5.2.0

What's Changed

🚀 Features

• feat: add dynamic pricing tooltip to billing plan cards by @jobenjada in #8247
• feat: add optional bundled qwen helm runtime by @BhagyaAmarasinghe in #8275
• feat: add taxonomy explorer UI by @BhagyaAmarasinghe in #8265
• feat: add docker qwen taxonomy setup by @BhagyaAmarasinghe in #8286
• feat(charts): side-by-side chart builder with reactive live preview by @jobenjada in #8262
• feat: cardless link surveys by @jobenjada in #8273
• feat(teams): gate bulk invite behind Scale plan and rate-limit invites by @Dhruwang in #8331
• feat: support Vertex Gemini taxonomy config by @BhagyaAmarasinghe in #8333
• feat: support app surveys in the v3 Surveys API by @xernobyl in #8307
• feat: prioritize last used login method on login page by @jobenjada in #8315
• feat(surveys): add status controls to survey list context menu [ENG-969] by @Dhruwang in #8306
• feat: add edit action button in survey editor by @jobenjada in #8326
• feat(unify-feedback): display translated feedback record text by @Dhruwang in #8377
• feat(billing): confirm immediate-charge plan upgrades by @Dhruwang in #8388
• feat: lazy response detail modal on OpenTextSummary row click by @jobenjada in #8022
• feat(auth): migrate authentication from NextAuth to Better Auth [ENG-1054] by @xernobyl in #8384
• feat: add OAuth support for MCP server by @BhagyaAmarasinghe in #8406
• feat(i18n): validate i18n lockfile synchronization in scan-translations by @Dhruwang in #8423
• feat(invite): bulk CSV team assignment + UI alignment with contacts upload [ENG-1244][ENG-998] by @Dhruwang in #8280
• feat(unify-feedback): revamp Unify Feedback IA, sources & taxonomy gating by @jobenjada in #8419
• feat(surveys): generate 20 AI example responses instead of 10 by @jobenjada in #8459
• feat(unify-feedback): anchor FeedbackSource to directory-workspace assignment via composite FK by @xernobyl in #8434
• feat(charts): add sentiment and emotion fields to charts (ENG-1632) by @Dhruwang in #8436
• feat(unify-feedback): rework Topics & Subtopics on React Query + /api/v3 by @jobenjada in #8450
• feat(charts): add rating measures (ratingCount + ratingAverage) [ENG-1661] by @Dhruwang in #8444
• feat(editor): add bullet and numbered list buttons to the toolbar by @jobenjada in #8454
• feat: block personal email sign-ups on Formbricks Cloud by @xernobyl in #8451
• feat(survey-editor): group & color-code the Add Block question-type picker by @jobenjada in #8458
• feat(charts): backport chart and dashboard improvements [backport 5.2] by @itsjavi in #8564
• feat(charts): language-stable option grouping via value_id + canonical value_text [ENG-1673] (5.2 backport) by @Dhruwang in #8580

🐛 Fixes

• fix: "Add logo" link 404 [ENG-1281] by @Dhruwang in #8251
• fix: rating and CSAT smiley misaligned in single response card by @pandeymangg in #8252
• fix: AI translation marks complete without populating field [ENG-1286] by @Dhruwang in #8253
• fix: show failing env vars in validation errors by @xernobyl in #8245
• fix: repair MCP survey tool schemas by @BhagyaAmarasinghe in #8256
• fix: enforce action-aware role checks on storage routes by @Dhruwang in #8242
• fix: enforce surveys-exist guard on plan onboarding route [ENG-1290] by @Dhruwang in #8260
• fix: improve self-hosted AI generation stability by @BhagyaAmarasinghe in #8261
• fix: bump shell-quote to 1.8.4 [ENG-1302] by @itsjavi in #8266
• fix: clarify AI chart prompt errors by @xernobyl in #8248
• fix: allow conditional logic on CTA questions without external link by @Dhruwang in #8270
• fix: redact webhook signing secrets from management API responses by @Dhruwang in #8269
• fix: microcopy — split Setup/Login/Logout into Set up/Log in/Log out by @Dhruwang in #8272
• fix: always suggest white card background on Suggest colors by @jobenjada in #8284
• fix: restore Manage billing details button for custom and scale plans [ENG-1330] by @Dhruwang in #8287
• fix: create survey button overflows card boundary on survey creation page by @itsjavi in #8295
• fix(deps): patch Dependabot security advisories, consolidate pnpm overrides by @itsjavi in #8301
• fix: avoid undefined workspace redirect by @BhagyaAmarasinghe in #8300
• fix(follow-ups): pass explicit locale to getTranslate in worker by @Dhruwang in #8291
• fix(tags): treat duplicate tag-on-response as no-op [ENG-1272] by @Dhruwang in #8278
• fix(i18n): correct zh-Hant-TW translations and ICU placeholders [ENG-1056] by @Dhruwang in #8279
• fix: stub @formbricks/survey-ui/styles?inline during vitest runs by @Dhruwang in #8271
• fix(api/v2): scope organization user PATCH to authenticated org [ENG-1139] by @Dhruwang in #8310
• fix: restore backward compatibility for older mobile SDKs on the v5 client API by @pandeymangg in #8322
• fix: correct framework-guide field names and pnpm shared-lockfile key by @xernobyl in #8317
• fix(security): pin form-data to patched 4.0.5 (ENG-1513) by @Dhruwang in #8324
• fix(security): bump undici to 7.28.0 (ENG-1509, ENG-1505) by @Dhruwang in #8328
• fix(security): bump markdown-it and pin typeorm 0.3.29 by @BhagyaAmarasinghe in #8329
• fix(security): bump nodemailer to 9.0.1 (ENG-1511, ENG-1507) by @Dhruwang in #8327
• fix(onboarding): let org owners create their first workspace from the landing page by @Dhruwang in #8335
• fix: remediate container image vulnerabilities by @BhagyaAmarasinghe in #8350
• fix(auth): land invited users in the app after email verification [ENG-1527] by @Dhruwang in #8360
• fix(deps): close remaining Dependabot alert (js-yaml) + refresh dompurify pin by @Dhruwang in #8361
• fix(a11y): submit button steals keyboard tab order on every survey by @itsjavi in #8356
• fix: make otel log transport safe by @BhagyaAmarasinghe in #8319
• fix(surveys): identify ending cards by id instead of label in selectors [ENG-990] by @itsjavi in #8359
• fix: harden response queue IndexedDB handling by @BhagyaAmarasinghe in #8363
• fix: place Traefik labels on Formbricks service by @BhagyaAmarasinghe in #8364
• fix(surveys): allow pinch-zoom on mobile link surveys (WCAG 1.4.4) [ENG-1294] by @itsjavi in #8358
• fix: harden server-side validation on survey response submission by @xernobyl in #8368
• fix: support large CSV feedback source imports by @BhagyaAmarasinghe in #8369
• fix(ci): auto-close Linear tickets when Dependabot alerts resolve by @Dhruwang in #8362
• fix: localize survey logo alt text by @jobenjada in #8158
• fix: fix UI issues in feedback records csv upload [ENG-1503] by @pandeymangg in #8389
• fix: surface personal link segment errors by @jobenjada in #8062
• fix: complete SCA/3DS for upgrade payments and surface payment failures by @jobenjada in #8370
• fix: include missed language translation strings by @jobenjada in #7998
• fix: update dead XM & Surveys link on platform introduction page by @jobenjada in #8414
• fix(ai): surface Vertex 429 quota errors instead of failing silently by @Dhruwang in #8392
• fix: update dead xm-and-surveys doc links to new URLs by @jobenjada in #8413
• fix: persist endingId on natural survey finishes and create paths by @itsjavi in #8416
• fix: translations by @itsjavi in #8421
• fix: Canonicalization of legacy language codes by @pandeymangg in #8390
• fix(surveys): WCAG AA accessibility for the survey package [ENG-1345] by @itsjavi in #8365
• fix: drops responses from the response queue if they encounter a 400 error by @pandeymangg in #8379
• fix(charts): make filter equals case-insensitive and add value pickers (ENG-1565) by @Dhruwang in #8391
• fix: graceful GitHub release fetch with auth + fallback (ENG-1501) by @Dhruwang in #8397
• fix(deps): bump @tootallnate/once to fix GHSA-vpq2-c234-7xj6 (ENG-1379) by @Dhruwang in #8440
• fix: normalize signup email token creation by @BhagyaAmarasinghe in #8437
• fix: validate userId length before tearing down existing user by @pandeymangg in #8439
• fix(web): don't report "Organization not found" to Sentry on the landing page by @Dhruwang in #8383
• fix(survey-ui): scope Tailwind v4 global CSS to #fbjs to stop host-page pollution by @Dhruwang in #8378
• fix: prevent turbo cache from filling local disk space [ENG-1662] by @mattinannt in #8448
• fix(email): render embed rating stars as hosted PNG [ENG-1609] by @Dhruwang in #8445
• fix: prevent manager privilege escalation via v2 organization-users API [ENG-1518] by @pandeymangg in #8438
• fix: suppress Better Auth oauthAuthServerConfig warning by @xernobyl in #8447
• fix: reject scheme-relative callback URLs in login redirect [ENG-1636] by @xernobyl in #8462
• fix: mobile preview spreads Preview and Restart buttons across the editor [ENG-1533] by @itsjavi in #8465
• fix: multi-language responses split select options into per-language categories (ENG-1566) by @Dhruwang in #8441
• fix: enforce workspace scoping when generating personal survey links [ENG-1635] by @pandeymangg in #8468
• fix(surveys): return 400 instead of 500 for invalid survey image URLs [ENG-1329] by @pandeymangg in #8457
• fix: correct survey language switcher dropdown background (ENG-1701) by @Dhruwang in #8470
• fix(surveys): standalone Conditional Logic section + unified jump-to dropdown (ENG-1328) by @jobenjada in #8443
• fix(link-surveys): make footer links & suggested colors WCAG AA compliant by @jobenjada in #8442
• fix(a11y): respect prefers-reduced-motion globally in the web app by @itsjavi in #8473
• fix(survey-ui): meet WCAG AA contrast on date picker today cell by @Dhruwang in #8480
• fix: preserve current workspace when navigating to org settings (ENG-1700) by @Dhruwang in #8471
• fix(ui): contain Radix form-bubble inputs inside Switch and Checkbox roots by @itsjavi in #8477
• fix(i18n): keep main-nav category names in English across all locales by @jobenjada in #8485
• fix(api): let organization-only API keys reach organization endpoints by @jobenjada in #8489
• fix(surveys): keep "Generate responses" action visible but disabled when responses exist by @jobenjada in #8488
• fix: auto-login after email verification (ENG-1746) by @xernobyl in #8494
• fix(docs): init Formbricks embed on script onload instead of fixed timeout by @Dhruwang in #8481
• fix: let MCP clients request surveys:write and correct validate_survey scope (5.2 backport) by @xernobyl in #8510
• fix(web): only set workspace cookie on change to stop action refresh loop (backport #8513 → 5.2) by @Dhruwang in #8515
• fix: prevent infinite re-render loop when authenticated actions refresh the route (backport #8507 → 5.2) by @Dhruwang in #8517
• fix(api-keys): stop truncating the org-access note in the API key modal (backport #8519 → 5.2) by @Dhruwang in #8521
• fix(ui): keep InputCombobox chevron right-aligned when the dropdown is empty (backport #8520 → 5.2) by @Dhruwang in #8522
• fix: [Backport] fixes infinite re render for auth actions by @pandeymangg in #8529
• fix: verify password against the credential account for email change and 2FA (5.2 backport) by @xernobyl in #8538
• fix(billing): refresh plan state after a successful upgrade (ENG-1790) [backport 5.2] by @Dhruwang in #8535
• fix(charts): [5.2 backport] correct rating measure labels and stale "Run Query" empty-state copy by @itsjavi in #8552
• fix(api): reject publishing an app survey with zero triggers (5.2 backport) (#8547) by @pandeymangg in #8554
• fix(helm): wait for PostgreSQL before migrations (5.2 backport) (#8550) by @Dhruwang in #8556
• fix: header-only CSV crash in Unify source creation (ENG-1799) (backport #8533) by @xernobyl in #8555
• fix(docker): validate environment before migrations (backport #8551) [5.2] by @Dhruwang in #8558
• fix(account): redirect SSO account deletion to the post-deletion survey (ENG-1780) [backport 5.2] by @Dhruwang in #8531
• fix: return 409 for duplicate creates under the Prisma 7 driver adapter (ENG-1801) [5.2 backport] by @xernobyl in #8572
• fix(sso): stop requiring RFC 9207 issuer param for Azure (ENG-1800) [backport 5.2] by @xernobyl in #8562
• fix: sync Better Auth TwoFactor table so 2FA login works after enabling (5.2 backport) by @xernobyl in #8560
• fix(api): allow displayLimit recontact + independent displayPercentage in v3 surveys (5.2 backport) (#8537) by @pandeymangg in #8571
• fix(unify): disable active write controls for read-only members on Feedback Data (5.2 backport) (#8570) by @pandeymangg in #8573
• fix(auth): read the correct field from the OAuth consent response (MCP) [backport 5.2] by @xernobyl in #8576
• fix(surveys): survey player a11y — screen-reader semantics, WCAG keyboard/focus model, visual polish [backport 5.2] by @itsjavi in #8581
• fix(taxonomy): make failed runs actionable and recoverable (5.2 backport) (#8582) by @pandeymangg in #8586
• fix: correct Helm release image validation (5.2 backport) by @Dhruwang in #8590

🔧 Refactors

• refactor(surveys): migrate template-based survey creation to API v3 by @itsjavi in #8219
• refactor: fix vulnerable dependencies for tar and form-data by @itsjavi in #8343
• refactor(settings): scope organization & account settings to their own routes by @Dhruwang in #8342
• refactor(web): migrate apps/web from Tailwind CSS v3 to v4 (ENG-1053) by @Dhruwang in #8325
• refactor: simplify ai survey dialog by @itsjavi in #8422
• refactor(navigation): dedupe org/workspace switcher into useSwitcherData by @Dhruwang in #8347

⚡ Performance

• perf(turbo): move runtime-only env vars to passThroughEnv [ENG-1663] by @mattinannt in #8449

📚 Docs

• docs: document RustFS server-level CORS for self-hosted file uploads by @xernobyl in #8294
• docs(api/v3): split the v3 OpenAPI spec into a multi-file source by @xernobyl in #8311
• docs: update Docker self-hosting setup guide by @BhagyaAmarasinghe in #8313
• docs: add LLM copy options by @harshsbhat in #8354
• docs: reduce Community Edition workspace limit to 1 by @jobenjada in #8409
• docs: add user-facing MCP OAuth setup guides for Claude and Codex by @xernobyl in #8412
• docs: update settings navigation references for Formbricks 5.0 by @harshsbhat in #8482
• docs(api-keys): clarify workspace vs organization access scopes by @jobenjada in #8490

✅ Tests

• test: add taxonomy permission action coverage by @BhagyaAmarasinghe in #8386

⚙️ CI

• ci(auth): skip Better Auth integration suite when the harness is absent by @xernobyl in #8402
• ci: bump sonarqube-scan-action to v8.2.0 (fix Java 17 deprecation) by @xernobyl in #8460

🧹 Chores

• chore(deps): bump hono to 4.12.25 [ENG-1264][ENG-1265][ENG-1266][ENG-1267] by @Dhruwang in #8276
• chore(deps): bump protobufjs@8 to 8.6.3 [ENG-1446] by @Dhruwang in #8297
• chore: adds docs for flutter sdk support by @pandeymangg in #8289
• chore: migrate to pnpm 11 using codemod by @itsjavi in #8303
• chore(deps): bump @grpc/grpc-js to 1.14.4 [ENG-1324][ENG-1325] by @Dhruwang in #8277
• chore: update hub to 0.6.0 by @xernobyl in #8298
• chore(analytics): add PostHog backend events for AI survey creation an… by @harshsbhat in #8334
• chore(experiments): Remove trial banner button and create new A/B exp… by @harshsbhat in #8396
• chore(auth): capture page/UTM/source attribution on signup & login by @harshsbhat in #8398
• chore: A/B experiments — trial-ending popup, 250-only response info, app-connection toggle, hideable templates by @harshsbhat in #8346
• chore: Add lite license for free remove branding by @harshsbhat in #8191
• chore: integrate playwright axe for a11y e2e tests by @itsjavi in #8372
• chore: update Helm app version to 5.0.2 by @github-actions[bot] in #8197
• chore(billing): Contact Sales card + A/B experiments (subscription/usage redesign & plan comparison table) by @harshsbhat in #8432
• chore: move Next.js docs index from AGENTS.md into nextjs-docs agent skill by @itsjavi in #8467
• chore: Add email confirmed posthog event by @harshsbhat in #8484
• chore(billing): emit paid-subscription lifecycle events to PostHog by @harshsbhat in #8475
• chore: load root .env in lingo.dev i18n:generate scripts by @itsjavi in #8476
• chore: dogfood in-app Formbricks surveys, code-action triggers & What's New panel by @harshsbhat in #8435
• chore(auth): identify user in PostHog on sign-up by @harshsbhat in #8495

Full Changelog: 5.1.4...5.2.0