4.9.0-rc.1

What's Changed

• fix: derive organizationId from resources in server actions to prevent cross-org IDOR by @bakabaka91 in #7409
• fix: fixes race between setUserId and trigger by @pandeymangg in #7498
• fix: pre-strip style attributes before DOMPurify to prevent CSP violations by @Dhruwang in #7489
• feat: add enterprise license features table by @jobenjada in #7492
• fix: removes pino pretty from edge runtime by @pandeymangg in #7510
• fix: ensure at least one filter is required for segments by @jobenjada in #7503
• feat: add validation for custom survey closed message heading by @jobenjada in #7502
• fix: only allow URL in exact match URL by @jobenjada in #7505
• fix: mark various strings as translatable by @urbalazs in #7338
• fix: auto-expand multi-language card when toggle is enabled by @Dhruwang in #7504
• chore: forward customer state to chatwoot by @Dhruwang in #7518
• chore: change LINGO_API_KEY environment variable name by @urbalazs in #7521
• fix: sdk init issues by @pandeymangg in #7516
• fix: fixes the loading skeleton on workspaces/tags page and some sentry improvements by @pandeymangg in #7533
• fix: allow survey updation without followup access by @Dhruwang in #7528
• feat: enhance survey display in webhook row with limited visibility by @Dhruwang in #7535
• chore: Improve the webhook "Test Endpoint" feature by @xernobyl in #7527
• refactor: update CTA component styles and utility class groups by @Dhruwang in #7532
• feat: choice rotation by @Dhruwang in #7512
• feat: add V3 surveys API by @xernobyl in #7499
• fix: fixes welcome card logo removal bug by @pandeymangg in #7544
• feat: searchable dropdown by @Dhruwang in #7530
• fix: mark language selector tooltip as translatable by @urbalazs in #7520
• docs: update docs re multi-lang by @jobenjada in #7547
• fix: resolve high severity dependabot alerts by @mattinannt in #7551
• docs: clarify v2 contact API request body shapes (#1089) by @xernobyl in #7552
• fix: segment targeting "isNotIn" didnt work by @jobenjada in #7550
• fix: localize survey and app date rendering by @xernobyl in #7473
• feat: enhance segment activity summary and settings in segment modal by @jobenjada in #7553
• fix: resolve remaining dependabot alerts by @mattinannt in #7561
• fix: prevent session expiry during active use by @Dhruwang in #7558
• fix(web): add message for when JS is disabled (#7455) by @bharathkumar39293 in #7459
• fix: (Duplicate) prevent multi-language survey buttons from falling back to English by @Dhruwang in #7559
• fix: response table settings formatting by @Dhruwang in #7540
• feat: enhance welcome card to support video uploads and display #7491 by @aryanghugare in #7497
• fix: proper errors server side when resources are not found by @pandeymangg in #7571
• chore: add dev:setup script to generate .env and missing secrets by @mattinannt in #7555
• fix: use TTC data for reliable survey impression counting by @Dhruwang in #7572
• fix: translations for option types by @Dhruwang in #7576
• fix: handle 404 race condition in Stripe webhook reconciliation by @Dhruwang in #7584
• fix: prevent TypeError when checking for duplicate matrix labels by @cursor[bot] in #7579
• fix: scrolling behaviour to invalid questions by @Dhruwang in #7573
• fix: duplicate org creation by @Dhruwang in #7593
• fix: prevent duplicate hobby subscriptions from race condition by @Dhruwang in #7597
• feat: add Estonian language support for surveys by @IllimarR in #7574
• feat: adds support for internal webhook urls by @pandeymangg in #7577
• fix: migrate auth sessions to database-backed storage by @BhagyaAmarasinghe in #7594
• fix: prevent auto-save from overwriting survey status during publish by @Dhruwang in #7618
• fix: sync segment state after auto-save to prevent stale reference on publish by @pandeymangg in #7619
• fix: resolve language code case mismatch in link survey rendering by @Dhruwang in #7624
• revert: remove fake-door workflows experiment (#7392) by @jobenjada in #7631
• feat: split AI toggle into smart tools and data analysis settings by @Dhruwang in #7563
• fix: correct CSAT template option order for question 2 by @jobenjada in #7636
• feat: Make password reset links single-use and revocable by @xernobyl in #7627
• docs: add German README summary by @mattinannt in #7641
• chore: add Codex environment config by @mattinannt in #7589
• fix: adds formbricks instance on window by @pandeymangg in #7630
• fix: harden api error reporting for v2/v1 Sentry observability by @xernobyl in #7633
• fix: prevent language switch from breaking survey orientation and resetting language on auto-save by @Dhruwang in #7654
• fix: 7549 multilang button overflow by @jobenjada in #7656
• fix: multi-lang toggle covering arabic text by @jobenjada in #7657
• chore: Revoke all active sessions after password reset by @xernobyl in #7628
• fix: merge epic/improve-telemetry into main by @pandeymangg in #7666
• feat: Supporting different AI providers within Formbricks by @xernobyl in #7611
• feat: add envoy gateway helm bundle by @BhagyaAmarasinghe in #7686
• docs: remove spurious left-overs by @salim-b in #7690
• feat: custom posthog events by @pandeymangg in #7647
• fix: support OTEL host config for envoy telemetry by @BhagyaAmarasinghe in #7692
• fix: make navigation more user-friendly by @jobenjada in #7599
• feat: unifiy nav auth behaviour by @jobenjada in #7635
• fix: add TERMS_URL support to survey link footers by @nielskaspers in #7670
• fix: (duplicate) server error toast handling by @Dhruwang in #7701
• feat: support GKE Envoy ingress split with numeric ports and service annotations by @BhagyaAmarasinghe in #7704
• fix: handle internal server error toast behavior in create organization by @dingdyan in #7662
• feat: offline support for link surveys by @Dhruwang in #7694
• fix: Dutch translations for link survey footer (Privacy Policy, Imprint, Report Survey) by @xernobyl in #7707
• chore: Harden SSO account linking for existing email-based accounts by @xernobyl in #7702
• fix(api): return 409 Conflict instead of 500 when creating user with duplicate email by @Chronolapse411 in #7675
• fix: improve restricted ID validation toast with i18n support by @Dhruwang in #7703

New Contributors

• @bakabaka91 made their first contribution in #7409
• @aryanghugare made their first contribution in #7497
• @cursor[bot] made their first contribution in #7579
• @nielskaspers made their first contribution in #7670
• @dingdyan made their first contribution in #7662
• @Chronolapse411 made their first contribution in #7675

Full Changelog: 4.8.0...4.9.0-rc.1