6.0.2

What's Changed

• fix(docker): ship a slim Cube image without known CVEs [ENG-3431] (backport #9457 to release/6.0) by @BhagyaAmarasinghe in #9487
• fix(helm): run Cube with a read-only root filesystem and no capabilities (backport #9461 to release/6.0) by @BhagyaAmarasinghe in #9488
• fix(security): bump next to 16.3.6 for GHSA-vcvr-r3jv-pc5j (backport #9478 to release/6.0) by @Dhruwang in #9482

Full Changelog: 6.0.1...6.0.2

5.4.5

What's Changed

• fix(helm): run Cube with a read-only root filesystem and no capabilities (backport #9461 to release/5.4) by @BhagyaAmarasinghe in #9490
• fix(docker): ship a slim Cube image without known CVEs [ENG-3431] (backport #9457 to release/5.4) by @BhagyaAmarasinghe in #9489
• fix(security): bump next to 16.3.6 for GHSA-vcvr-r3jv-pc5j (backport #9478 to release/5.4) by @Dhruwang in #9483

Full Changelog: 5.4.4...5.4.5

6.0.1

What's Changed

• fix(helm): make v6 upgrades safer for self-hosters (backport 6.0) by @BhagyaAmarasinghe in #9340
• docs: add release and maintenance policy page (backport #9273 to release/6.0) by @Dhruwang in #9341
• fix: replace MinIO client with RustFS CLI (backport #9395 to release/6.0) by @mattinannt in #9436
• fix(web): require Manage access to change survey custom head scripts (backport #9432 to release/6.0) by @mattinannt in #9434

🔒 Security credits

Thanks to the following researchers, who reported issues fixed in this release through
responsible disclosure:

• Credit: Grzegorz Szymon Tworek (F3715H) - grzegorz.tworek@sec4check.pl
  Reported missing permission checks allowing unauthorized changes to survey custom head scripts (#9432).

Full Changelog: 6.0.0...6.0.1

5.4.4

What's Changed

• fix: replace MinIO client with RustFS CLI (backport #9395 to release/5.4) by @mattinannt in #9437
• fix(web): require Manage access to change survey custom head scripts (backport #9432 to release/5.4) by @mattinannt in #9435

🔒 Security credits

Thanks to the following researchers, who reported issues fixed in this release through
responsible disclosure:

• Credit: Grzegorz Szymon Tworek (F3715H) - grzegorz.tworek@sec4check.pl
  Reported missing permission checks allowing unauthorized changes to survey custom head scripts (#9432).

Full Changelog: 5.4.3...5.4.4

5.4.3

What's Changed

• fix(ci): pull the MinIO images from quay.io instead of Docker Hub (backport #9260 to release/5.4) by @xernobyl in #9262
• fix(security): bump next to 16.3.3 for two critical RCE advisories (backport #9225 to release/5.4) by @xernobyl in #9266
• fix(responses): bound the "Other" response filter instead of permuting every subset (backport #9253 to release/5.4) by @xernobyl in #9256
• fix(helm): support Gateway API v1.5 clusters (backport #9291 to release/5.4) by @BhagyaAmarasinghe in #9293

🔒 Security credits

Thanks to the following researchers, who reported issues fixed in this release through
responsible disclosure:

• Arthur Chan (Ada Logics), with credit owed to Google and Ada Logics — the response filter on "Other" built every permutation of every subset and aborted the Node process (#9256)

Full Changelog: 5.4.2...5.4.3

6.0.0

Overview

Formbricks 6.0 replaces the legacy authorization evaluator with AuthZed SpiceDB and ships Embedded Data V1. SpiceDB is now the sole authorization decision engine, with no runtime fallback, so a self-hosted upgrade runs inside a maintenance window and prepares its authorization graph before serving traffic.

Self-hosted installations upgrade directly from a supported v5 version — no bridge release is required. Follow Upgrade to Formbricks v6 for the procedure and Migration → v6 for the configuration changes. Tested upgrade pair for this release: — do not upgrade from a pair that is not listed here.

Under the release and maintenance policy, the 6.0 minor receives bug fixes and security fixes until 21 December 2026. After that date it receives no further fixes; move to a newer minor before then.

⚠️ Breaking changes

The upgrade procedure, prerequisites and rollback all live in Upgrade to Formbricks v6 and Migration → v6. Read those before you pull a 6.0 image. This list is the index of what changes, not the procedure.

Self-hosted deployment

• AuthZed SpiceDB is a required dependency and the sole authorization engine; protected operations fail closed when it is unavailable (#9089).
• Upgrades require explicit maintenance preparation; missing, disabled or weaker-consistency AuthZed settings now block server startup (#9280).
• Production Compose requires its own POSTGRES_PASSWORD instead of the shared postgres password (#8900).
• Bundled PostgreSQL overrides are respected: app and SpiceDB follow the effective endpoint, role and database, so PVC-backed installs with a custom postgresql.auth.username / .database must provision and migrate first (#9279).
• Bundled Envoy CRDs move to Gateway API v1.5.1 (apply v1.8.4 CRDs first), and Envoy pod overrides move from envoy.deployment.envoyGateway.pod to envoy.deployment.pod (#9292).
• Taxonomy deployments must declare taxonomy.llm.contextWindowTokens, select a bundled model when several are enabled, complete their provider wiring, and move reliability settings from raw taxonomy.env / hub.env keys to the named fields; the selected-record cap default drops from 50,000 to 10,000 (#8954).
• DEFAULT_ORGANIZATION_ID and DEFAULT_ORGANIZATION_ROLE are renamed to AUTH_SSO_DEFAULT_ORGANIZATION_ID and AUTH_SSO_DEFAULT_ORGANIZATION_ROLE. Values are unchanged, and both are Enterprise SSO just-in-time provisioning only (#9157).

API and SDK contract

• GET /api/v3/surveys: meta.hasArchived is replaced by meta.workspaceSurveyCount. On an unfiltered request, hasArchived === true becomes workspaceSurveyCount > totalCount (#8964).
• isSingleResponsePerEmailEnabled is removed from the Survey resource on Management API v1 and v2. It never enforced anything server-side, so only the field references need removing (#8975).
• POST /api/v3/surveys returns 422 with invalid_params instead of 500 when a body passes the request schema but fails the write schema (#8991).
• Contact-attribute-key management endpoints on v1 and v2 now return 403 for organizations without the contacts entitlement. Entitled organizations see no change (#8955).
• New declared embedded-data fields must match ^[a-z][a-z0-9_]*$, avoid reserved names (country, lang, …) and not collide across variables and hidden fields; existing names re-save unchanged. Response exports now use Title Case metadata headers, the full reserved catalog and numeric values (#9219).

Changed defaults and limits

• Workspaces per organization drop from 3 to 1 without an Enterprise license, and while a Cloud license cannot be confirmed. Existing workspaces stay accessible; only creating another is blocked (#9008).
• The organization invite quota becomes 50 recipients per organization per day, replacing 20 single invites plus 20 bulk operations (#9182).
• When Redis rejects a session read, the request falls back to PostgreSQL and succeeds instead of returning 500 FAILED_TO_GET_SESSION. Update alerts that expect the 500 (#9125).

Coming from 5.3 or earlier

• The bundled Valkey image moved from the Debian Valkey 8.1.1 amd64 child digest to the Alpine Valkey 8.1.9 multi-architecture index. This already shipped in 5.4.0, so it is only new to you if you are upgrading from 5.3 or earlier (#8986).

What's Changed

🚀 Features

• feat: add enrichment status indicator for feedback records by @Dhruwang in #8845
• feat(helm): support Hub workload scheduling by @BhagyaAmarasinghe in #8992
• feat: group question type by category in the block dropdowns (ENG-1777) by @jobenjada in #8979
• feat(helm): configure reliable taxonomy generation by @BhagyaAmarasinghe in #8954
• feat: lower unlicensed self-hosted workspace cap to 1 by @mattinannt in #9008
• feat(navigation): rename Unify to Analyze and badge Act as Beta (ENG-2742) by @jobenjada in #9020
• feat(observability): record the outcome of every SSO callback by @xernobyl in #9026
• feat: add Formbricks logo to MCP OAuth consent page by @jobenjada in #8960
• feat: cut authorization over to AuthZed by @BhagyaAmarasinghe in #9089
• feat(unify): add "Re-import historic data" to Formbricks survey sources by @Dhruwang in #8987
• feat(auth): make the signed-out screens work on a phone by @itsjavi in #9074
• feat: let creators name survey blocks by @Dhruwang in #9103
• feat: pipe response and survey context into feedback record metadata by @xernobyl in #9111
• feat: allow hiding the default checkmark icon on ending cards (ENG-1787) by @Dhruwang in #9083
• feat(ai): add an AI UI kit and stream survey generation (ENG-1248) by @itsjavi in #9027
• feat: add Khmer and Nepali survey interface translations by @Dhruwang in #9117
• feat(charts): chart on the response context stored in record metadata [ENG-1555] by @Dhruwang in #9134
• feat(sso): sync the IdP display name on every sign-in, and lock the name field for SSO users by @mattinannt in #9104
• feat(charts): split chart creation into AI and manual entry points (ENG-2782) by @itsjavi in #9071
• feat(surveys): stop new follow-ups where Workflows can replace them by @jobenjada in #8983
• feat(ai): unify the disabled AI smart tools prompt by @jobenjada in #9031
• feat: download all response attachments as a ZIP by @Dhruwang in #9109
• feat: relative date range validation for date questions by @Dhruwang in #9107
• feat(surveys): mirror widget placement for right-to-left languages by @jobenjada in #8977
• feat(workflows): report workflow usage to PostHog on cloud and to usage telemetry when self-hosted by @itsjavi in #9146
• feat: set the language new surveys are created in per workspace by @Dhruwang in #9122
• feat(surveys): add Rename to the survey list context menu by @Dhruwang in #9177
• feat(embedded-data): Embedded Data V1 — reserved fields, setEmbeddedData(), lifecycle events, typed exports by @pandeymangg in #9219
• feat: limit organization invite recipients per day by @BhagyaAmarasinghe in #9182
• feat(ai): apply the AI UI kit to example responses and taxonomy generation [ENG-3112] by @itsjavi in #9220
• feat: add explicit AuthZed maintenance preparation (backport #9265 to release/6.0) by @Dhruwang in #9280

🐛 Fixes

• fix(sso): write the canonical Account.issuer so Google sign-in stops looping...

6.0.0-rc.5

What's Changed

• fix(helm): backport Envoy review safeguards to 6.0 by @BhagyaAmarasinghe in #9295

Full Changelog: 6.0.0-rc.4...6.0.0-rc.5

6.0.0-rc.4

What's Changed

• fix(helm): support Gateway API v1.5 clusters (backport #9291 to release/6.0) by @BhagyaAmarasinghe in #9292

Full Changelog: 6.0.0-rc.3...6.0.0-rc.4

6.0.0-rc.3

What's Changed

• fix(ci): pull the MinIO images from quay.io instead of Docker Hub (backport #9260 to release/6.0) by @xernobyl in #9263
• fix(i18n): update Hungarian translations (backport #9234 to release/6.0) by @Dhruwang in #9261
• fix(survey-editor): stop a disabled unit select covering the rule delete button (backport #9250 to release/6.0) by @Dhruwang in #9264
• chore: A/B test shortening the Pro trial from 14 to 7 days (backport #9224 to release/6.0) by @Dhruwang in #9269
• fix(analysis): partition NPS and CSAT buckets exhaustively (backport #9248 to release/6.0) by @Dhruwang in #9268
• fix(ui): cap combobox option list inside its popover (backport #9243 to release/6.0) by @Dhruwang in #9270
• fix(survey-link): stop a mounted gate fighting the language picker (backport #9246 to release/6.0) by @Dhruwang in #9271
• fix(charts): drop grouped rows no selected measure answers (backport #9239 to release/6.0) by @Dhruwang in #9272
• fix(charts): keep one category label treatment on flipped bar charts (backport #9240 to release/6.0) by @Dhruwang in #9277
• feat: add explicit AuthZed maintenance preparation (backport #9265 to release/6.0) by @Dhruwang in #9280
• fix: respect PostgreSQL Helm overrides (backport #9221 to release/6.0) by @Dhruwang in #9279
• fix(charts): resolve option labels from every mapped question (backport #9235 to release/6.0) by @Dhruwang in #9278
• docs: clarify Kubernetes v6 maintenance upgrades (backport #9282 to release/6.0) by @BhagyaAmarasinghe in #9283
• fix(responses): bound the "Other" response filter instead of permuting every subset (backport #9253 to release/6.0) by @xernobyl in #9255

Full Changelog: 6.0.0-rc.2...6.0.0-rc.3

6.0.0-rc.2

What's Changed

• fix: terminate AuthZed health CLI after failures (backport #9232 to release/6.0) by @Dhruwang in #9233

Full Changelog: 6.0.0-rc.1...6.0.0-rc.2