v0.87.1
September 10, 2026
**Security polish after 0.87.0:** webhook JSON bodies no longer have template forms that escape protection and every configuration error shows up right away, the browser extension can no longer mix up two connections, and automatic alerts never go out without their configured credentials.
-
Security
Webhook JSON bodies: every template form protected
The JSON body of a Webhook task is now read with Handlebars' own grammar: conditions, loops with separators, helpers with arguments, inverse blocks and whitespace control are recognised and protected, and a value can never create new properties in the JSON sent. A free-text body starting with a block now works. An unsupported form or a template error fails the task with a clear message, without retries and without leaving it hanging. The guide lists the supported syntax.
-
Security
Extension: never a stale response on a new connection
If you reconnect the extension while an earlier request is still in flight, the late response can no longer overwrite the new connection: every write checks it is still the expected one. This applies to renewal, sync, context and disconnect. Disconnecting now asks for confirmation in the page, and the link's automatic renewal is no longer reset on every wake-up.
-
Security
Automatic alerts only with the right credentials
An alert policy left in the old format is no longer sent without its signature or headers: delivery stops with a clear error and the editor shows "To migrate" with the two ways to unblock it (re-enter the credential, or the automatic conversion at upgrade time, which now runs before the service accepts requests). A save that does not re-enter the credential is rejected instead of silently wiping it.
-
Improvement
Stricter sessions and limits
A super administrator's extended visibility on realtime streams follows role revocation immediately; the extension link requires a genuinely activated link; the per-credential request limit is a real ceiling; item history is filtered by organisation on every read; authentication libraries are updated.
-
Improvement
Small things that no longer get in the way
A dialog no longer closes when a mouse gesture crosses the panel edge; "Go to state" is available on the designer's non-blocking warnings too; a file uploaded with a non-standard type (for example `image/jpg`) is stored and delivered with the canonical type; the Library paginates faster on large collections.