Features
- feat(credentials): set up keyless credentials from the v2 API, CLI and Sim MCP (#9875)
- feat(credentials): keyless Snowflake, Microsoft app-only and Google keyless, GitHub and Bitbucket tokens, DocuSign JWT (#9869)
- feat(mistral): extract PDF images as files and expose table format in Mistral Parser (#9856)
- feat(api): run a pinned deployment version and expose paused run points in v2 (#9854)
- feat(api-keys): read-only API keys and expiry at creation (#9855)
- feat(api): workflow trigger health and enablement through the v2 API (#9853)
- feat(network): honor HTTP_PROXY, HTTPS_PROXY and NO_PROXY for guarded requests, AWS SDK clients and OTLP export (#9851)
- feat(credentials): saved credentials for 21 token-and-host blocks on one host-aware check factory (#9849)
- feat(api): manage workspace members through the v2 API (#9852)
- feat(credentials): saved credentials for 17 more blocks, GitLab tokens, and keyless hardening (#9840)
- feat(search): manage source permissions through a shared API and CLI (#9845)
- feat(search): update GitLab permission CSVs through the API (#9841)
- feat(library): AI Agent Development Company vs Building In House: How to Decide (#9844)
- feat(library): Best AI Agent Platforms That Support the A2A Protocol in 2026 (#9843)
- feat(library): AI Agent Builders With Built-In Web Search and Research Tools in 2026 (#9842)
- feat(credentials): saved credentials and credential-only block versions, with keyless AWS/Databricks OIDC (#9763)
Improvements
- improvement(api): release audit follow-ups for v2 member analytics, workflow access middleware and docs (#9858)
- improvement(search): return a longer live read window when an MCP client asks for more chunks (#9823)
Bug Fixes
- fix(credentials): correct keyless setup instructions and enforce the saved-credential contract on every credential block (#9878)
- fix(mistral): say V3 parses an uploaded or referenced PDF, and bound Max Images at 100 (#9872)
- fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups (#9870)
- fix(sim-setup): stop doctor --fix from turning ${VAR} references into literals (#9868)
- fix(credentials): report a refused host as the user's input, persist normalized account ids, cap Databricks reads (#9859)
- fix(release): keyless subject uniqueness, NO_PROXY IPv6/CIDR, proxied boot secret, and remaining audit follow-ups (#9866)
- fix(release): small release-audit cleanups (#9863)
- fix(release): reuse only full-access delegation keys and treat a blank crawl depth as unset (#9857)
- fix(security): harden saved-credential, proxy egress, and keyless-mint paths from the release audit (#9865)
- fix(release): redact deploy keys, check operation-backed tools in the saved-credential contract, and drop SDK copy (#9864)
- fix(release): run pinned async versions on their own variables, map CLI key-creation errors, show GitLab tokens as the current block (#9862)
- fix(sim-setup): quote env values containing $ so dotenv, Bun, and Compose don't expand them (#9861)
- fix(release): cap proxied plain-http responses, count Firecrawl depth from the start URL, and drop stale route cache on upgrade (#9860)
- fix(firecrawl): complete v2 response and depth compatibility (#9847)
- fix(cli): bind sim-setup's containers to loopback, fix reset and env quoting, retire the legacy simstudio CLI (#9830)
- fix(docker): keep ISR and suffix-list caches writable on a read-only root (#9829)
Other Changes
- test(api-keys): use a neutral database role name in the internal-error fixture (#9877)
- test(credentials): use a non-token-shaped GitHub fixture so secret scanning stays quiet (#9876)
- docs(release): correct the Discord allowlist note, Mistral image naming, and the NO_PROXY reference (#9874)
- docs(skills): name refuseUnsafeTypedUrl in the add-integration token-credential steps (#9873)
- chore(sdk): use a live release family as the desktop feed's unrelated-release fixture (#9850)
- chore(sdk): remove the TypeScript and Python SDKs (#9848)
- chore(deps): take vitest 5.1, shiki 4.6, react-hook-form 7.91, MCP SDK 2.4, and small in-range updates (#9846)
- chore(deps): upgrade pi to 1.5.0 (#9826)
- ci: bump the actions group across 2 directories with 7 updates (#9839)
Contributors
- @dependabot[bot]
- @waleedlatif1