formbricks/formbricks 6.2.0 on GitHub

Upgrade impact

Upgrade impact: Action required for every self-hosted deployment: upgrade in a maintenance window with permission preparation, and check the Valkey, Cube, Helm, storage, audit-log and API items below. Upgrade steps

Overview

Formbricks 6.2 adds the Survey Flow Editor, with show-if conditions, calculated values and rules before the first question, and a Signature question. Surveys can be imported and exported as Formbricks, Word, Excel, CSV and Markdown files, every question and answer option gets a code for analysis exports, and reviewers can mark responses as Low quality. Dashboards get filters, a read-only Dashboard viewer role, and an API and MCP tools. Organizations can set data retention policies, website surveys can check show conditions and visit data, every list gets the same table toolbar, and attachment exports build in the background.

Self-hosters: upgrade from the latest 6.1 patch, in a maintenance window, and follow the 6.2 upgrade guide. Skipping 6.1 is not supported. The upgrade from 6.1.4 to 6.2.0 was tested.

Formbricks 6.2 receives bug fixes and security fixes until 13 February 2027.

⚠️ Breaking changes

Steps for each item are in the 6.2 upgrade guide.

Self-hosted deployment

The permission schema changes for the new Dashboard viewer role, and team#manage is narrowed. Online upgrades from 6.1 are refused: upgrade in a maintenance window with permission preparation (#9925)
The bundled Valkey moves from 8.1.9 to 9.1.2. Back up the Valkey volume and update any pinned image first (#9743)
Docker Compose and one-click need the Cube query timeout, PostgreSQL shared memory and the 6.2 Cube image and model files (Cube memory)
Helm with the bundled PostgreSQL now sets the CUBEJS_DB_* variables, which override cube.envFrom. Move your Cube database settings to cube.env (#10002)
Attachment exports need s3:AbortMultipartUpload on your own bucket and two new job queues for your own job consumer (#9917)
Self-hosted audit logging needs an Enterprise licence that includes audit logs. Without one, audit events stop after the upgrade (#9699)
Hub refuses to start when TAXONOMY_EMBEDDING_MODEL equals EMBEDDING_MODEL (#9955)
Where email-audit rows must be retained, deleting their source now fails instead of leaving content behind. Restore the dependency and retry (#9886)

API and SDK contract

Published surveys are locked: changing a question code, answer code, question type or option text after a survey leaves draft returns 422 with an immutable_* code on v3 and MCP, and 400 with published_survey_locked: on v1 (#9847)
MCP patch_survey, edit_survey_blocks, set_survey_block_order and delete_survey on a survey with responses return 428 unless the call sends confirm: true (#9919)
v3 survey create: a duplicate question ID names blocks.N.elements.M.id with the code duplicate_identifier, and a create whose after-commit work fails returns 201 (v3) or 200 (v1) with the saved survey (#9878)
GET /api/v2/organizations/{organizationId}/users can return the new dashboard_viewer role (#9925)

What's Changed

🚀 Features

feat(types): add the shared show-conditions schema and evaluator [ENG-3925] by @pandeymangg in #9618
feat(feedback-records): expose updated_since/updated_until for incremental extraction [ENG-3420] by @xernobyl in #9515
feat: data retention policies, exemptions and history [ENG-3713][ENG-3610][ENG-3611][ENG-3612][ENG-3721] by @xernobyl in #9567
feat(surveys): let creators keep the ending card open instead of auto-closing [ENG-3428] by @itsjavi in #9622
feat(billing): explain response overage pricing under the usage bar by @jobenjada in #9682
feat: show conditions and the visit for website surveys [ENG-3926][ENG-3927] by @pandeymangg in #9655
feat: show AND/OR groups as a tree in the debug panel [ENG-4070] by @pandeymangg in #9759
feat(surveys): add Malay (ms-MY) survey language support by @Dhruwang in #9706
feat: emit structured abuse alert signals by @BhagyaAmarasinghe in #9814
feat: add post-deployment health check image by @Dhruwang in #9538
feat(docker): support external PostgreSQL for SpiceDB by @BhagyaAmarasinghe in #9829
feat(creatives): feedback buttons and banners by @itsjavi in #9666
feat(api): charts and dashboards in API v3, MCP and the app by @xernobyl in #9786
feat: unified table toolbar on every list table by @Dhruwang in #9811
feat: widen the Advanced filter field picker and show field icons by @Dhruwang in #9885
feat(creatives): per-creative browser-language switch; fail the E2E journey without Creatives by @itsjavi in #9890
feat(surveys): compact survey card with close button beside the question and side-by-side choices by @jobenjada in #9816
feat(email-audit): record outbound email attempts and rendered copies by @BhagyaAmarasinghe in #9886
feat: question and answer codes, advanced export and Low quality responses by @pandeymangg in #9847
feat(responses): build attachment exports in the background and download them from storage [ENG-6862] by @BhagyaAmarasinghe in #9917
feat(signature): add a signature element for drawn and typed signatures by @mattinannt in #9880
feat(web): ID-free app links for marketing (/billing, /settings, /contacts, …) by @harshsbhat in #9569
feat(dashboards): dashboard viewer role and dashboard filters by @Dhruwang in #9925
feat(surveys): import and export surveys as Formbricks, Word, Excel and CSV files [ENG-6844] by @xernobyl in #9878
feat: Survey Flow Editor by @itsjavi in #9919
feat(api): add optional full survey details to the v3 surveys list [ENG-6861] by @xernobyl in #9879

🐛 Fixes

fix(auth): end an OAuth app's tokens that reach past its narrowed consent [ENG-3529] by @xernobyl in #9555
fix(js-core): load the SDK and survey renderer on pages with an AMD loader [ENG-3657] by @pandeymangg in #9617
fix(web): unify workspace pickers and stop nested scrolling in switchers by @jobenjada in #9607
fix: sign Plain chat external ID with customerDetailsSignature by @mattinannt in #9628
fix(plain): fail open when the active-customer lookup errors [ENG-2117] by @Dhruwang in #9619
fix(survey-editor): clarify changing a survey's default language [ENG-3617] by @itsjavi in #9625
fix(survey-ui): keep smiley rating line art readable in dark mode [ENG-3937] by @Dhruwang in #9626
fix(api-v3): refuse survey patches and block edits that introduce cyclic logic by @Dhruwang in #9634
fix(link-survey): say an invalid link is not valid instead of "This looks fishy." by @jobenjada in #9643
fix(surveys): resolve bare language codes to the canonical survey language [ENG-3961] by @itsjavi in #9637
fix(api-v3): accept survey patches that leave a stored survey's existing issues untouched [ENG-3975] by @Dhruwang in #9651
fix(docker): refresh the bundled Cube model on update [ENG-3951] by @BhagyaAmarasinghe in #9645
fix: run the JS SDK journey under a customer CSP and stop Zod's eval probe [ENG-3969] by @Dhruwang in #9640
fix(upgrade): run the online migration script from the bundled CLI's image path [ENG-3949] by @BhagyaAmarasinghe in #9656
fix(helm): skip deferred migrations in the Hub migration wait [ENG-3948] by @BhagyaAmarasinghe in #9642
fix(authzed): document the prepare Job's full environment and name invalid variables [ENG-3953] by @BhagyaAmarasinghe in #9650
fix(upgrade): compare survey edges as sets in online finalize [ENG-3950] by @BhagyaAmarasinghe in #9662
fix(chart): let online mode keep a single Cube replica [ENG-3955] by @BhagyaAmarasinghe in #9663
fix(webhooks): pick webhook surveys with a multi-select combobox [ENG-3960] by @itsjavi in #9632
fix(billing): resolve duplicate Stripe responses prices instead of failing the catalog by @Dhruwang in #9615
fix(surveys): keep every answer when file uploads overlap [ENG-3945] by @pandeymangg in #9672
fix(auth): record a sign-in, and resume an MCP authorization, only once its second factor completes it [ENG-3271][ENG-3933] by @xernobyl in #9620
fix(docker): cap /api/auth request bodies at the one-click Traefik edge [ENG-3977] by @xernobyl in #9652
fix(workspaces): enforce the workspace limit inside the creating transaction [ENG-3921] by @xernobyl in #9613
fix(auth): block subdomains of wildcard disposable email providers on signup by @jobenjada in #9635
fix(look): make the survey-level styling toggle say what it does by @jobenjada in #9627
fix(data-retention): show the survey retention note as small info and warning alerts by @jobenjada in #9681
fix(survey-editor): turn on browser language auto-select when a second language is added [ENG-3963] by @itsjavi in #9639
fix(survey-editor): name the browser tab after the survey being edited by @jobenjada in #9646
fix(web): refresh breadcrumbs and switchers after renaming an org or workspace [ENG-724] by @Dhruwang in #9633
fix(charts): use unsaved-changes copy when discarding edits to a saved chart [ENG-3941] by @Dhruwang in #9629
fix(web): drop the churn-survey retry that can never run [ENG-3217] by @pandeymangg in #9685
fix(security): bound anonymous request bodies on auth routes and the Next proxy [ENG-3846][ENG-3972] by @xernobyl in #9636
fix(support): only mount the Plain chat when customer identity can be verified by @Dhruwang in #9616
fix(docker): publish the one-click app port on loopback only [ENG-3983] by @xernobyl in #9680
fix(auth): close Better Auth's native sign-up route so Turnstile can't be skipped [ENG-3988] by @xernobyl in #9703
fix: honor sslaccept in migration connections by @BhagyaAmarasinghe in #9700
fix(authzed): report a prepare step that ran out its time as a timeout [ENG-4039] by @BhagyaAmarasinghe in #9708
fix(survey-ui): fill smiley face details with currentColor by @xernobyl in #9718
fix(survey-editor): show Capture IP as off while Anonymize responses is on by @jobenjada in #9641
fix(audit-logs): require the enterprise licence for self-hosted audit logging [ENG-3374] by @xernobyl in #9699
fix: make Node trust the OS CA bundle so the eMudhra distrust reaches it [ENG-4065] by @pandeymangg in #9720
fix(redis): scope private CA trust to Redis connections by @BhagyaAmarasinghe in #9721
fix(surveys): stop a finished survey without an ending card leaving an empty dialog [ENG-4069] by @Dhruwang in #9739
fix(saml): bound the callback's XML parse and stop storing anonymous responses as traces [ENG-3973][ENG-3976] by @xernobyl in #9686
fix(security): bump sanitize-html, MCP server SDK, markdown-it, vite, follow-redirects [ENG-4073][ENG-4074][ENG-4075] +18 by @Dhruwang in #9774
fix(surveys): accept a choice label from any stored language in membership validation by @Dhruwang in #9769
fix(link-survey): gate the link page, its routes and actions on a servable survey [ENG-4032] by @xernobyl in #9702
fix(billing): refuse paid plan changes without a resolved tax location [ENG-4033] by @Dhruwang in #9694
fix(surveys): allow the default ending-card CTA without external URL entitlement [ENG-4052] by @Dhruwang in #9713
fix: read cookies before the page surface registers after() in the workspace layout [ENG-3375] by @pandeymangg in #9775
fix: capture trustworthy audit request metadata by @BhagyaAmarasinghe in #9773
fix(surveys): reopen the editor preview after its close X is clicked by @Dhruwang in #9740
fix(api-v2): keep one organization from changing a shared user's name or active state [ENG-3807] by @xernobyl in #9683
fix(security): bump vitest to 4.1.12 and storybook to 10.6.2 and patch 3 advisories [ENG-6577][ENG-6578][ENG-6579] by @Dhruwang in #9782
fix: block oemails.com signups on Formbricks Cloud by @jobenjada in #9778
fix(auth): treat a session whose Postgres row is gone as signed out instead of crashing [ENG-3418] by @BhagyaAmarasinghe in #9789
fix(saml): decrypt and time encrypted assertions in the parse worker [ENG-4051] by @xernobyl in #9768
fix(docker): keep IPv6 visitors' real address on one-click installs [ENG-3897] by @BhagyaAmarasinghe in #9791
fix(container-security): one Backlog ticket per image instead of one Triage ticket per CVE [ENG-3962] by @xernobyl in #9781
fix(analysis): truncate long chart and dashboard names in the list tables [ENG-6702] by @Dhruwang in #9805
fix(mcp): bound input validation across requests and batches by @mattinannt in #9760
fix: clarify Helm CRD ownership and add cluster coverage by @BhagyaAmarasinghe in #9792
fix(security): harden taxonomy chart runtime defaults by @BhagyaAmarasinghe in #9801
fix(docker): complete Debian one-click installation by @BhagyaAmarasinghe in #9810
fix: show accurate error pages for backend failures by @Dhruwang in #9783
fix(surveys): generate AI survey drafts in survey languages beyond dashboard locales by @Dhruwang in #9776
fix(saml): restore sign-in, bound jackson's XPath selects, and match its refusals [ENG-4045][ENG-4108][ENG-6646][ENG-6648] by @xernobyl in #9793
fix(surveys): stop survey buttons submitting a host page's form [ENG-3457] by @pandeymangg in #9827
fix: make AI timeouts configurable for self-hosted models by @BhagyaAmarasinghe in #9719
fix(security): bump next to 16.4.1 and patch 2 advisories [ENG-6683][ENG-6691] by @Dhruwang in #9804
fix(link-survey): require the single-use link in the public PIN and verify-email actions [ENG-4041] by @xernobyl in #9790
fix(email): rate-limit every email per organization, sender and recipient [ENG-3823][ENG-6658] by @xernobyl in #9796
fix(link-survey): email the stored survey name, bounded and de-linked [ENG-4043] by @xernobyl in #9826
fix(deps): bump zod to 4.6.6 (GHSA-mrhx-c7xc-m3w5) by @Dhruwang in #9848
fix(storage): require PIN token and single-use link for upload URLs by @Dhruwang in #9862
fix: clamp max file size to at least 1 MB in file upload question by @Dhruwang in #9860
fix: response details show option IDs for translated choice answers by @Dhruwang in #9859
fix: response email opt-out links point to the account notifications page by @Dhruwang in #9861
fix: keep every survey language when re-enabling the ending card button by @Dhruwang in #9863
fix(workflows): let the workflow title fill the header and wrap [ENG-6572] by @itsjavi in #9858
fix(survey-ui): draw focus as a dashed outline so it never reads as selected [ENG-4062] by @itsjavi in #9857
fix(email): bump nodemailer and the packages behind open Dependabot alerts [ENG-6680] by @xernobyl in #9865
fix: no empty gap in Advanced filter with a single rule by @Dhruwang in #9869
fix(docker): run the app image on Node 24.22.2 [ENG-6597] by @xernobyl in #9868
fix: block 11 Proton and SimpleLogin email domains on Cloud by @jobenjada in #9851
fix(rate-limit): fail closed on abuse limits when Redis is unavailable [ENG-3828] by @BhagyaAmarasinghe in #9845
fix: block Tuta email domains on Formbricks Cloud signup by @jobenjada in #9872
fix(docker): name the failing step when one-click setup stops by @BhagyaAmarasinghe in #9884
fix(deps): upgrade Better Auth to 1.7.7 and stop depending on account issuers [ENG-3880] by @xernobyl in #9889
fix(account): email users when their account is deleted [ENG-862] by @itsjavi in #9891
fix(storage): refuse upload urls for closed and archived surveys [ENG-4044] by @xernobyl in #9843
fix(billing): end free trials on Hobby unless the org explicitly buys a plan by @Dhruwang in #9785
fix(surveys): keep the survey bundle clean under a strict CSP, and gate it in CI by @mattinannt in #9905
fix(surveys): keep a gap between the last input and the sticky Back/Next row in embed mode by @Dhruwang in #9907
fix(authzed): keep audits off the shared queue and outbox alerts live [ENG-3764] by @BhagyaAmarasinghe in #9904
fix: fail fast when Redis is slow or down by @BhagyaAmarasinghe in #9912
fix: add opt-in STARTTLS requirement for SMTP by @BhagyaAmarasinghe in #9921
fix(api): bound collection sizes in response, identify and auth requests [ENG-6797][ENG-6882] by @xernobyl in #9855
fix: refresh integration lists after adding, updating or removing a connection by @Dhruwang in #9899
fix(storage): stop decoding file names a second time on download and delete [ENG-3077] by @pandeymangg in #9923
fix(api-v3): bound validation work in the survey document parse [ENG-4100] by @xernobyl in #9926
fix(authzed): recover projection delivery after transient Redis outages by @BhagyaAmarasinghe in #9941
fix: batch large survey translations by @BhagyaAmarasinghe in #9936
fix(i18n): use one German label per concept in de-DE by @jobenjada in #9937
fix(security): bump node-forge, follow-redirects and joi, patching 14 advisories [ENG-6917][ENG-6922][ENG-6919] +11 more by @Dhruwang in #9920
fix(i18n): use one Portuguese label per concept in pt-BR and pt-PT by @jobenjada in #9951
fix(responses): check finished under a row lock in the client response update [ENG-6869] by @xernobyl in #9934
fix(web): enforce the role floor, survey visibility and branding licence in server actions [ENG-6812][ENG-6811][ENG-6840] by @xernobyl in #9929
fix(analysis): decode each HTML entity once in example-response headlines by @xernobyl in #9928
fix(sdk): prevent strict-csp prefetch violations with setup opt-out by @mattinannt in #9956
fix(segments): scope any to workspace-visible surveys and require visibility for segment filters [ENG-6870] by @xernobyl in #9935
fix(analytics): expose Cube embedded-key discovery (backport #9973 to release/6.2) by @pandeymangg in #9979
fix: show the full survey options menu without scrolling (backport #9967 to release/6.2) by @itsjavi in #9981
fix(signature): let the pad follow the survey theme and dark appearance (backport #9990 to release/6.2) by @itsjavi in #9997
fix(responses): make the status filter keep every ticked value (backport #9989 to release/6.2) by @pandeymangg in #9998
fix(survey-import): let the import dialog grow so the report and list fit (backport #9965 to release/6.2) by @jobenjada in #9987
fix(docker): keep the one-click update running when started as ./formbricks.sh (backport #9984 to release/6.2) by @BhagyaAmarasinghe in #10000
fix(helm): let a fresh install with the bundled database become ready (backport #9986 to release/6.2) by @BhagyaAmarasinghe in #10002
fix(helm): keep the Valkey claim template stable across chart upgrades (backport #9985 to release/6.2) by @BhagyaAmarasinghe in #10001
fix(docker): run the app image on Node 24.22.3 (backport #10004 to release/6.2) [ENG-7155] by @xernobyl in #10005

⚡ Performance

perf(i18n-utils): read source files through a bounded pool in scan-translations [ENG-3936] by @xernobyl in #9624
perf(authzed): process organizations concurrently in the full audit by @BhagyaAmarasinghe in #9828
perf: trim non-survey JavaScript from link survey pages by @Dhruwang in #9866
perf(survey-editor): stop autosave and saves from re-rendering the editor page [ENG-3792] by @Dhruwang in #9867
perf: server-render page content instead of gating the root layout on client i18n setup by @Dhruwang in #9888
perf(responses): derive filter options with distinct-value queries [ENG-3755] by @itsjavi in #9910

📚 Docs

docs(self-hosting): document AAAA records and IPv6 firewall rules for one-click setup [ENG-3467] by @xernobyl in #9602
docs(self-hosting): pin Cube by digest on 6.0.x before an online upgrade by @Dhruwang in #9658
docs(self-hosting): add a general upgrade guide for every release by @Dhruwang in #9687
docs: add a changelog page that mirrors the GitHub release notes by @Dhruwang in #9688
docs: add dashboard glossary terms, ADRs and agent-skills config [ENG-3928] by @xernobyl in #9779
docs: document self-hosted deployment components by @BhagyaAmarasinghe in #9772
docs: move iOS SDK installation guidance to Swift Package Manager by @mattinannt in #9817
docs(creatives): user, MCP and technical handbook docs for Creatives by @itsjavi in #9850
docs: explain why a banner blinks on page switches and how to hide it by @itsjavi in #9877
docs: add CODING_STANDARDS.md for design and review judgement calls [ENG-6843] by @xernobyl in #9871
docs(agents): check maintained release lines when changing CI by @xernobyl in #9896
docs(standards): no compatibility obligation for unreleased code by @xernobyl in #9909
docs: simplify enterprise upgrades and unify release guidance by @mattinannt in #9808
docs(ai): add guidelines for code that calls an AI model by @xernobyl in #9946
docs(surveys): flow editor screenshots after the polish, and formbricks file notes by @itsjavi in #9968
docs: publish the 6.2 upgrade guide and 6.2.0 release notes (backport #10006 to release/6.2) by @Dhruwang in #10007

⚙️ CI

ci(sonarqube): ignore coverage on PRs targeting release branches by @xernobyl in #9716
feat(ci): monitor stack container images and sync vulnerabilities to Linear by @mattinannt in #9712
ci: treat an uncompilable CodeRabbit schema as unavailable, not as an invalid config by @Dhruwang in #9806
fix(ci): use isolated fixtures for Docker validation by @mattinannt in #9714
fix(ci): unblock browser checks and complete cube image update by @mattinannt in #9834
ci: remove the PR size warning workflow [ENG-6621] by @xernobyl in #9787
ci: migrate Docker builds to Blacksmith using existing registries by @mattinannt in #9715
ci: keep the E2E report when a run stalls, and fail lint on duplicate ADR numbers by @Dhruwang in #9870
fix(ci): run Cube in the v3 contract job instead of accepting its 502 by @Dhruwang in #9943
chore(ci): weekly Dependabot version updates for the npm workspace [ENG-6884] by @xernobyl in #9902

🧹 Chores

chore(sonar): stop two rules from flagging intentional patterns [ENG-3871] by @xernobyl in #9598
test(auth): stop the bootstrap-race test flaking on Better Auth's masked 403 [ENG-3980] by @xernobyl in #9647
chore: run Playwright E2E on the Actions runner, retire Azure service by @mattinannt in #9673
chore: clarify survey packages in root LICENSE MIT exceptions by @mattinannt in #9711
chore: update hub to 0.14.1 [ENG-4067] by @xernobyl in #9726
test(e2e): wait for AuthZed projection before fixture login [ENG-4101] by @xernobyl in #9767
chore(deps): roll up open Dependabot image, chart and action bumps by @Dhruwang in #9777
chore(license): pitch AI smart tools instead of spam protection in Lite license copy by @jobenjada in #9824
chore(helm): bump taxonomy to 0.1.14 [ENG-4491][ENG-6601] by @xernobyl in #9825
chore(docker): bump authzed/zed from v1.1.1 to v1.14.0 by @dependabot in #9750
chore(docker): bump vllm/vllm-openai from v0.14.0 to v0.32.0 in /docker by @dependabot in #9755
chore: commit the AI Hero skills for the feature development flow by @mattinannt in #9836
chore(docker): synchronize bundled Valkey upgrade to 9.1.2 by @dependabot in #9743
chore(docker): bump vllm/vllm-openai from v0.14.0 to v0.32.0 by @dependabot in #9748
chore(docker): bump authzed/spicedb from v1.56.2 to v1.57.0 in /docker by @dependabot in #9822
chore(agents): add the release-notes skill with patch notes and a Security section by @xernobyl in #9853
chore: split and streamline agent guidance by @mattinannt in #9838
chore: lint and test guardrails from an agent retrospective by @itsjavi in #9788
chore: turn six months of review and incident history into agent checks and standards by @mattinannt in #9895
chore(helm): bump taxonomy to 0.1.15 [ENG-6872] by @xernobyl in #9903
chore(helm): bump postgres from 17-alpine to 18-alpine in /charts/formbricks by @dependabot in #9876
test(surveys): cover the response queue rebuilt after every add during an in-flight send by @Dhruwang in #9898
chore(editor): remove the per-question "Changes may lead to inconsistencies" note by @pandeymangg in #9942
chore(editor): drop the Signature "Is not signed" logic hint by @jobenjada in #9963
chore: update hub to 0.14.2 by @xernobyl in #9955
chore(agents): mirror sonar in staged lint, add i18n:merge by @mattinannt in #9901
chore: update hub to 0.14.3 (backport #9991 to release/6.2) [ENG-7099] by @xernobyl in #9992

🔒 Security

Fixes for vulnerabilities reported to us or found internally. Thanks to the researchers named below, who reported them through responsible disclosure.

High — A SAML sender with the configured issuer and the service provider's encryption certificate could block the server with an encrypted assertion; decryption and parsing are now bounded (#9768)
Medium — Saved segments could reveal who responded to a Restricted survey to members who can't see that survey (#9935). Reported by Dickson Wu, SEAL & CertiK.
Medium — A finished response's answers could be changed or reopened after the response was marked finished (#9934). Reported by SaaSforUS.
Medium — Embedded Data usage lists showed names and statuses of Restricted surveys to members who can't see them, and changing a pending invite's role skipped the user-management minimum role on self-hosted instances that raise it (#9929)
Medium — On self-hosted multi-organization instances, one organization's API key could deactivate or rename a user who also belongs to other organizations (#9683)
Medium — The public link-survey email could carry client-supplied text under a customer's branding; it now uses the stored survey name (#9826)
Medium — A single v3 or MCP survey create could tie up a web process during validation (#9926)
Medium — Survey preview and SDK setup links opened new tabs that could navigate the Formbricks tab (#9878)
Anonymous callers could get upload URLs for draft, closed or archived surveys (#9843), and for single-use or PIN-protected surveys without a valid link or PIN (#9862), and leave unused files in the storage bucket. They could not read files or responses.
A caller with a valid MCP credential could send a request that exhausted server memory during input validation (#9760)
SMTP can be required to use STARTTLS with SMTP_REQUIRE_TLS=1 (#9921)
node-forge updated to 1.4.1, follow-redirects to 1.16.2 and joi to 17.13.9: certificate verification, TLS and parsing flaws (#9920)
follow-redirects updated to 1.16.1 and @modelcontextprotocol/server to 2.3.0: credential headers on cross-origin redirects and MCP validation memory use (#9774)
Hub updated to 0.14.3, with Go 1.27.4 and golang.org/x/net 0.62.0 (#9992)

Full Changelog: 6.1.4...6.2.0