From 38d3c63c1c8fd5768236ee21cfea161e116dc4d0 Mon Sep 17 00:00:00 2001 From: Dotta Date: Mon, 13 Apr 2026 10:22:41 -0500 Subject: [PATCH] Add v2026.410.0 release notes --- releases/v2026.410.0.md | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 releases/v2026.410.0.md diff --git a/releases/v2026.410.0.md b/releases/v2026.410.0.md new file mode 100644 index 00000000000..d5daed2d9bd --- /dev/null +++ b/releases/v2026.410.0.md @@ -0,0 +1,35 @@ +# v2026.410.0 + +> Released: 2026-04-10 + +## Highlights + +- **Issue workflow and review gates** — Refined the issue detail experience, added explicit review-start controls, tightened execution-policy handoffs, and improved live issue updates across review and approval stages. ([#3000](https://github.com/paperclipai/paperclip/pull/3000), [#3039](https://github.com/paperclipai/paperclip/pull/3039), [#3204](https://github.com/paperclipai/paperclip/pull/3204), [#3222](https://github.com/paperclipai/paperclip/pull/3222), @cryppadotta) +- **Routines and approvals** — Added draft routine defaults, run-time overrides, generic issue-linked board approvals, and related inbox/activity plumbing so routine-driven work can stay governed without custom workflows. ([#3220](https://github.com/paperclipai/paperclip/pull/3220), [#3204](https://github.com/paperclipai/paperclip/pull/3204), @cryppadotta) +- **Issue chat, inbox, and navigation UX** — Improved issue chat stability and performance, added nested inbox views and keyboard shortcuts, and polished attachments, image viewing, and issue-detail navigation. ([#3079](https://github.com/paperclipai/paperclip/pull/3079), [#3163](https://github.com/paperclipai/paperclip/pull/3163), [#3205](https://github.com/paperclipai/paperclip/pull/3205), @cryppadotta, @devinfoley) +- **MCP server and workspace hardening** — Added a standalone Paperclip MCP server package, project-level environment variables, worktree reseeding, and tighter runtime/workspace setup checks. ([#2999](https://github.com/paperclipai/paperclip/pull/2999), [#3001](https://github.com/paperclipai/paperclip/pull/3001), [#3203](https://github.com/paperclipai/paperclip/pull/3203), @cryppadotta) + +## Improvements + +- **Auth and adapter resilience** — Removed the hardcoded auth JWT secret fallback, improved agent-auth secret fallback behavior, added Bedrock model-selection support for `claude-local`, and hardened resumed Claude/Codex session handling. ([#3124](https://github.com/paperclipai/paperclip/pull/3124), [#3033](https://github.com/paperclipai/paperclip/pull/3033), [#2866](https://github.com/paperclipai/paperclip/pull/2866), [#3299](https://github.com/paperclipai/paperclip/pull/3299), @aronprins, @cleanunicorn, @ergonaworks, @kimnamu) +- **Execution reliability** — Tightened non-participant stage mutation checks, stabilized comment wake batching, persisted heartbeat child PIDs earlier, and reduced route-test cross-talk in the local test harness. ([#3206](https://github.com/paperclipai/paperclip/pull/3206), [#3222](https://github.com/paperclipai/paperclip/pull/3222), @cryppadotta) +- **Developer workflow cleanup** — Scoped workspace-link preflight checks to linked worktrees, refreshed worktree/repo-plan docs, and kept generated lockfile refresh flows aligned with CI ownership. ([#3203](https://github.com/paperclipai/paperclip/pull/3203), @cryppadotta) + +## Fixes + +- **Security authorization hardening** — Company portability import preview/apply, approval decisions, activity creation, heartbeat-run issue listing, and heartbeat cancellation now enforce company-scoped access correctly. ([#3315](https://github.com/paperclipai/paperclip/pull/3315), @cryppadotta) +- **Security dependency updates** — Upgraded `multer` to `2.1.1` and `rollup` to `4.59.0` to address known CVEs in the shipped dependency graph. ([#2819](https://github.com/paperclipai/paperclip/pull/2819), @mvanhorn) +- **Server and auth edge cases** — Fixed Express 5 auth wildcard routing, removed the remaining hardcoded JWT fallback in auth init, improved reverse-proxy keepalive behavior, and preserved timezone-aware log timestamps. ([#3124](https://github.com/paperclipai/paperclip/pull/3124), [#3009](https://github.com/paperclipai/paperclip/pull/3009), [#2936](https://github.com/paperclipai/paperclip/pull/2936), [#2937](https://github.com/paperclipai/paperclip/pull/2937), @KhairulA, @Lempkey, @cleanunicorn) +- **Issue and runtime stability** — Fixed long-thread typing lag, signoff follow-up handling, workspace link/runtime regressions, identifier collisions in issue creation, and stale session recovery in Codex resume flows. ([#3163](https://github.com/paperclipai/paperclip/pull/3163), [#2818](https://github.com/paperclipai/paperclip/pull/2818), [#2909](https://github.com/paperclipai/paperclip/pull/2909), @devinfoley, @marysomething99-prog, @mvanhorn) + +## Upgrade Guide + +Database migrations `0049` through `0054` will run automatically on startup. These add issue-relation and execution-decision data, inbox dismissal state, project environment support, and draft-routine storage. The migrations are additive, but operators should still take a backup before upgrading production data. + +If you are upgrading for the security advisory, make sure every deployed package is at least `2026.410.0`. Versions earlier than `2026.410.0` should be treated as vulnerable for the published GHSA. + +## Contributors + +Thank you to everyone who contributed to this release! + +@AllenHyang, @aronprins, @cleanunicorn, @cryppadotta, @DanielSousa, @davison, @devinfoley, @ergonaworks, @HearthCore, @HenkDz, @KhairulA, @kimnamu, @Lempkey, @marysomething99-prog, @mvanhorn, @plind-dm, @shoaib050326, @sparkeros, @wbelt