# Hoppscotch changelog

> An open-source API development ecosystem — a lightweight web-based alternative to Postman.

- Vendor: Hoppscotch
- Category: Developer Tools
- Official site: https://hoppscotch.io
- Tracked by: What's New (https://whatsnew.fyi/product/hoppscotch)
- Harvested from: GitHub (hoppscotch/hoppscotch)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 2026.7.0

- Date: 2026-07-30
- Version: 2026.7.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.7.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.7.0

- **fixed** — Address collection data loss in personal workspaces
- **fixed** — Prevent request loss in large team collections
- **added** — Implement fallback to initial values for empty environment variables
- **added** — Add configurable connection timeout bounds on the Desktop App
- **fixed** — Remove ctrl+backspace and ctrl+delete key bindings
- **fixed** — Hide native Edit menu bar on Linux
- **security** — Apply security patch for the dependency chain

This release addresses collection data loss in personal workspaces and request loss in imported large team collections, adds fallback to initial values for empty environment variables and configurable connection timeouts on the Desktop App, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-7-0.

##### What's Changed
* chore(agent): bump portable config to `v0.1.18` by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6508
* feat(common): implement current env value fallback to initial value by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6503
* chore: security patch for the dependency chain `v2026.7.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6533
* fix(common): drop ctrl+backspace, ctrl+delete by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6541
* feat(desktop): connection timeout bounds by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6524
* chore(native): pin plugin git deps by rev by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6542
* fix(desktop): hide native Edit menu bar on Linux by @Souheyl7Gouadria in https://github.com/hoppscotch/hoppscotch/pull/6456
* fix(common): personal workspace possible data loss issue by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6510
* fix(backend): prevent request loss in large team collections by @Jurager in https://github.com/hoppscotch/hoppscotch/pull/6072
* fix(backend): bump deprecated backend Dockerfile to `node:22` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6552

##### New Contributors
* @Souheyl7Gouadria made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6456
* @Jurager made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6072

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.6.1...2026.7.0

### 2026.6.1

- Date: 2026-07-15
- Version: 2026.6.1
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.1
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.6.1

- **added** — Allow containers to run with arbitrary non-root user IDs
- **added** — Enable response-cookie capture for Agent-routed requests
- **fixed** — Desktop App login loop caused by empty auth cookies when signing in to self-hosted instances
- **changed** — Lazy-load jq-wasm in the JSON lens renderer for lighter response rendering

> [!Important]
> This release applies to self-hosted deployments. Cloud web remains on the previous stable release, and the Cloud Desktop App release is deferred, while the personal-workspace data-loss issue ([#6483](https://github.com/hoppscotch/hoppscotch/issues/6483)) is being addressed.

This patch release resolves a Desktop App login loop when signing in to self-hosted instances, adds support for running containers under arbitrary non-root user IDs, and enables response-cookie capture for Agent-routed requests, alongside a lighter JSON response renderer.

##### What's Changed
* feat: allow containers to run with arbitrary non-root UIDs by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6481
* fix: desktop login loop caused by empty auth cookies by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6502
* fix: bump `relay` for agent response-cookie capture and pin fork revisions by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6496
* fix(common): lazy-load `jq-wasm` in the JSON lens renderer by @hassams in https://github.com/hoppscotch/hoppscotch/pull/6463

##### New Contributors
* @hassams made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6463

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.6.0...2026.6.1

### 2026.6.0

- Date: 2026-06-30
- Version: 2026.6.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.6.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.6.0

- **added** — Cookie persistence support on the Desktop App
- **added** — ID token support across OAuth2 flows
- **added** — Mock server URL handling for subpath deployments
- **added** — Thai language support
- **added** — Surface which config fields block saving in self-hosted admin
- **fixed** — Mock server persists isPublic on creation and defaults to private
- **fixed** — Enforce ownership on user history and private user fields in backend
- **fixed** — Reject path/query/fragment in SMTP URL validation
- **fixed** — Resolve environment variables in inherited collection headers
- **fixed** — Preserve JSON bodies in curl parser
- **fixed** — Sync self-hosted instance version from manifest in desktop
- **fixed** — Rewrite Finnish language pack
- **fixed** — Add missing Chinese locale keys
- **fixed** — Defer CookieJarService binding
- **security** — Security patch for the dependency chain

> [!IMPORTANT]
There's a known issue on the cloud offering where personal-workspace collections may appear missing or become inaccessible, and the cloud web deployment has been rolled back. Self-hosted deployments are not affected. Follow updates in #6483.

This release adds cookie persistence support on the Desktop App, ID token support across OAuth2 flows, mock server URL handling for subpath deployments, and Thai language support, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-6-0.

##### What's Changed
* fix(mock-server): persist isPublic on creation, default to private by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6410
* fix(backend): enforce ownership on user history and private User fields by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6409
* fix(backend): reject path/query/fragment in SMTP URL validation by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6413
* feat(sh-admin): surface which config fields block saving by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6385
* chore: security patch for the dependency chain `v2026.6.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6450
* feat(mock-server): append /backend to domain-based URL when subpath access is enabled by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6448
* fix(common): resolve environment variables in inherited collection headers by @sahil29roy in https://github.com/hoppscotch/hoppscotch/pull/6447
* fix(common): preserve JSON bodies in curl parser by @gengjiawen in https://github.com/hoppscotch/hoppscotch/pull/5768
* feat(desktop): desktop cookie persistence and reapplication by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6416
* fix(desktop): sync self-hosted instance version from manifest by @cassiocauee in https://github.com/hoppscotch/hoppscotch/pull/6423
* feat: add Thai translation by @anusoft in https://github.com/hoppscotch/hoppscotch/pull/6449
* docs(js-sandbox): update development instructions by @abhaybansal0322 in https://github.com/hoppscotch/hoppscotch/pull/6387
* fix(common): rewrite Finnish language pack by @roopepaajanen in https://github.com/hoppscotch/hoppscotch/pull/6402
* fix(common): add missing Chinese locale keys by @nikhil-shukl in https://github.com/hoppscotch/hoppscotch/pull/6363
* refactor(common): improve syncing systems and remove platform-wise duplications by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6334
* feat(common): add OAuth2 token type selector for `id_token` support by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6444
* fix(common): defer CookieJarService binding by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6478

##### New Contributors
* @sahil29roy made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6447
* @gengjiawen made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5768
* @cassiocauee made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6423
* @anusoft made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6449
* @abhaybansal0322 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6387
* @roopepaajanen made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6402
* @nikhil-shukl made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6363

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.5.0...2026.6.0

### 2026.5.0

- Date: 2026-05-28
- Version: 2026.5.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.5.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.5.0

- **security** — Prevent mass assignment in onboarding
- **security** — Stop secret variable values from leaking to backend
- **security** — Apply security patch for the dependency chain
- **fixed** — Fix class validator decorator usages
- **fixed** — Wait for proxy settings before issuing requests
- **fixed** — Align appload types and resolve shell import alias
- **fixed** — Fix class validation issue for updateRESTUserRequest
- **fixed** — Preserve collection tree on OpenAPI re-import
- **added** — Make proxy URL configurable from environment variables and admin dashboard
- **added** — Add zoom level control in Desktop App settings
- **added** — Add OpenAPI 3.1 collection export
- **added** — Add Mongolian language support

This release adds OpenAPI 3.1 collection export, zoom level controls in the Desktop App, configurable proxy URLs from environment variables and the admin dashboard, and Mongolian language support, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-5-0.

##### What's Changed
* fix(security): prevent mass assignment in onboarding by @nahidhasan94 in https://github.com/hoppscotch/hoppscotch/pull/6171
* fix: class validator decorator usages by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6293
* chore: security patch for the dependency chain `v2026.5.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6338
* fix: stop secret variable values from leaking to backend  by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6279
* fix(common): wait for proxy settings before issuing requests by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6333
* feat: make proxy URL configurable from env and admin dashboard by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6336
* feat(desktop): zoom level control in settings by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6358
* feat(common): add OpenAPI 3.1 collection export by @mcdgavin in https://github.com/hoppscotch/hoppscotch/pull/5880
* fix(desktop): align appload types and resolve shell import alias by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6369
* fix: class validation issue for updateRESTUserRequest by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6373
* feat: add Mongolian translation by @cf3901646 in https://github.com/hoppscotch/hoppscotch/pull/6344
* fix(common): preserve collection tree on OpenAPI re-import by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6376

##### New Contributors
* @mcdgavin made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5880
* @cf3901646 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6344

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.4.1...2026.5.0

### 2026.4.1

- Date: 2026-05-14
- Version: 2026.4.1
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.4.1
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.4.1

- **fixed** — Preserve script imports and avoid WebKit lookbehind regression affecting top-level imports in pre-request and test scripts on the experimental scripting sandbox
- **fixed** — Resolve desktop blank screen on older macOS versions
- **added** — Add desktop setting for keyboard shortcuts on non-QWERTY layouts

This patch release fixes a regression affecting top-level imports in pre-request and test scripts on the experimental scripting sandbox, resolves a desktop blank screen on older macOS versions, and adds a desktop setting for keyboard shortcuts on non-QWERTY layouts.


##### What's Changed
* fix: preserve script imports and avoid WebKit lookbehind by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6306
* feat(desktop): settings phase 3a - keyboard layout strategy by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6289


**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.4.0...2026.4.1

### 2026.4.0

- Date: 2026-04-30
- Version: 2026.4.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.4.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.4.0

- **added** — Collection-level pre-request and test scripts
- **added** — SMTP OAuth2 authentication support
- **added** — Desktop settings with manual update controls
- **changed** — Improve API documentation publishing UX
- **changed** — Use stateless OAuth2 state store
- **changed** — Make webapp-server timeouts configurable in self-hosted deployments
- **fixed** — Handle non-string values in Postman collection import
- **fixed** — Correct environment locale wording
- **fixed** — Make $randomUUID predefined variable RFC 4122 compliant
- **fixed** — Add missing aria-labels to icon-only sidenav links
- **fixed** — Variable hover tooltip was not clickable (disappeared)
- **fixed** — Resolve invalid environment validation when publishing docs in personal workspace
- **fixed** — Remediate quinn-proto vulnerability across native packages
- **fixed** — Apply platform default proxy URL on load and reset
- **fixed** — Support id_token in Authorization Code OAuth flow
- **fixed** — Restore magic-link sign-in flow on cloud for orgs
- **fixed** — Unified store scope and migration reroute in desktop
- **fixed** — Harden onboarding config endpoint
- **fixed** — Set domain URL as mockserver environment
- **fixed** — Subfolder add-new in team collections respects write access
- **security** — Security patch for the dependency chain v2026.4.0

This release introduces collection-level pre-request and test scripts, desktop settings with manual update controls, refinements to the API documentation experience, and self-hosted improvements, including SMTP OAuth2 authentication, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-4-0.

##### What's Changed
* refactor(cli): match test-result helper name to documented contract by @Basavaraj8143 in https://github.com/hoppscotch/hoppscotch/pull/6122
* feat(backend): use stateless OAuth2 state store by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6098
* fix(common): handle non-string values in Postman collection import by @okxint in https://github.com/hoppscotch/hoppscotch/pull/6137
* fix(common): correct environment locale wording by @PallavSarkar2005 in https://github.com/hoppscotch/hoppscotch/pull/6117
* fix(data): make `$randomUUID` predefined variable RFC 4122 compliant by @Grizouforever in https://github.com/hoppscotch/hoppscotch/pull/6125
* chore(common): complete missing Spanish translations by @Pakvothe in https://github.com/hoppscotch/hoppscotch/pull/6109
* chore(common): complete missing Turkish translations by @onwp in https://github.com/hoppscotch/hoppscotch/pull/6071
* chore(common): modify Chinese translation of words by @jiangzm in https://github.com/hoppscotch/hoppscotch/pull/5996
* fix(common): add missing aria-labels to icon-only sidenav links by @rayrishu19-wq in https://github.com/hoppscotch/hoppscotch/pull/6160
* fix(common): variable hover tooltip was not clickable (disappeared) by @AaronFortG in https://github.com/hoppscotch/hoppscotch/pull/6155
* feat: add SMTP OAuth2 authentication support by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6141
* fix: resolve invalid environment validation when publishing docs in personal workspace by @sahilkhan09k in https://github.com/hoppscotch/hoppscotch/pull/5962
* feat(common): improve API documentation publishing UX by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6116
* fix: remediate `quinn-proto` vulnerability across native packages by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6174
* docs: security threat model and policy update by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6158
* fix(common): apply platform default proxy URL on load and reset by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6142
* feat: add collection-level pre-request and test scripts by @johnan319 in https://github.com/hoppscotch/hoppscotch/pull/5745
* fix(common): support `id_token` in Authorization Code OAuth flow by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6144
* feat(desktop): settings phase 0 - infra and update check by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6172
* feat(selfhost-web): make webapp-server timeouts configurable by @rkferreira in https://github.com/hoppscotch/hoppscotch/pull/6147
* fix(common): restore magic-link sign-in flow on cloud for orgs by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6237
* fix(desktop): unified store scope and migration reroute by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6238
* chore: security patch for the dependency chain `v2026.4.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6191
* fix(backend): harden onboarding config endpoint by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6240
* fix(common): set domain url  as mockserver environment by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6185
* fix(common): subfolder add-new in team collections respects write access by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6243
* fix(common): preserve string contract for GQL history responses by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6244

##### New Contributors
* @Basavaraj814

_[Truncated at 4000 characters — full notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.4.0]_

### 2026.3.1

- Date: 2026-04-10
- Version: 2026.3.1
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.1
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.3.1

- **fixed** — Unblock settings save in the admin dashboard when input validation passes

This patch release, exclusive to the Enterprise offering, resolves an issue that prevented changes to settings from being saved in the admin dashboard.

##### What's Changed

- fix(sh-admin): unblock settings save when input validation passes by @nivedin

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.3.0...2026.3.1

### 2026.3.0

- Date: 2026-03-31
- Version: 2026.3.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.3.0

- **added** — Add Cloud for Organizations support to the desktop app
- **added** — Show user workspace memberships in admin dashboard
- **added** — Add MAILER_SMTP_IGNORE_TLS option and optional SMTP authentication
- **added** — Fall back to ref_id in remove functions when id is missing
- **changed** — Route mock server and published docs operations through platform backend
- **changed** — Update Chinese translations
- **fixed** — Persist OAuth2 code challenge method selection
- **fixed** — Prevent stored XSS in team member overflow tooltip
- **fixed** — Fetch full team collection tree on workspace import
- **fixed** — Restore tooltips on icon-only buttons inside popover triggers
- **fixed** — Prevent infinite auth refresh retry loop on permanent token failure
- **fixed** — Add native Edit menu to enable clipboard shortcuts on Linux
- **fixed** — Prevent open redirect in enter page
- **fixed** — Prevent stored XSS via mock server responses and cross-team request moves
- **fixed** — Fix keyboard shortcuts on non-English layouts
- **fixed** — Use operation title as fallback in OpenAPI import
- **fixed** — Handle File objects in HAR postData text resolution
- **fixed** — Validate device-login redirect_uri to prevent token theft via DNS wildcard bypass
- **fixed** — Resolve history schema mismatch on page reload
- **fixed** — Show newly created folder in save-as dialog
- **security** — Apply security patches for the dependency chain

This release brings Cloud for Organizations to the desktop app, adds admin workspace visibility, keyboard shortcut support for non-English layouts, and optional SMTP authentication, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-3-0.

##### What's Changed
* fix(common): persist OAuth2 code challenge method selection by @umutkeltek in https://github.com/hoppscotch/hoppscotch/pull/5921
* chore(common): update Chinese translations by @jiangzm in https://github.com/hoppscotch/hoppscotch/pull/5979
* fix(common): prevent stored XSS in team member overflow tooltip by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5984
* fix(common): fetch full team collection tree on workspace import by @chhaviG22 in https://github.com/hoppscotch/hoppscotch/pull/5792
* fix: restore tooltips on icon-only buttons inside popover triggers by @nikhilmahato21 in https://github.com/hoppscotch/hoppscotch/pull/5935
* fix(common): prevent infinite auth refresh retry loop on permanent token failure by @danielalanbates in https://github.com/hoppscotch/hoppscotch/pull/5893
* fix(desktop): add native Edit menu to enable clipboard shortcuts on Linux by @umutkeltek in https://github.com/hoppscotch/hoppscotch/pull/5920
* fix(common): prevent open redirect in enter page by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5982
* chore: security patch for the dependency chain `v2026.3.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6013
* fix(backend): prevent stored XSS via mock server responses and cross-team request moves by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6006
* feat: add `MAILER_SMTP_IGNORE_TLS` and optional SMTP auth by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5972
* feat: show user workspace memberships in admin dashboard by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5968
* refactor(common): route mock server and published docs operations through platform backend by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6036
* feat(desktop): cloud for orgs support - phase 3 by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6043
* fix: keyboard shortcuts on non-English layouts by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6009
* fix(common): use operation title as fallback in OpenAPI import by @hypergadam in https://github.com/hoppscotch/hoppscotch/pull/5950
* fix(common): handle File objects in HAR postData text resolution by @sh3xu in https://github.com/hoppscotch/hoppscotch/pull/5917
* fix(desktop): add missing backport changes by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6047
* fix: validate device-login redirect_uri to prevent token theft via DNS wildcard bypass by @nahidhasan94 in https://github.com/hoppscotch/hoppscotch/pull/6012
* feat(common): fall back to `ref_id` in remove functions when `id` is missing by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/5898
* chore: patch dependency vulnerabilities and harden production image by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6055
* fix: use team.findMany for fetching user teams by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6057
* fix(common): resolve history schema mismatch on page reload by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6068
* chore: align Tauri plugin-shell versions by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6069
* fix(common): newly created folder not shown in save-as dialog by @majiayu000 in https://github.com/hoppscotch/hoppscotch/pull/6059

##### New Contributors
* @umutkeltek made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5921
* @nikhilmahato21 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5935
* @danielalanbates made their first contri

_[Truncated at 4000 characters — full notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.3.0]_

### 2026.2.1

- Date: 2026-03-05
- Version: 2026.2.1
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.1
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.2.1

- **fixed** — Hide horizontal scrollbar in Firefox for URL input
- **fixed** — Prevent request payload from overriding id and name
- **security** — Enforce user ownership when deleting Personal Access Token
- **fixed** — Update documentation link for mock server
- **changed** — Bump Prisma packages to 7.4.2

This patch release addresses a security issue related to Personal Access Token deletion, a regression with stored request payloads that could override collection identifiers, and list truncation beyond 10 items in team workspaces, alongside minor bug fixes.

##### What's Changed
* fix(common): hide horizontal scrollbar in Firefox for URL input by @Theproudcold in https://github.com/hoppscotch/hoppscotch/pull/5906
* fix(backend): prevent request payload from overriding id and name by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5913
* fix(backend): enforce user ownership when deleting PAT by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5916
* fix(common): update documentation link for mock server by @sh3xu in https://github.com/hoppscotch/hoppscotch/pull/5929
* fix(backend): bump Prisma packages to `7.4.2` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5932

##### New Contributors
* @Theproudcold made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5906
* @sh3xu made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5929

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.2.0...2026.2.1

### 2026.2.0

- Date: 2026-02-26
- Version: 2026.2.0
- Original notes: https://github.com/hoppscotch/hoppscotch/releases/tag/2026.2.0
- Permalink: https://whatsnew.fyi/product/hoppscotch/releases/2026.2.0

- **added** — URL encode/decode context menu actions
- **added** — Search and pagination to teams list in sh-admin
- **added** — Foundational support for dropdown-based organization switcher
- **added** — API documentation versioning
- **added** — Cloud for orgs platform contract in desktop
- **fixed** — Correctly resolve secret environment variables in basic auth header
- **fixed** — Auto-recover from corrupted sandbox state
- **fixed** — Improve responsive layout and overflow in realtime pages
- **fixed** — Constrain variable tooltip to viewport for long values
- **fixed** — Resolve TypeError when opening request from search results
- **fixed** — Increase modal dialog width for more screen sizes
- **fixed** — Prevent IDOR in user collection and request endpoints
- **changed** — Update Czech locale with improved translations
- **deprecated** — Legacy interceptor system
- **security** — Security patch for the dependency chain
- **security** — Resolve security advisories for IDOR and onboarding bypass

This release introduces API documentation versioning, a unified dropdown-based switcher for Cloud orgs tier, and scripting sandbox reliability improvements, alongside security patches, bug fixes, and enhancements.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-2-0.

> [!Note]
> This release includes database migrations required for the API Documentation versioning feature. If you are self-hosting, please ensure you run the latest migrations after upgrading. Please refer to the [documentation](https://docs.hoppscotch.io/documentation/self-host/community-edition/install-and-build#running-migrations) for more context.

##### What's Changed
* feat(common): URL encode/decode context menu actions by @KanhaiyaPandey in https://github.com/hoppscotch/hoppscotch/pull/5782
* fix(common): correctly resolve secret environment variables in basic auth header by @aviu16 in https://github.com/hoppscotch/hoppscotch/pull/5879
* fix: auto-recover from corrupted sandbox state by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5874
* fix(common): improve responsive layout and overflow in realtime pages by @chandraprakash-pandey in https://github.com/hoppscotch/hoppscotch/pull/5843
* chore: security patch for the dependency chain `v2026.2.0` by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5887
* feat(sh-admin): add search and pagination to teams list by @Leon-Luu in https://github.com/hoppscotch/hoppscotch/pull/5803
* chore(common): deprecate legacy interceptor system by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/5830
* chore(common): update `Czech` locale with improved translations by @lubomirblazekcz in https://github.com/hoppscotch/hoppscotch/pull/5895
* fix(backend): resolve security advisories for IDOR and onboarding bypass by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5897
* feat(common): add foundational support for dropdown-based organization switcher by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5890
* feat: api documentation versioning by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5676
* fix(common): constrain variable tooltip to viewport for long values by @aviu16 in https://github.com/hoppscotch/hoppscotch/pull/5878
* fix(common): resolve TypeError when opening request from search results by @Leon-Luu in https://github.com/hoppscotch/hoppscotch/pull/5842
* fix(common): increase modal dialog width for more screen sizes by @iDschepe in https://github.com/hoppscotch/hoppscotch/pull/5884
* feat(desktop): cloud for orgs platform contract by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/5903
* fix(backend): prevent IDOR in user collection and request endpoints by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5902

##### New Contributors
* @KanhaiyaPandey made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5782
* @aviu16 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5879
* @chandraprakash-pandey made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5843
* @lubomirblazekcz made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5895
* @iDschepe made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5884

**Full Changelog**: https://github.com/hoppscotch/hoppscotch/compare/2026.1.1...2026.2.0