This release includes targeted security fixes across key libraries to help protect your app from issues like directory traversal, stored XSS, and SSRF. It also removes an unused rich text editor dependency to reduce exposure to a low-severity XSS risk and keep the frontend bundle leaner.

Links inside embedded changelog views now open in a new browser tab instead of navigating within the embed panel. This prevents navigation errors when users click links in embedded content, and adds safer link handling with noopener and noreferrer.

You can now request access to the REST API from Settings (available on Pro and Team plans), use new API documentation, and work with new authenticated endpoints for reading your changelog data. This release also strengthens security around previews, webhooks, and project access, and prevents accidental overwrites when multiple people edit the same entry.

Embed and GitHub-related URLs now keep the original capitalization of GitHub usernames and org names, so your project links display correctly. We also strengthened HTTPS protection by ensuring browsers receive a Strict-Transport-Security header with subdomain coverage and preload support.

This release expands compatibility for GPT-5 models by routing GPT-5.x requests through the right API, helping summaries generate reliably as models evolve. It also addresses a security concern and reduces release-time failures by ensuring the app can start cleanly during updates.

This release tightens security for the embed subscribe endpoint by honoring each project's allowed domains, so subscription requests are only accepted from trusted origins. It also reduces noise from expected asset compilation errors, keeping monitoring focused on issues that matter.