- fix(agents): Classify raw provider transport errors as outages (#4138)
- feat(agents+ui): Add the channel bot admin API (#4118)
- feat(agents): Add a unique key on agent session id and workspace id (#4117)
- feat(agents): Record approval decisions per click before applying them (#4116)
- feat(agents): Deliver channel notices from the durable agent workflow (#4115)
- fix(agents): Allow more than 50 tools on agent chat sessions (#4012)
Integrations
- revert(integrations+ui): Delete old registry when its URL changes (#4168)
- fix(integrations+ui): Delete old custom registry when its URL changes (#4164)
- feat(integrations): Add Socket MCP server to the catalog (#4156)
- feat(integrations): Support Atlassian OAuth in Confluence actions (#4154)
- feat(integrations): Add Atlassian OAuth to Jira and add JSM actions (#4153)
- feat(integrations): Add Zendesk OAuth client credentials provider (#4152)
- feat(integrations): Add Slack pin and bookmark actions (#4150)
- feat(integrations): Add Devin MCP server to the catalog (#4144)
Engine
- fix(engine): Flush partial NSTUN writes so large uploads don't stall (#4146)
API
- fix(api): Return 4xx for missing secrets, workflows and Bitbucket hosts (#4163)
- fix(rbac+ui): Drop secret read for registry sync and show repo ID (#4137)
- fix(api): Return 401 for webhook secrets with non-ASCII characters (#4109)
- fix(api): Return 422 for deeply nested invalid request bodies (#4108)
User interface
- fix(ui): Let admins remove a custom registry repository (#4161)
- fix(ui): Let read-only users auto-layout the workflow canvas (#4005)
Infrastructure
- docs(infra): Clarify independent WAF monitoring ownership (#4148)
- docs(infra): Explain legacy Fargate WAF migration (#4147)
- chore(infra): Add an RLS sweep script for enforce rollouts (#4140)
- feat(infra): Move role setup to a script, migrate as migrator only (#4134)
Documentation
- docs: Add GitOps / Custom Registry tab and split Git sync page (#4170)
Full Changelog: 1.5.0-alpha.2.4...1.5.0-alpha.3