Skip to main content

​
🚀 Features

  • Model Hub improvements Enhancements to the Model Hub experience for managing AI models.
  • App Builder security scanner App Builder can now run security scans against agentic coding apps, with findings surfaced in the UI.
    • Added security scan records, endpoints, and a background scan job on the server
    • Added UI support for triggering scans and reviewing findings

​
🐛 Bug Fixes

  • Republish app backend flow Fixed the backend flow for republishing apps.
  • Unpublish app frontend flow Fixed frontend handling of the unpublish app flow.

​
🛠️ Chores

  • GitHub source control integration server provider Added the server-side GitHub provider that powers the source control integration for Agentic Coding apps, building on the data model foundations below.
  • Conflict handling API and conflict status Added an API for handling source-control conflicts and exposing conflict status, so prompts are blocked while unresolved conflicts remain.
  • AI Model sample payloads are cheap and editable Generating sample payloads for AI Models is now cheaper, and the payloads can be edited after generation.
  • Fixed private key handling in the Google Drive client Corrected how the Google Drive connector client processes private keys.
  • Updated icon URL path Connector icon URLs now resolve from an updated path.
  • Server Gemfile updates Bumped the integrations gem in the server Gemfile to 0.41.2 and then 0.41.3.
  • Request logs now include Origin and Referer headers The server-side request/response logger now captures the incoming Origin and Referer headers alongside the existing Workspace-Id header, giving AppSignal traces more context for debugging cross-origin and embedded requests.
  • Data model foundations for GitHub integration Added the underlying migrations and models that back the upcoming GitHub integration for Agentic Coding apps.
    • New records for Git provider installations, repository targets, app branch targets, session events, and webhook deliveries
    • Status tracking, validation, uniqueness rules, OAuth token handling, and repository ownership details on the new models
    • Automatic cleanup of related Git records when their parent app, session, or installation is removed

​
🔒 Security

  • Clickjacking protection for embedded published apps Published Data Apps and Agentic Apps are now protected against clickjacking by enforcing a Content Security Policy frame-ancestors directive derived from each workspace’s approved embed origins.
    • Added a frame-ancestors directive to responses served through the published app proxy, limiting embedding to 'self' and the origins registered for the app’s workspace
    • Added an embed-origins lookup endpoint that returns approved origins and propagation details for a workspace, with request coalescing, caching, timeouts, and safe fallbacks
    • Origin matching now supports exact, wildcard, and pattern-based entries so admins can allow entire subdomain trees or template-style origins
    • Default CORS access is restricted to approved domains and localhost, and the embed CORS bypass is disabled by default so the allow-list is always enforced
    • Added rate limiting for unauthenticated embed-origin lookups to prevent abuse of the public lookup endpoint