2026.3.0
Added 4
- Add Cloud for Organizations support to the desktop app
- Show user workspace memberships in admin dashboard
- Add MAILER_SMTP_IGNORE_TLS option and optional SMTP authentication
- Fall back to ref_id in remove functions when id is missing
Changed 2
- Route mock server and published docs operations through platform backend
- Update Chinese translations
Fixed 14
- Persist OAuth2 code challenge method selection
- Prevent stored XSS in team member overflow tooltip
- Fetch full team collection tree on workspace import
- Restore tooltips on icon-only buttons inside popover triggers
- Prevent infinite auth refresh retry loop on permanent token failure
- Add native Edit menu to enable clipboard shortcuts on Linux
- Prevent open redirect in enter page
- Prevent stored XSS via mock server responses and cross-team request moves
- Fix keyboard shortcuts on non-English layouts
- Use operation title as fallback in OpenAPI import
- Handle File objects in HAR postData text resolution
- Validate device-login redirect_uri to prevent token theft via DNS wildcard bypass
- Resolve history schema mismatch on page reload
- Show newly created folder in save-as dialog
Security 1
- Apply security patches for the dependency chain
This release brings Cloud for Organizations to the desktop app, adds admin workspace visibility, keyboard shortcut support for non-English layouts, and optional SMTP authentication, alongside security patches and bug fixes.
Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-3-0.
What's Changed
- fix(common): persist OAuth2 code challenge method selection by @umutkeltek in https://github.com/hoppscotch/hoppscotch/pull/5921
- chore(common): update Chinese translations by @jiangzm in https://github.com/hoppscotch/hoppscotch/pull/5979
- fix(common): prevent stored XSS in team member overflow tooltip by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5984
- fix(common): fetch full team collection tree on workspace import by @chhaviG22 in https://github.com/hoppscotch/hoppscotch/pull/5792
- fix: restore tooltips on icon-only buttons inside popover triggers by @nikhilmahato21 in https://github.com/hoppscotch/hoppscotch/pull/5935
- fix(common): prevent infinite auth refresh retry loop on permanent token failure by @danielalanbates in https://github.com/hoppscotch/hoppscotch/pull/5893
- fix(desktop): add native Edit menu to enable clipboard shortcuts on Linux by @umutkeltek in https://github.com/hoppscotch/hoppscotch/pull/5920
- fix(common): prevent open redirect in enter page by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/5982
- chore: security patch for the dependency chain
v2026.3.0by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6013 - fix(backend): prevent stored XSS via mock server responses and cross-team request moves by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6006
- feat: add
MAILER_SMTP_IGNORE_TLSand optional SMTP auth by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5972 - feat: show user workspace memberships in admin dashboard by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/5968
- refactor(common): route mock server and published docs operations through platform backend by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6036
- feat(desktop): cloud for orgs support - phase 3 by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6043
- fix: keyboard shortcuts on non-English layouts by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6009
- fix(common): use operation title as fallback in OpenAPI import by @hypergadam in https://github.com/hoppscotch/hoppscotch/pull/5950
- fix(common): handle File objects in HAR postData text resolution by @sh3xu in https://github.com/hoppscotch/hoppscotch/pull/5917
- fix(desktop): add missing backport changes by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6047
- fix: validate device-login redirect_uri to prevent token theft via DNS wildcard bypass by @nahidhasan94 in https://github.com/hoppscotch/hoppscotch/pull/6012
- feat(common): fall back to
ref_idin remove functions whenidis missing by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/5898 - chore: patch dependency vulnerabilities and harden production image by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6055
- fix: use team.findMany for fetching user teams by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6057
- fix(common): resolve history schema mismatch on page reload by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6068
- chore: align Tauri plugin-shell versions by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6069
- fix(common): newly created folder not shown in save-as dialog by @majiayu000 in https://github.com/hoppscotch/hoppscotch/pull/6059
New Contributors
- @umutkeltek made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5921
- @nikhilmahato21 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5935
- @danielalanbates made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5893
- @hypergadam made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5950
- @nahidhasan94 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6012
- @majiayu000 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6059
Full Changelog: https://github.com/hoppscotch/hoppscotch/compare/2026.2.1...2026.3.0