v5.1.0

What's Changed

• feat: support richer token cost tracking for ask by @jsourcebot in #1353
• fix(web): change version banner copy from "Upgrade" to "Update" by @msukkari in #1354
• docs: clarify Yarn setup for contributors by @royalpinto007 in #1358
• fix: add pcre2 and libyaml to macos install script by @dsabsay in #1360
• fix(web): send anonymous PostHog events as personless by @brendan-kellam in #1367
• Improve token caching. by @jsourcebot in #1366
• Visualize context window usage in Ask Sourcebot by @jsourcebot in #1370
• refactor(web): normalize Ask user message text extraction by @whoisthey in #1371
• feat(web): render mermaid diagrams in Ask answers by @whoisthey in #1369
• chore(web): mermaid followups by @whoisthey in #1373
• refactor(web): resolve language model capabilities from models.dev by @whoisthey in #1372
• fix(backend): pass zoekt index args without shell by @brendan-kellam in #1376
• fix(web): verify review webhook deliveries by @brendan-kellam in #1378
• Add OpenAPI generation workflow by @brendan-kellam in #1398
• Allow DPoP-bound OAuth access tokens by @brendan-kellam in #1395
• ci: enforce prisma migration ordering and schema drift by @brendan-kellam in #1400
• feat(web): text file attachments for Ask by @whoisthey in #1374
• feat(web): binary file attachments for Ask by @whoisthey in #1375
• chore(web): Validate OAuth scopes for MCP access by @brendan-kellam in #1396
• fix(web): add HTTP security headers to all responses by @msukkari in #1407
• feat: add SCIM 2.0 user provisioning (EE) by @brendan-kellam in #1306
• chore: make backend worker API URL configurable via WORKER_API_URL by @brendan-kellam in #1409
• chore: upgrade nodemailer to ^9.0.1 to address GHSA-p6gq-j5cr-w38f by @linear-code[bot] in #1356
• chore: bump vendor/zoekt to upgrade golang.org/x/net and golang.org/x/crypto (CVEs) by @brendan-kellam in #1412
• fix(web): maintain sidebar scroll position when navigating between chats by @brendan-kellam in #1411
• chore: upgrade @opentelemetry/core to ^2.8.0 to address CVE-2026-54285 by @brendan-kellam in #1413
• Jminnetian/fix connector scrolling by @jsourcebot in #1418
• feat(setupWizard): add reo by @msukkari in #1419
• fix(ci): pass --no-workspaces-update to npm version in setup-sourcebot release by @msukkari in #1420
• fix(setupWizard): add repository field for npm publish provenance by @msukkari in #1421
• fix(ci): map @react-grab and element-source licenses to MIT in license audit by @msukkari in #1422
• feat(web): add deployment system stats to service ping by @brendan-kellam in #1424
• feat(web): guard EE user deletion behind SCIM and unify user API shape by @brendan-kellam in #1425
• fix(backend): handle Gitea ERR_STREAM_PREMATURE_CLOSE during sync by @brendan-kellam in #1405
• feat(web): fetch /browse data client-side and disallow crawlers via robots.txt by @brendan-kellam in #1426
• chore(ci): Add cloud ci by @brendan-kellam in #1429
• docs: point Docker image references at docker.sourcebot.dev by @msukkari in #1430
• feat(web): enable Sentry node and browser profiling by @brendan-kellam in #1431
• feat: show not-found UI when an Ask GitHub repo doesn't exist by @brendan-kellam in #1432
• Jminnetian/askskills by @jsourcebot in #1410
• Jminnetian/sanitize tool names by @jsourcebot in #1423

New Contributors

• @royalpinto007 made their first contribution in #1358
• @dsabsay made their first contribution in #1360

Full Changelog: v5.0.4...v5.1.0