Skip to main content

​
✨ Enhancements

  • User invite flow for agentic coding apps Agentic coding apps now support visibility controls and per-app user management, letting owners share apps via public link or invite specific users.
    • Added public and invite-only visibility modes, configurable from a new App Settings modal in the editor
    • Owners can invite users by email, resend invitations, and accept or remove pending users on a per-app basis
    • Invitation emails guide recipients through an invite-aware sign-up flow that redirects to the deploy URL after acceptance
    • Added agentic-app token authentication for select endpoints and workflows so invited users can access apps securely
    • App Settings modal also exposes status controls and a Built with badge toggle
  • OAuth 2.0 client credentials authentication for HTTP connectors The HTTP source and destination connectors now support OAuth 2.0 client credentials, letting Multiwoven fetch and attach Bearer access tokens automatically.
    • Added an Authentication Type setting with none and oauth_client_credentials options in the HTTP source and destination specs
    • When oauth_client_credentials is selected, configure OAuth Token URL, OAuth Client ID, OAuth Client Secret, and an optional OAuth Scope
    • Access tokens are cached and refreshed automatically before they expire, so requests continue to use a valid token without manual intervention
    • The integrations gem has been bumped to 0.38.0 to include this change
  • Expanded HTTP source response parsing The HTTP source connector now handles a wider range of API response shapes, including tabular payloads with nested and two-dimensional value arrays, making it easier to ingest data from APIs such as Microsoft Graph.
    • Added support for mapping response headers to streamed row values so header/row-style responses are parsed into records correctly
    • Repeated requests no longer produce duplicate records
    • Improved handling of requests that do not use pagination settings
  • Same-origin frontend proxy and agentic coding deployment polling Frontend requests now route through a same-origin proxy path, improving cookie handling and simplifying API routing across development and production environments.
    • API calls from the browser use same-origin proxy paths instead of cross-origin requests, keeping authentication cookies consistent
    • Credentialed cross-origin requests are no longer permitted by default; CSRF protection is enabled by default when no bypass setting is provided
    • Agentic coding deployments now run asynchronously on the frontend with status polling, surfacing clearer progress and failure messages to users
  • Refinements to cookie-based authentication and CSRF handling Follow-up improvements to the cookie-based auth and CSRF rollout make the flow safer to deploy across environments.
    • Auth and CSRF cookies are now always host-only (no domain scoping) for stricter browser isolation
    • Browser JWT tokens are included by default, with per-request opt-out via a token param or environment configuration
    • CORS is now configured independently for credentialed and public (no-credentials) requests, so embed assets and anonymous API consumers can be scoped separately from authenticated origins
    • The CSRF middleware bypass now defaults to enabled, keeping enforcement off until each environment completes the frontend X-CSRF-Token cutover
  • Async deployment creation for agentic coding Deployment creation can now run asynchronously, returning a pending deployment immediately while provisioning continues in the background.
    • Added an endpoint to retrieve individual deployment details
    • Async polling reports deployment status, completion URLs, and error messages so clients can track progress without blocking
  • Cookie-based authentication with CSRF protection Sign-in and sign-out flows now use secure, HttpOnly authentication cookies alongside a CSRF cookie for browser-based sessions.
    • Added an API auth token endpoint that returns the current JWT when available via cookie or header
    • Enterprise sign-up and SSO flows now complete via cookie-based authentication, with success redirects that no longer include the token in the URL
    • Mutating requests now enforce double-submit CSRF validation and return 403 on mismatch or missing tokens
    • Safe HTTP methods (GET, HEAD, OPTIONS) skip CSRF validation, and requests without an auth cookie or using bearer-token auth are bypassed since they aren’t vulnerable to the browser-cookie attack model
    • Frontend sign-in, sign-up, and SSO views now rely on a login state cookie instead of storing tokens in local storage, and public sign-in pages stay accessible for logged-out users while redirecting signed-in users away
    • App previews and event streams use updated authenticated request handling compatible with the cookie-based flow

​
🔧 Maintenance

  • Pinned Premailer version to silence deprecation logs The CE server Gemfile now pins Premailer to a specific release, resolving noisy deprecation warnings in email styling and keeping compatibility consistent across environments.
  • Dependency updates to resolve security vulnerabilities Refreshed integrations dependencies and bumped the integrations gem to 0.37.4 to address known vulnerabilities.
    • Updated the Nokogiri version requirement
    • Removed async-websocket from runtime dependencies
    • Strengthened release validation to ensure the published version matches the expected semantic version format and the exact released version
  • CE server dependency updates to address vulnerabilities Refreshed the CE server’s Ruby dependencies (server/Gemfile.lock) to resolve known security vulnerabilities.
  • CE server integrations gem bump to 0.38.0 Updated the multiwoven-integrations dependency in the CE server to ~> 0.38.0, aligning the CE server with the latest integrations release for improved compatibility and capabilities.
  • Deployment revision tagging for agentic coding telemetry OpenTelemetry exports from the agentic coding tracer now include the application revision as a resource attribute, making it easier to filter traces and metrics by deployment.
    • Revision is resolved from AppSignal config when available, then falls back to APP_REVISION and APPSIGNAL_APP_REVISION environment variables
    • The revision attribute is omitted when no value is configured, avoiding errors and empty tags

​
🐛 Bug Fixes

  • Safer batch pagination when the initial offset is missing or empty Reverse ETL batch queries now handle missing or empty starting offsets consistently, so pagination begins at the correct position and advances reliably across subsequent batches instead of erroring out.
  • Clearer SAML SSO failure when no enabled configuration exists SAML SSO sign-in now fails gracefully when no enabled SSO configuration is available, returning a clear failure message instead of leaving the authentication flow in an incomplete state. Failures are also logged with relevant sign-in details to aid troubleshooting.
  • Filter sub-session user prompts from agentic coding SSE output Internal sub-session user prompt events are no longer persisted or streamed to the primary coding session’s SSE output, while sub-session assistant tool-call events continue to be forwarded so task execution signals remain visible. Primary-session user messages render as before. The default reasoning variant now falls back to low when no explicit setting is provided.
  • Null-safe secret handling for agentic coding apps Improved secret creation for agentic coding apps to gracefully handle cases where app settings are missing or empty.
    • Added a null check for secrets so no secret is created when the app configuration is unavailable
    • Prevents unnecessary errors when there are no secrets to create
  • Reliable logout cookie cleanup Logout now reliably clears all authentication-related cookies.
  • Improved invite signup handling Invite signup flows now handle server responses more reliably.
    • Signups without authentication tokens no longer break login state updates
    • Successful invite signups with valid attributes complete login and navigation correctly
    • Server-provided errors are now displayed as separate notifications
    • AppGen invite redirects continue to work for external deployment URLs
  • Persist reasoning and patch data in agentic coding prompts Prompt persistence and event streaming now correctly capture reasoning, patch, and tool data across prompt lifecycles.
    • Added patch-type prompt support and richer structured metadata, including message/part tracking and started/ended timestamps
    • Event streaming now persists assistant updates per part, improving partial vs. completed handling for tool and patch data
    • Agentic coding prompts API now returns results in chronological order (oldest first)