Features
- feat(scheduled-tasks): migrate jobs agent to scheduled tasks agent (#5090)
- feat(google-calendar): wire freebusy, align tools with API v3, add calendar + sharing tools (#5084)
- feat(feature-flags): migrate 3 env-flags to AppConfig-backed runtime flags (#5086)
- feat(grafana): validate integration and add folder, health, and contact-point tools (#5082)
- feat(feature-flags): AppConfig-backed gated feature flags (#5059)
- feat(ci): mship companion pr check (#5079)
- feat(db): zero-downtime migration safety lint + db-migrate skill (#5041)
- feat(auth): OAuth-only signup with Microsoft provider (#5073)
- feat(jsm): add Atlassian Assets (Insight/CMDB) tools for asset management (#5072)
- feat(copilot): server-side mothership tool/vfs/file metrics (#5071)
Improvements
- improvement(perm-groups): allow workspace filter for permission groups (#5070)
- refactor(connectors): split client metadata from server runtime (#5076)
- improvement(ci): fix companion regex (#5083)
- improvement(ci): rename companion tags to be more descriptive (#5081)
- refactor(table): split the 5.3k-line service.ts god-file into per-concern modules (#5069)
Bug Fixes
- fix(scheduled-tasks): fix scheduled tasks schema validation (#5091)
- fix(providers): allow HTTP for self-hosted vLLM endpoints (#5078)
- fix(providers): pin vLLM provider endpoint to validated IP (#5077)
- fix(webhooks): cap request body size on public webhook receivers (#5075)
- fix(uploads): authorize internal file URLs before download (#5049)
- fix(credential-sets): stop leaking open-invite tokens to all users (#5074)
- fix(providers): pin Azure OpenAI/Anthropic endpoints to validated IP (#5060)
- fix(execute): reject only cross-site session execution (CSRF guard) (#5068)
Other Changes
- chore(deps): bump js-yaml to 4.2.0 and nodemailer to 8.0.9 in apps/sim (#5067)
Contributors
Contributors
icecrasher321, TheodoreSpeaks, and 2 other contributors