Bee Flow v2026.10.30.2

What's Changed

• Admin: creating or editing an organisation sends only the fields the route accepts by @tom-beeflow in #452
• Login: a custom Microsoft button logo gets room by @tom-beeflow in #451

Full Changelog: v2026.10.30.1...v2026.10.30.2

Bee Flow v2026.10.30.1

What's Changed

• Firebird database integration: read-only SQL access for chat, automations and apps by @tom-beeflow in #449
• Microsoft SSO: fix the admin screen, additional tenants with their own login button text and logo by @tom-beeflow in #450

Full Changelog: v2026.10.30...v2026.10.30.1

Bee Flow v2026.10.30

What's Changed

• Boot: CPU model warmups off the boot path and only for models in use; durable-secret bootstrap retries by @tom-beeflow in #448

Full Changelog: v2026.10.29...v2026.10.30

Bee Flow v2026.10.29

What's Changed

• Container exceptions: drop the fixed ones, tie Debian reviews to the tracker by @tom-beeflow in #442
• Nextcloud connector 1.6.7: a failed user lookup no longer logs the embedded app out by @tom-beeflow in #443
• Release: copy every released image to the Scaleway registry next to the cluster by @tom-beeflow in #444
• Release: mirror with skopeo, which the Scaleway registry accepts by @tom-beeflow in #445
• Quality round 2026-10-29: loose types, strictness, long functions, agent-hub TypeScript and ratchets by @tom-beeflow in #446
• pwt-runner: upgrade libbrotli1 (CVE-2026-111497), unblocks the v2026.10.29 release candidate by @tom-beeflow in #447

Full Changelog: v2026.10.28...v2026.10.29

Bee Flow v2026.10.28

What's Changed

• zod 4.6 (GHSA-mrhx-c7xc-m3w5) and the 2026-10-24 DoS advisories by @tom-beeflow in #331
• Architecture and maintainability round: import cycles, core→feature edges, empty catches, inline styles, react-hooks by @tom-beeflow in #330
• Quality round 2: HttpError in routes, 74.6% of the server type-checked, userEvent, any/log ratchets, SDK majors by @tom-beeflow in #335
• Quality round 3: all comments in English, SSRF guards and URL tokens, withTransaction, shared mocks, static styles by @tom-beeflow in #336
• Quality round 4: code-quality CLIs, server splits, Builder types, react-query by @tom-beeflow in #337
• Round 5 (A6): docs in CI, guard/classify fail closed, SDK/connector/scripts type-checked, coverage floors by @tom-beeflow in #341
• Nested automation folders, managed from the Automations MCP by @tom-beeflow in #343
• MCP: fill datatables, and start an automation run live by @tom-beeflow in #344
• NMBRS SOAP: use the method names the v3 WSDL actually has by @tom-beeflow in #346
• NMBRS: salaries need Period and Year; per-company bulk reads; paging by @tom-beeflow in #350
• Automations overview: trigger colours, clearer status, folder sections by @tom-beeflow in #351
• Round 5 (agent-hub): react-query codemods, auto-split big files, JSX extract, eslint errors with bulk suppressions, knip exports by @tom-beeflow in #352
• Round 5 (server): swallowed errors fail closed, server type levels up to strict by @tom-beeflow in #367
• Round 5 (agent-hub, wave B): react-query reads, honest fetch-in-effect ratchet, lower complexity by @tom-beeflow in #368
• Round 5 (server architecture): server-mv and split-big tools, layering 279 -> 244, cycles 30 -> 26 by @tom-beeflow in #369
• Allow-lists for telemetry click names and the usage customer view by @tom-beeflow in #370
• docs: override postcss-selector-parser, qs, uuid (34 advisories -> 0) by @tom-beeflow in #374
• Connector and Hub module SDK: strict types (843 -> 0 errors), orgNaming mirror, clear-cache returns the organisation name by @tom-beeflow in #373
• Viewers may not start runs, skill links check run rights, maintenance window and DSR fixes by @tom-beeflow in #375
• Nmbrs bulk tools: short-lived page cache (10 pages -> 1 SOAP call) by @tom-beeflow in #376
• Round 5 (agent-hub): reads through react-query (fetch-in-effect 204 -> 147), useAgentHubData split into slices by @tom-beeflow in #372
• Automations: Outlook on your own mailbox or a shared mailbox (actions and the New email trigger) by @tom-beeflow in #378
• Round 5 (server): half the server strict, import cycles 10 -> 5, store schemas under one migration ledger, honest module-mock count by @tom-beeflow in #377
• Agent-hub tests: 641 test files to TypeScript, fireEvent -> userEvent (1,467 -> 779) by @tom-beeflow in #379
• Spreadsheet tabs no longer use up the datatable cap; datatable limits configurable by @tom-beeflow in #380
• Round 6 fixes: no user content in logs, writes not retried, CI output out of git, honest mock counts by @tom-beeflow in #382
• Server eslint: complexity and size rules as errors, existing findings suppressed per file and rule by @tom-beeflow in #383
• Docs: REST reference generated from the server (1,840 routes), auth and stream docs corrected by @tom-beeflow in #384
• agent-hub: @/ imports instead of deep relative paths (6,423), react-hooks findings 538 -> 146 by @tom-beeflow in #385
• Server types: strict 2,164 -> 2,283 files, noImplicitAny 384 -> 417, runtime identical by @tom-beeflow in #386
• App Studio: Studio documents in apps (viewer, picker, compare per kind, copy with another look) by @tom-beeflow in #390
• Server comments: history narration out (1,661 -> 948 lines), the why kept, with a ratchet by @tom-beeflow in #391
• Dependencies: the 17 vuln-watch advisories (undici, node-forge, js-yaml, body-parser, webpack-dev-middleware, http-cache-semantics) by @tom-beeflow in #392
• Nextcloud connector 1.6.4 by @tom-beeflow in #394
• Fix main: notificationEvents purge test broke when its fixed test date passed the 30-day retention by @tom-beeflow in #393
• Security: docs CMS auth relay, security_scan network isolation, no PII on disk in the guard cache, nodemailer advisories by @tom-beeflow in #396
• Ten server issues: licence, HTTP auth cache, Soverin Cc, WhisperX multipart, Vertex music, MCP group members, CI onnxruntime, APP_VERSION and two test/script fixes by @tom-beeflow in #397
• Agent-hub issues: datatable column suggestions, resolveTarget without screens, Teams/Meet import buttons, sharing knowledge with groups by @tom-beeflow in #398
• Desktop: Electron 44.10.0 (Node Brotli fix), open the workspace at /app, Nextcloud linking reports its outcome by @tom-beeflow in #395
• Nextcloud connector 1.6.5: stop forwarding the AppAPI secret, Talk bot survives restarts, 19 audit fixes by @tom-beeflow in #405
• Fix credential-store init and the ncScope IPv6 rate-limit key; quieter store inits by @tom-beeflow in #282
• Dependencies: the open Dependabot updates, regenerated against main and verified by @tom-beeflow in #400
• Automations: no live write with a gap, forward refs block, re-reads after a write allowed, output schemas for every nextcloud_* tool by @tom-beeflow in #406
• Nextcloud triggers: one payload shape for every producer, colleagues' events behind an opt-in and a visibility check by @tom-beeflow in #408
• Desktop: store the Nextcloud app password with the user's sign-in (run the request in the workspace page) by @tom-beeflow in #409
• Fix main CI: agent-hub typecheck without server node_modules, entry budget after today's merges by @tom-beeflow in #423
• Chat order: a turn lands where it was asked, and one deterministic read order by @tom-beeflow in #422
• Meeting notes: Teams and Meet imports run in the background (no 504 on long recordings) by @tom-beeflow in #424
• CMS: logo and favicon from an uploaded asset; feature demos follow the page language with neutral names by @tom-beeflow in #425
• Dependabot: monthly grouped version updates, majors planned by hand; the 9 open updates applied or declined by @tom-beeflow in #426
• Dependabot: react-native-webview moves with the Expo SDK (patches only) by @tom-beeflow in #430
• Build(deps): Bump the actions-patch-minor group across 1 directory with 6 updates by @dependabot[bot] in #429
• Build(deps): Bump the satellites-patch-minor group across 1 directory with 2 updates by @dependabot[bot] in #428
• Guard and classify: model-stack upgrade (torch 2.15, gliclass 0.1.21, transformers 5.21 in classify), eval gate passed by @tom-beeflow in #432
• Release gate: undici 6.29.1 in the server image's npm, filelock 4.2.1 in classify by @tom-beeflow in #433
• Chats: no turn is lost or misplaced when turns overlap (agent, direct and swarm), unique seq per conversation by @tom-beeflow in #434
• Nextcloud connector 1.6.6: certificate pinning, Dutch, Talk context per user, calendar triggers for colleagues by @tom-beeflow in #437
• Data-extraction dry-run samples follow the fields, automations demo mails per language, dead setup wizard removed by @tom-beeflow in #438
• Guard pyproject on torch 2.15.0; Dependabot leaves torch and react-native-webview alone by @tom-beeflow in #439
• Release gate: healthcheck wget stub marker back on line 2 by @tom-beeflow in #441

Full Changelog: v2026.10.23...v2026.10.28

Bee Flow v2026.10.23

What's Changed

• fix(ci): connector release token may update workflow files in the mirror by @tom-beeflow in #303
• chore(agent-hub): import/order autofix, inline colour styles to Tailwind, lower ratchets by @tom-beeflow in #319
• Bugs found by the type checker: fixes with regression tests by @tom-beeflow in #320
• Brotli CVE-2026-111497: patch the Playwright runner's Node, Electron 44.9.3 by @tom-beeflow in #324
• Daily vulnerability watch over every dependency and runtime; fix its first findings by @tom-beeflow in #323
• agent-hub to TypeScript, wave 3 and the last hand-written files (frontend quality phase 0) by @tom-beeflow in #325
• vuln-watch: fix the YAML so the workflow parses by @tom-beeflow in #327
• vuln-watch: run hourly, mail each finding once by @tom-beeflow in #328
• Remove pip from the guard and classify images by @tom-beeflow in #329

Full Changelog: v2026.10.21...v2026.10.23

Bee Flow v2026.10.21

What's Changed

• feat(studio): pdf_compare component, two PDFs side by side with changes outlined in red by @tom-beeflow in #298
• Automations: run observability, form wizards, reliable AI steps, tables and testing by @tom-beeflow in #297
• Node.js 22.23.4 security release; Nextcloud connector 1.6.3 by @tom-beeflow in #299
• Security round: components, Python sidecars, images and audit coverage by @tom-beeflow in #301

Full Changelog: v2026.10.20...v2026.10.21

Bee Flow v2026.10.20

What's Changed

• Frontend fixes: OAuth origin check, Solution errors, public app i18n, workflow menu, output reorder, chat width (BFSF-400/401/398/405/406/471) by @tom-beeflow in #128
• Server security fixes: connector identity, rate limiting, pin gate, metrics cardinality (BFSF-377, 381, 382, 389, 390, 452, 454, 459, 468) by @tom-beeflow in #129
• Privacy and data handling fixes (BFSF-469, 470, 424, 463, 418, 460, 384, 388, 461) by @tom-beeflow in #130
• CMS: a weblog for the product website, editable in the panel and over the CMS MCP by @tom-beeflow in #121
• CI: frontend tests in four shards by @tom-beeflow in #112
• Fixes: search-service embed and re-ingest, FAST_DEV guard, subscription confirmation mail, Nextcloud project links (BFSF-415, 417, 378, 252, 488) by @tom-beeflow in #131
• Datatables: column usage pill shows who uses it and opens Used by by @tom-beeflow in #132
• Learning Center: make the AI coach easy to find in the lesson player by @tom-beeflow in #133
• Builder: wait for the first token like the chat does by @tom-beeflow in #135
• Automations overview: Cards by default, and show what each flow does by @tom-beeflow in #134
• Automations: form editor overview, live-run form overlay, sidebar icons in the ribbon by @tom-beeflow in #136
• Bump uuid from 13.0.0 to 14.0.2 in /agent-hub by @dependabot[bot] in #67
• Bump better-sqlite3 from 11.10.0 to 13.0.3 in /server by @dependabot[bot] in #70
• Bump jsdom from 28.1.0 to 30.1.1 in /server by @dependabot[bot] in #72
• Bump the mobile-patch-minor group in /mobile with 4 updates by @dependabot[bot] in #75
• Bump the server-patch-minor group across 1 directory with 28 updates by @dependabot[bot] in #123
• Bump the frontend-patch-minor group across 1 directory with 11 updates by @dependabot[bot] in #122
• Bump the pii-service-patch-minor group in /pii-service with 2 updates by @dependabot[bot] in #90
• Bump the classify-service-patch-minor group in /classify-service with 3 updates by @dependabot[bot] in #89
• Bump uuid from 13.0.2 to 14.0.2 in /server by @dependabot[bot] in #71
• Bump the whisperx-patch-minor group in /whisperx-service with 3 updates by @dependabot[bot] in #61
• Bump react-dom from 18.3.1 to 19.3.0 in /docs by @dependabot[bot] in #60
• Bump android-actions/setup-android from 3.2.2 to 4.0.4 by @dependabot[bot] in #57
• Bump actions/download-artifact from 4.3.0 to 8.0.1 by @dependabot[bot] in #56
• Bump undici from 6.29.0 to 8.11.2 in /nextcloud-connector by @dependabot[bot] in #53
• Bump http-proxy-middleware from 3.0.5 to 4.2.0 in /nextcloud-connector by @dependabot[bot] in #52
• chore: maintenance round (dependencies, non-prd cleanup, security and tooling plan) by @tom-beeflow in #137
• Code-quality round: findings closed, boundaries enforced, 50 files split, one source per concept, gates lowered; Component Designer removed by @tom-beeflow in #156
• agent-hub to TypeScript, server structural work, chart-data-loss fixes by @tom-beeflow in #250
• SAST: fix the two real semgrep findings, annotate the rest, turn the gate back on by @tom-beeflow in #268
• Bug fixes and CMS work after the TypeScript conversion (ts-bugs) by @tom-beeflow in #267
• TypeScript 7 (native compiler) for every typecheck — phase 0 by @tom-beeflow in #271
• Bound server memory use: downloads, recordings, DLP token maps by @tom-beeflow in #295

Full Changelog: v2026.10.12.2...v2026.10.20

Bee Flow v2026.10.12.2

What's Changed

• Settings: put user and organisation settings in a logical place, and fix the GUI by @tom-beeflow in #125
• Settings: call the personal page "Koppelingen" in Dutch everywhere by @tom-beeflow in #126
• Composer: privacy line no longer pushes the Kennis pill onto a second row by @tom-beeflow in #127

Full Changelog: v2026.10.12...v2026.10.12.2

Bee Flow v2026.10.12.1

What's Changed

• Bump the guard-service-patch-minor group in /guard-service with 4 updates by @dependabot[bot] in #91
• CI: same tests and gates, shorter wall-clock (server shards, balanced frontend shards, mobile lint cache) by @tom-beeflow in #110
• CI: balance the frontend shards on GitHub's own per-file times by @tom-beeflow in #111
• MCP: IP allow-lists per endpoint via env by @tom-beeflow in #113
• Public URLs: https for a public host behind a TLS proxy by @tom-beeflow in #114
• CMS MCP: read-only website analytics tools by @tom-beeflow in #115
• Server image: clear the release container gate (October Go CVEs) by @tom-beeflow in #116
• Migrations: tests that fail when a migration is not registered at boot by @tom-beeflow in #117
• CMS MCP: page translations must sit under content, reject the flat shape by @tom-beeflow in #118
• Memory: recall relevant memories, fix extraction and review calls, keep memory text out of logs by @tom-beeflow in #120
• Knowledge bases: retry rate-limited embeddings, and source counts in the list again by @tom-beeflow in #119
• Embeddings: tests that both Azure paths wait out a 429 by @tom-beeflow in #124

Full Changelog: v2026.10.10...v2026.10.12.1