Back to the changelog

• Security

  Stronger sign-in security

  Logging out now closes every open web session, not just the one you're closing from; the browser extension stays linked. Every web session also has a maximum duration, after which you need to sign in again, and it can't be worked around by switching between organizations or moving in and out of impersonation: none of these steps ever restarts the count, so a session can't be stretched indefinitely by chaining them. Sessions created while impersonating another account or switching between organizations still have a tighter limit of their own. Revoking an administrative privilege now takes effect almost immediately, not only at the next sign-in. And a two-factor verification code can no longer be reused, while too many wrong attempts lock the current sign-in attempt.

• Security

  Stronger security for automations and alerts

  Requests to a flow's trigger endpoint and to agent tools now have a real, unavoidable rate limit: an automation can no longer generate unlimited traffic. Webhook alerts no longer expose secrets and headers in API responses, and a bug that prevented an alert with authentication headers from actually sending them has been fixed. A password reset performed by an administrator is now logged, and the affected user receives an email notification. Emails sent by a flow's automated scripts also now stay within your organization, with a cap on how many can be sent; reassigning an item from a script now checks that the recipient is an active user in your organization.

• Security

  Safer extension linking

  The web session opened from the extension now respects two-factor verification: if you enabled protection after linking the extension, a single reconfirmation from Settings is enough. A link token copied and opened in a different browser no longer creates a session. And each user can have at most 10 active links: beyond that, the oldest one is automatically deactivated. The extension's link is managed as its own separate credential from your web session: signing out of the app in your browser no longer disconnects it. Changing your password — or a reset performed by an administrator — always disconnects the extension on every device instead, because that's a genuine security event. The same applies to enabling two-factor verification: if you had linked the extension before turning it on, that link gets disconnected and needs to be recreated from Settings.

• Feature

  The extension renews itself

  The browser extension's link (valid for 90 days) now renews itself in the background shortly before it expires, with no action needed from you — including for links you already had. If a renewal response gets lost to a brief network hiccup, the link still stays valid for a few extra minutes, so a transient glitch won't disconnect you. If renewal isn't possible, a notice appears — now in the side panel too, not just the popup — with a single click to reconnect. The extension also speaks Italian or English based on your browser language — not just in the popup and side panel, but also on the Options page and in the notices shown directly on web pages — and errors now show in a dedicated panel instead of a separate pop-up window.

• Design

  More solid Webhook tasks

  A Webhook task without a connector is now checked as soon as you save, duplicate, import or publish it: an unsupported method, an unsafe address or badly formed headers are flagged right away, not only on the first real call. When a webhook call's body is in JSON format, the dynamic values you insert are now automatically converted into the correct form, so quotes or special characters in your data no longer break the request; if the resulting body still isn't valid JSON, the task stops with a clear error instead of accidentally sending the entire item as the payload. A plain-text body that starts with an expression (for example "{{item.data.name}} — case {{item.title}}") still works normally as free text, without being mistakenly treated as JSON.

• Design

  A more comfortable expression editor

  The field that shows an expression's resolved value now sizes itself to the real content — especially useful for single-line JSON in a webhook body or an event payload — and the cursor now always lands at the end of the text when you reopen the field to edit it. And when the list of available expressions is long, such as for a Document field, a search box at the top of the menu helps you find the one you need right away, even from the keyboard alone.

• Design

  A clearer publish dialog

  The publish dialog now immediately shows any warnings for the flow, each with a direct link to the status involved, and a publish error now stays visible until you resolve it, instead of disappearing on its own after a few seconds. The same direct link to the status now also appears for a misconfigured Webhook or Wait task; a Wait task without a valid duration blocks publishing, and if an already-published item still runs into one, the task now fails immediately with a clear message instead of silently waiting a minute. And if you try to import a flow file in a format that's no longer supported, the message clearly tells you to export it again from the current version.

• Design

  Safer confirmations for irreversible actions

  Deleting an item now requires typing its title to confirm, instead of a simple click on a generic browser dialog. Publishing or disabling a flow, deleting a version, or archiving a flow all go through the same confirmation dialog, with a more distinct look for truly irreversible actions compared to merely destructive ones. And accidentally closing a task's or a new process's window by clicking outside it, with unsaved changes, no longer loses your work: an explicit confirmation is now required.

• Feature

  New “My pending tasks” dashboard widget

  The dashboard for people working on items (Operator and Read-only roles) now shows a widget with their own pending tasks, each with a direct link. The Tasks page now starts filtered to "Pending" on first visit instead of showing the full list, and remembers whichever filter you pick afterwards. And when a new task is assigned to you, a pop-up notification also appears with a button that opens it right away.

• Improvement

  A more consistent, more readable interface

  The task, start-process, transition and quick-view windows now handle focus and keyboard navigation (including Esc) the same way, instead of each behaving differently. Informational text — empty states, "load more", summary messages — is now easier to read on Tasks, Items and the Flow detail page. And a few pieces of text that stayed fixed in Italian, including on the Help page, now follow your chosen language.

• Improvement

  A more responsive, more accessible Kanban

  Moving a card in the Kanban board now updates the view immediately, with automatic rollback and a warning if the server rejects the transition. Drag-and-drop is now also usable from the keyboard, with an announcement for screen reader users.

• Improvement

  Honest failed tasks on already-completed items

  A Failed task whose item is already completed no longer offers impossible actions: instead of Retry, Skip and Resolve buttons, you now see a note explaining why they aren't available. And if the server still rejects a save attempt, the message explains the actual reason instead of the generic "An error occurred".

• Improvement

  More complete event analytics

  The summary cards on the Events page now always add up to the period's total: previously an event with a "Partial delivery", "No effect" or "Pending" outcome could look like it had vanished. The "Failed" card is still there but labeled as a technical status, distinct from delivery outcomes, and the "Pending" card now includes a clarification of what it means and, when relevant, a count of how many have been pending for over an hour.

• Security

  Confidential document text stays protected everywhere

  A Library document not enabled for AI agents no longer exposes its extracted text through any automation: the protection previously only covered agent tools, but a template in a Webhook task's body, an event's payload, or an AI task's prompt could still read it. The document's name, link and size remain always visible; the full text stays readable only by opening the document in the viewer.

• Improvement

  Documents recognized in more formats, a more stable Library

  A file declared with an alternative type name (for example an old PDF alias) or with an extra parameter in its type is now recognized correctly, both for deciding whether to show a preview and when checking it at upload time: previously one of these cases would always fall back to download even when the format was supported. The Library also stays stable even with hundreds of documents uploaded at once: the listing no longer loses or duplicates rows when moving from one page to the next.

• Improvement

  Faster to load, snappier lists

  The app's first load now downloads a fraction of what it used to, with a noticeable benefit on slower connections; for anyone using a browser in a language other than Italian, the page now waits to show the right text instead of briefly flashing Italian first. Item and task lists load faster for people with a lot of history, and the analytics pages and dashboard also retrieve history more quickly.

• Improvement

  Underlying platform update

  The base libraries that power FlowSharp have been updated to their latest stable versions, including a number of security fixes. The interface's navigation engine has been renewed without changing how you use the app, and the internal queueing system that manages scheduled activities is now more resilient: a configuration problem on a single scheduled activity no longer blocks the others. For those running a self-hosted installation, infrastructure components now reference explicit versions instead of generic references that could drift on their own over time.