Back to the changelog

• Security

  Sensitive-data warnings at publish time too

  Until now, warnings about sensitive fields only appeared while designing. Publishing now repeats them and recognises two cases that used to slip through: a webhook with the default body, which sends all of the item's data, and the `{{json item}}` template. If an imported flow still contains placeholders instead of credentials, publishing says so clearly, with the task and property to fix; you can still publish, the choice stays yours. The same warnings also show up in the flow detail, on import, on duplication and on export.

• Improvement

  The activity log covers drafts too

  Creating a flow, renaming it or editing its draft design now leaves an entry in the activity log, with who, when and through which channel, even when the operation comes from an integration. So the log does not fill up while you work in the designer, close saves by the same author are grouped into one entry every five minutes, with the revision numbers it spans.

• Improvement

  Queued events all applied, in order

  When an item waits in a phase with a work-in-progress limit and several events arrive meanwhile, they are now applied one after another, in arrival order, each evaluated on the phase reached by the previous one. If an event no longer applies, the item's history says so, just as it says when a wait was closed by a manual move, an override or a timeout.

• Improvement

  Cleaner contracts for integrators

  Event codes that differ only by case or accents are now recognised as duplicates; the organisation's default language can be read from the APIs and the MCP integration; an invalid numeric value such as `Infinity` is rejected with a clear error instead of being silently replaced; in the MCP dashboard the count of items waiting for automation has a name that says what it measures. On the What's New page, even from a new browser, the unread-release indicator now works.

• Improvement

  Four touch-ups from testing

  Saving an AI assistant now confirms with a green notice and closes the card, and an error is shown prominently instead of hiding at the bottom. Flow share links have a sensible maximum lifetime, thirty days unless the installation sets otherwise, and the interface only offers expirations within that limit. The queued-events count is visible in lists and on the board too, not just in the detail, and in the history a deferred event that gets discarded or cancelled says so with its own label, instead of the generic “event received”. For anyone reading a flow through the MCP integration, credentials hidden in the entity URL template are masked as they already are on export.