2026.4.0
Added 3
- Collection-level pre-request and test scripts
- SMTP OAuth2 authentication support
- Desktop settings with manual update controls
Changed 3
- Improve API documentation publishing UX
- Use stateless OAuth2 state store
- Make webapp-server timeouts configurable in self-hosted deployments
Fixed 14
- Handle non-string values in Postman collection import
- Correct environment locale wording
- Make $randomUUID predefined variable RFC 4122 compliant
- Add missing aria-labels to icon-only sidenav links
- Variable hover tooltip was not clickable (disappeared)
- Resolve invalid environment validation when publishing docs in personal workspace
- Remediate quinn-proto vulnerability across native packages
- Apply platform default proxy URL on load and reset
- Support id_token in Authorization Code OAuth flow
- Restore magic-link sign-in flow on cloud for orgs
- Unified store scope and migration reroute in desktop
- Harden onboarding config endpoint
- Set domain URL as mockserver environment
- Subfolder add-new in team collections respects write access
Security 1
- Security patch for the dependency chain v2026.4.0
This release introduces collection-level pre-request and test scripts, desktop settings with manual update controls, refinements to the API documentation experience, and self-hosted improvements, including SMTP OAuth2 authentication, alongside security patches and bug fixes.
Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-4-0.
What's Changed
- refactor(cli): match test-result helper name to documented contract by @Basavaraj8143 in https://github.com/hoppscotch/hoppscotch/pull/6122
- feat(backend): use stateless OAuth2 state store by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6098
- fix(common): handle non-string values in Postman collection import by @okxint in https://github.com/hoppscotch/hoppscotch/pull/6137
- fix(common): correct environment locale wording by @PallavSarkar2005 in https://github.com/hoppscotch/hoppscotch/pull/6117
- fix(data): make
$randomUUIDpredefined variable RFC 4122 compliant by @Grizouforever in https://github.com/hoppscotch/hoppscotch/pull/6125 - chore(common): complete missing Spanish translations by @Pakvothe in https://github.com/hoppscotch/hoppscotch/pull/6109
- chore(common): complete missing Turkish translations by @onwp in https://github.com/hoppscotch/hoppscotch/pull/6071
- chore(common): modify Chinese translation of words by @jiangzm in https://github.com/hoppscotch/hoppscotch/pull/5996
- fix(common): add missing aria-labels to icon-only sidenav links by @rayrishu19-wq in https://github.com/hoppscotch/hoppscotch/pull/6160
- fix(common): variable hover tooltip was not clickable (disappeared) by @AaronFortG in https://github.com/hoppscotch/hoppscotch/pull/6155
- feat: add SMTP OAuth2 authentication support by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6141
- fix: resolve invalid environment validation when publishing docs in personal workspace by @sahilkhan09k in https://github.com/hoppscotch/hoppscotch/pull/5962
- feat(common): improve API documentation publishing UX by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6116
- fix: remediate
quinn-protovulnerability across native packages by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6174 - docs: security threat model and policy update by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6158
- fix(common): apply platform default proxy URL on load and reset by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6142
- feat: add collection-level pre-request and test scripts by @johnan319 in https://github.com/hoppscotch/hoppscotch/pull/5745
- fix(common): support
id_tokenin Authorization Code OAuth flow by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6144 - feat(desktop): settings phase 0 - infra and update check by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6172
- feat(selfhost-web): make webapp-server timeouts configurable by @rkferreira in https://github.com/hoppscotch/hoppscotch/pull/6147
- fix(common): restore magic-link sign-in flow on cloud for orgs by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6237
- fix(desktop): unified store scope and migration reroute by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6238
- chore: security patch for the dependency chain
v2026.4.0by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6191 - fix(backend): harden onboarding config endpoint by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6240
- fix(common): set domain url as mockserver environment by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6185
- fix(common): subfolder add-new in team collections respects write access by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6243
- fix(common): preserve string contract for GQL history responses by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6244
New Contributors
- @Basavaraj8143 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6122
- @okxint made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6137
- @PallavSarkar2005 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6117
- @Grizouforever made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6125
- @Pakvothe made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6109
- @onwp made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6071
- @rayrishu19-wq made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6160
- @sahilkhan09k made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5962
- @johnan319 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5745
- @rkferreira made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6147
Full Changelog: https://github.com/hoppscotch/hoppscotch/compare/2026.3.1...2026.4.0