Bee Flow v2026.10.28

What's Changed

• zod 4.6 (GHSA-mrhx-c7xc-m3w5) and the 2026-10-24 DoS advisories by @tom-beeflow in #331
• Architecture and maintainability round: import cycles, core→feature edges, empty catches, inline styles, react-hooks by @tom-beeflow in #330
• Quality round 2: HttpError in routes, 74.6% of the server type-checked, userEvent, any/log ratchets, SDK majors by @tom-beeflow in #335
• Quality round 3: all comments in English, SSRF guards and URL tokens, withTransaction, shared mocks, static styles by @tom-beeflow in #336
• Quality round 4: code-quality CLIs, server splits, Builder types, react-query by @tom-beeflow in #337
• Round 5 (A6): docs in CI, guard/classify fail closed, SDK/connector/scripts type-checked, coverage floors by @tom-beeflow in #341
• Nested automation folders, managed from the Automations MCP by @tom-beeflow in #343
• MCP: fill datatables, and start an automation run live by @tom-beeflow in #344
• NMBRS SOAP: use the method names the v3 WSDL actually has by @tom-beeflow in #346
• NMBRS: salaries need Period and Year; per-company bulk reads; paging by @tom-beeflow in #350
• Automations overview: trigger colours, clearer status, folder sections by @tom-beeflow in #351
• Round 5 (agent-hub): react-query codemods, auto-split big files, JSX extract, eslint errors with bulk suppressions, knip exports by @tom-beeflow in #352
• Round 5 (server): swallowed errors fail closed, server type levels up to strict by @tom-beeflow in #367
• Round 5 (agent-hub, wave B): react-query reads, honest fetch-in-effect ratchet, lower complexity by @tom-beeflow in #368
• Round 5 (server architecture): server-mv and split-big tools, layering 279 -> 244, cycles 30 -> 26 by @tom-beeflow in #369
• Allow-lists for telemetry click names and the usage customer view by @tom-beeflow in #370
• docs: override postcss-selector-parser, qs, uuid (34 advisories -> 0) by @tom-beeflow in #374
• Connector and Hub module SDK: strict types (843 -> 0 errors), orgNaming mirror, clear-cache returns the organisation name by @tom-beeflow in #373
• Viewers may not start runs, skill links check run rights, maintenance window and DSR fixes by @tom-beeflow in #375
• Nmbrs bulk tools: short-lived page cache (10 pages -> 1 SOAP call) by @tom-beeflow in #376
• Round 5 (agent-hub): reads through react-query (fetch-in-effect 204 -> 147), useAgentHubData split into slices by @tom-beeflow in #372
• Automations: Outlook on your own mailbox or a shared mailbox (actions and the New email trigger) by @tom-beeflow in #378
• Round 5 (server): half the server strict, import cycles 10 -> 5, store schemas under one migration ledger, honest module-mock count by @tom-beeflow in #377
• Agent-hub tests: 641 test files to TypeScript, fireEvent -> userEvent (1,467 -> 779) by @tom-beeflow in #379
• Spreadsheet tabs no longer use up the datatable cap; datatable limits configurable by @tom-beeflow in #380
• Round 6 fixes: no user content in logs, writes not retried, CI output out of git, honest mock counts by @tom-beeflow in #382
• Server eslint: complexity and size rules as errors, existing findings suppressed per file and rule by @tom-beeflow in #383
• Docs: REST reference generated from the server (1,840 routes), auth and stream docs corrected by @tom-beeflow in #384
• agent-hub: @/ imports instead of deep relative paths (6,423), react-hooks findings 538 -> 146 by @tom-beeflow in #385
• Server types: strict 2,164 -> 2,283 files, noImplicitAny 384 -> 417, runtime identical by @tom-beeflow in #386
• App Studio: Studio documents in apps (viewer, picker, compare per kind, copy with another look) by @tom-beeflow in #390
• Server comments: history narration out (1,661 -> 948 lines), the why kept, with a ratchet by @tom-beeflow in #391
• Dependencies: the 17 vuln-watch advisories (undici, node-forge, js-yaml, body-parser, webpack-dev-middleware, http-cache-semantics) by @tom-beeflow in #392
• Nextcloud connector 1.6.4 by @tom-beeflow in #394
• Fix main: notificationEvents purge test broke when its fixed test date passed the 30-day retention by @tom-beeflow in #393
• Security: docs CMS auth relay, security_scan network isolation, no PII on disk in the guard cache, nodemailer advisories by @tom-beeflow in #396
• Ten server issues: licence, HTTP auth cache, Soverin Cc, WhisperX multipart, Vertex music, MCP group members, CI onnxruntime, APP_VERSION and two test/script fixes by @tom-beeflow in #397
• Agent-hub issues: datatable column suggestions, resolveTarget without screens, Teams/Meet import buttons, sharing knowledge with groups by @tom-beeflow in #398
• Desktop: Electron 44.10.0 (Node Brotli fix), open the workspace at /app, Nextcloud linking reports its outcome by @tom-beeflow in #395
• Nextcloud connector 1.6.5: stop forwarding the AppAPI secret, Talk bot survives restarts, 19 audit fixes by @tom-beeflow in #405
• Fix credential-store init and the ncScope IPv6 rate-limit key; quieter store inits by @tom-beeflow in #282
• Dependencies: the open Dependabot updates, regenerated against main and verified by @tom-beeflow in #400
• Automations: no live write with a gap, forward refs block, re-reads after a write allowed, output schemas for every nextcloud_* tool by @tom-beeflow in #406
• Nextcloud triggers: one payload shape for every producer, colleagues' events behind an opt-in and a visibility check by @tom-beeflow in #408
• Desktop: store the Nextcloud app password with the user's sign-in (run the request in the workspace page) by @tom-beeflow in #409
• Fix main CI: agent-hub typecheck without server node_modules, entry budget after today's merges by @tom-beeflow in #423
• Chat order: a turn lands where it was asked, and one deterministic read order by @tom-beeflow in #422
• Meeting notes: Teams and Meet imports run in the background (no 504 on long recordings) by @tom-beeflow in #424
• CMS: logo and favicon from an uploaded asset; feature demos follow the page language with neutral names by @tom-beeflow in #425
• Dependabot: monthly grouped version updates, majors planned by hand; the 9 open updates applied or declined by @tom-beeflow in #426
• Dependabot: react-native-webview moves with the Expo SDK (patches only) by @tom-beeflow in #430
• Build(deps): Bump the actions-patch-minor group across 1 directory with 6 updates by @dependabot[bot] in #429
• Build(deps): Bump the satellites-patch-minor group across 1 directory with 2 updates by @dependabot[bot] in #428
• Guard and classify: model-stack upgrade (torch 2.15, gliclass 0.1.21, transformers 5.21 in classify), eval gate passed by @tom-beeflow in #432
• Release gate: undici 6.29.1 in the server image's npm, filelock 4.2.1 in classify by @tom-beeflow in #433
• Chats: no turn is lost or misplaced when turns overlap (agent, direct and swarm), unique seq per conversation by @tom-beeflow in #434
• Nextcloud connector 1.6.6: certificate pinning, Dutch, Talk context per user, calendar triggers for colleagues by @tom-beeflow in #437
• Data-extraction dry-run samples follow the fields, automations demo mails per language, dead setup wizard removed by @tom-beeflow in #438
• Guard pyproject on torch 2.15.0; Dependabot leaves torch and react-native-webview alone by @tom-beeflow in #439
• Release gate: healthcheck wget stub marker back on line 2 by @tom-beeflow in #441

Full Changelog: v2026.10.23...v2026.10.28