v5.1.5

What's Changed

• chore: remove legacy Linear issue tagging workflow by @msukkari in #1504
• fix(ci): reconcile vulnerability findings with Linear by @msukkari in #1505
• fix vulnerability triage for reusable callers by @msukkari in #1515
• chore: upgrade seroval to ^1.5.6 to address CVE-2026-59940 by @jsourcebot in #1508
• fix(backend): fall back when GitHub App installation is missing by @brendan-kellam in #1523

Full Changelog: v5.1.4...v5.1.5

v5.1.4

What's Changed

• chore: reduce Sentry span sampling outside development by @brendan-kellam in #1475
• chore: upgrade tar to ^7.5.20 to address CVE-2026-59875 by @linear-code[bot] in #1474
• fix(worker): preserve permissions on transient token refresh failures by @brendan-kellam in #1481
• fix(worker): classify permission sync failures by provider context by @brendan-kellam in #1482
• fix: surface permission sync issues requiring user action by @brendan-kellam in #1484
• chore: upgrade brace-expansion to address CVE-2026-13149 by @linear-code[bot] in #1471
• chore: upgrade shell-quote to ^1.10.0 to address CVE-2026-13311 by @linear-code[bot] in #1469
• chore: upgrade js-yaml to ^4.3.0 to address CVE-2026-59869 by @linear-code[bot] in #1470
• chore: upgrade JavaScript dependencies to address 22 CVEs and 6 GHSAs by @jsourcebot in #1502
• chore: bump vendor/zoekt to upgrade gRPC-Go to v1.82.1 by @jsourcebot in #1503

Full Changelog: v5.1.3...v5.1.4

v5.1.3

What's Changed

• fix(web): prevent workspace connector focus ring clipping by @brendan-kellam in #1457
• feat(gitlab): add optional webUrl field to derive projectUrl by @brendan-kellam in #1458
• feat(web): associate Sentry errors with users by @brendan-kellam in #1452
• docs: point MCP server examples at the public app.sourcebot.dev deployment by @msukkari in #1462
• feat(web): add Idira SSO support by @brendan-kellam in #1459
• Add inactive user deprovisioning tool by @brendan-kellam in #1464
• fix(web): prevent file header overflow by @brendan-kellam in #1465

Full Changelog: v5.1.2...v5.1.3

v5.1.2

What's Changed

• fix(backend): recover entitlements after license sync by @brendan-kellam in #1454
• fix: verify signed online license entitlements by @brendan-kellam in #1442
• feat(web): add optional LLM user email header by @brendan-kellam in #1455

Full Changelog: v5.1.1...v5.1.2

v5.1.1

What's Changed

• fix(worker): capture API route errors in Sentry by @brendan-kellam in #1439
• fix(worker): use Ask GitHub PAT for repository auth by @brendan-kellam in #1440
• feat(web): add Book a Call button to sidebar and docs navbar by @msukkari in #1441

Full Changelog: v5.1.0...v5.1.1

v5.1.0

What's Changed

• feat: support richer token cost tracking for ask by @jsourcebot in #1353
• fix(web): change version banner copy from "Upgrade" to "Update" by @msukkari in #1354
• docs: clarify Yarn setup for contributors by @royalpinto007 in #1358
• fix: add pcre2 and libyaml to macos install script by @dsabsay in #1360
• fix(web): send anonymous PostHog events as personless by @brendan-kellam in #1367
• Improve token caching. by @jsourcebot in #1366
• Visualize context window usage in Ask Sourcebot by @jsourcebot in #1370
• refactor(web): normalize Ask user message text extraction by @whoisthey in #1371
• feat(web): render mermaid diagrams in Ask answers by @whoisthey in #1369
• chore(web): mermaid followups by @whoisthey in #1373
• refactor(web): resolve language model capabilities from models.dev by @whoisthey in #1372
• fix(backend): pass zoekt index args without shell by @brendan-kellam in #1376
• fix(web): verify review webhook deliveries by @brendan-kellam in #1378
• Add OpenAPI generation workflow by @brendan-kellam in #1398
• Allow DPoP-bound OAuth access tokens by @brendan-kellam in #1395
• ci: enforce prisma migration ordering and schema drift by @brendan-kellam in #1400
• feat(web): text file attachments for Ask by @whoisthey in #1374
• feat(web): binary file attachments for Ask by @whoisthey in #1375
• chore(web): Validate OAuth scopes for MCP access by @brendan-kellam in #1396
• fix(web): add HTTP security headers to all responses by @msukkari in #1407
• feat: add SCIM 2.0 user provisioning (EE) by @brendan-kellam in #1306
• chore: make backend worker API URL configurable via WORKER_API_URL by @brendan-kellam in #1409
• chore: upgrade nodemailer to ^9.0.1 to address GHSA-p6gq-j5cr-w38f by @linear-code[bot] in #1356
• chore: bump vendor/zoekt to upgrade golang.org/x/net and golang.org/x/crypto (CVEs) by @brendan-kellam in #1412
• fix(web): maintain sidebar scroll position when navigating between chats by @brendan-kellam in #1411
• chore: upgrade @opentelemetry/core to ^2.8.0 to address CVE-2026-54285 by @brendan-kellam in #1413
• Jminnetian/fix connector scrolling by @jsourcebot in #1418
• feat(setupWizard): add reo by @msukkari in #1419
• fix(ci): pass --no-workspaces-update to npm version in setup-sourcebot release by @msukkari in #1420
• fix(setupWizard): add repository field for npm publish provenance by @msukkari in #1421
• fix(ci): map @react-grab and element-source licenses to MIT in license audit by @msukkari in #1422
• feat(web): add deployment system stats to service ping by @brendan-kellam in #1424
• feat(web): guard EE user deletion behind SCIM and unify user API shape by @brendan-kellam in #1425
• fix(backend): handle Gitea ERR_STREAM_PREMATURE_CLOSE during sync by @brendan-kellam in #1405
• feat(web): fetch /browse data client-side and disallow crawlers via robots.txt by @brendan-kellam in #1426
• chore(ci): Add cloud ci by @brendan-kellam in #1429
• docs: point Docker image references at docker.sourcebot.dev by @msukkari in #1430
• feat(web): enable Sentry node and browser profiling by @brendan-kellam in #1431
• feat: show not-found UI when an Ask GitHub repo doesn't exist by @brendan-kellam in #1432
• Jminnetian/askskills by @jsourcebot in #1410
• Jminnetian/sanitize tool names by @jsourcebot in #1423

New Contributors

• @royalpinto007 made their first contribution in #1358
• @dsabsay made their first contribution in #1360

Full Changelog: v5.0.4...v5.1.0

v5.0.4

What's Changed

• chore: upgrade vite to ^8.0.16 to address CVE-2026-53571 by @brendan-kellam in #1313
• chore: upgrade @grpc/grpc-js to ^1.14.4 to address CVE-2026-48068, CVE-2026-48069 by @brendan-kellam in #1315
• chore: upgrade nodemailer to ^8.0.9 to address GHSA-r7g4-qg5f-qqm2 by @brendan-kellam in #1331
• chore: upgrade dompurify to ^3.4.11 to address GHSA-x4vx-rjvf-j5p4 by @brendan-kellam in #1332
• chore: upgrade hono to ^4.12.25 to address CVE-2026-54287 by @brendan-kellam in #1322
• chore: upgrade form-data to ^4.0.6 to address CVE-2026-12143 by @brendan-kellam in #1316
• chore: upgrade markdown-it to ^14.2.0 to address CVE-2026-48988 by @brendan-kellam in #1321
• chore: upgrade @babel/core to ^7.29.6 to address CVE-2026-49356 by @brendan-kellam in #1333
• chore: upgrade nodemailer to ^8.0.11 to address GHSA-268h-hp4c-crq3 by @brendan-kellam in #1328
• chore: upgrade ws to ^8.21.0 to address CVE-2026-48779 by @brendan-kellam in #1324
• chore: refresh @babel/core lockfile to ^7.29.7 to address CVE-2026-49356 by @linear-code[bot] in #1344
• chore: upgrade esbuild to ^0.28.1 to address GHSA-g7r4-m6w7-qqqr by @linear-code[bot] in #1342
• chore: upgrade tar to ^7.5.16 to address CVE-2026-53655 by @linear-code[bot] in #1338
• chore: upgrade protobufjs to ^7.6.4 to address CVE-2026-54269 by @linear-code[bot] in #1336
• chore: upgrade js-yaml to ^4.2.0 to address CVE-2026-53550 by @linear-code[bot] in #1335
• chore(ci): remove LLM summary generation from vulnerability triage by @brendan-kellam in #1334
• feat(ci): tag triaged Linear issues with the source repository by @brendan-kellam in #1345
• fix(web): enable Next.js version skew protection during rolling deploys by @brendan-kellam in #1346
• feat(web): record service ping history and add usage report download by @brendan-kellam in #1348
• feat(shared): decouple offline anonymous access from seat cap by @brendan-kellam in #1349

New Contributors

• @linear-code[bot] made their first contribution in #1344

Full Changelog: v5.0.3...v5.0.4

v5.0.3

What's Changed

• fix(web): always request offline_access for MCP refresh_token grant by @fatmcgav in #1292
• chore(web): Improved security settings by @brendan-kellam in #1303
• fix(shared): validate SOURCEBOT_ENCRYPTION_KEY length by @brendan-kellam in #1305
• fix(web): prevent crash when User-Agent header is missing by @brendan-kellam in #1309
• fix(web): require User.email and reject SSO sign-ins without an email by @brendan-kellam in #1310

Full Changelog: v5.0.2...v5.0.3

v5.0.2

What's Changed

• refactor(web): share connectors explainer copy across login and upsell menus by @msukkari in #1280
• chore: add release workflow for setup-sourcebot by @brendan-kellam in #1279
• chore: upgrade protobufjs to ^7.6.2 by @brendan-kellam in #1281
• feat(web): support for anthropic prompt caching and UI cached token display by @jsourcebot in #1278
• fix(web): fix GitLab MR inline comment 400 errors on context lines and renames by @fatmcgav in #1149
• chore: upgrade qs to ^6.15.2 to address CVE-2026-8723 by @brendan-kellam in #1282
• chore: upgrade picomatch to ^4.0.4 to address CVE-2026-33671, CVE-2026-33672 by @brendan-kellam in #1283
• chore: ignore CVE-2026-41305 (postcss build-time XSS) in Trivy by @brendan-kellam in #1288
• chore: upgrade ws to ^8.20.1 to address CVE-2026-45736 by @brendan-kellam in #1286
• chore: upgrade hono to ^4.12.24 to address CVE-2026-47673, CVE-2026-47674, CVE-2026-47675, CVE-2026-47676 by @brendan-kellam in #1289
• chore: bump zoekt submodule to upgrade go-git to v5.19.1 (CVE-2026-45571) by @brendan-kellam in #1290
• fix(web): surface actionable error when Lighthouse is unreachable by @brendan-kellam in #1293
• fix(web): stop rapid localStorage flip when removing a language model by @brendan-kellam in #1295
• feat(web): resolve Anthropic thinking config from model capabilities by @brendan-kellam in #1294
• feat(web): add isLanguageModelConfigured to service ping by @brendan-kellam in #1296
• chore: remove deprecated env-var identity provider configuration by @brendan-kellam in #1297
• fix(web): Support multiple IDPs of the same type by @brendan-kellam in #1177
• fix(backend): prevent duplicate index jobs from indexedAt race by @brendan-kellam in #1298
• chore: upgrade shell-quote to ^1.8.4 to address CVE-2026-9277 by @jsourcebot in #1299
• fix(worker): pass logger to getAuthCredentialsForRepo during repo sync by @brendan-kellam in #1300

Full Changelog: v5.0.1...v5.0.2

v5.0.1

What's Changed

• fix(web): Prompt anonymous users to login if they want to use connectors in Ask by @jsourcebot in #1274

Full Changelog: v5.0.0...v5.0.1