This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+10 more
Affected surfaces
ReleasePort's take
Moderate signalPin minimatch to version 10.2.5 to avoid a ReDoS vulnerability identified in ENG‑1113.
Why it matters: Severity 90 indicates high risk; updating the dependency eliminates the denial‑of‑service threat immediately.
Summary
AI summaryFixes, features and chores across client API, Helm, security, a11y, charts, surveys, docs and deps.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Pin [email protected] to bypass ReDoS vulnerability (ENG-1113). Pin [email protected] to bypass ReDoS vulnerability (ENG-1113). Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Security | High |
Scope getDistinctAttributeValuesAction to the attribute key's workspace (ENG-1115). Scope getDistinctAttributeValuesAction to the attribute key's workspace (ENG-1115). Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Breaking | High |
Remove isAIDataAnalysisEnabled flag (ENG-1039). Remove isAIDataAnalysisEnabled flag (ENG-1039). Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Add response IDs and contact activity improvements. Add response IDs and contact activity improvements. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Add v3 survey patch endpoint. Add v3 survey patch endpoint. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Add connect app snippet card. Add connect app snippet card. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Add MCP v3 surveys server. Add MCP v3 surveys server. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Include person attributes in response integrations and export (ENG-1116). Include person attributes in response integrations and export (ENG-1116). Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Medium |
Generate surveys with AI. Generate surveys with AI. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Dependency | Medium |
Bump axios to 1.16.0 (closes ENG-1249, ENG-1250). Bump axios to 1.16.0 (closes ENG-1249, ENG-1250). Source: llm_adapter@2026-06-11 Confidence: high |
— |
Full changelog
What's Changed
- fix: strip client-provided timestamps in client response API (ENG-828) by @mattinannt in https://github.com/formbricks/formbricks/pull/8047
- fix: add CSAT and CES summary filter icons by @jobenjada in https://github.com/formbricks/formbricks/pull/8056
- fix: enforce billing-only settings access by @jobenjada in https://github.com/formbricks/formbricks/pull/8053
- fix: correct settings sidebar back navigation behavior by @jobenjada in https://github.com/formbricks/formbricks/pull/8052
- fix: preserve legacy SDK shape with placeholder segment data by @pandeymangg in https://github.com/formbricks/formbricks/pull/8067
- fix: staging AI chart Cube schema by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8057
- fix: scope display contact lookup to workspace (ENG-818) by @mattinannt in https://github.com/formbricks/formbricks/pull/8048
- fix: wire Cube API secret into Helm defaults by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8068
- fix: sanitize CSV/XLSX exports against formula injection by @pandeymangg in https://github.com/formbricks/formbricks/pull/8045
- fix: route Manage Teams and integration OAuth callbacks to settings (ENG-988) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8059
- fix: gate AI chart generation on smartTools, not dataAnalysis (ENG-1001) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8060
- fix: render scheduled-plan-change description placeholders correctly by @Dhruwang in https://github.com/formbricks/formbricks/pull/8064
- fix: harden Helm env value rendering by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8070
- fix: require Cube API secret in compose by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8071
- fix: update Helm chart default image tag by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8072
- fix: show copy icon on legacy environmentId, reintroduce duplicate survey action (ENG-978, ENG-987) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8061
- fix: fixes responseId client api issue with legacy environmentId by @pandeymangg in https://github.com/formbricks/formbricks/pull/8079
- chore: add typecheck command and fix format and type issues by @itsjavi in https://github.com/formbricks/formbricks/pull/7999
- fix: adds close button on response error screen by @pandeymangg in https://github.com/formbricks/formbricks/pull/8093
- fix: remount AI translation editor on value change, not disabled transition by @Dhruwang in https://github.com/formbricks/formbricks/pull/8084
- fix: allow enterprise oauth display names by @jobenjada in https://github.com/formbricks/formbricks/pull/8099
- fix: chart date range type switch + presets include today (ENG-1034, ENG-1035) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8096
- fix: reserve future contact keys and improve segment errors (ENG-1037, ENG-994) by @jobenjada in https://github.com/formbricks/formbricks/pull/8101
- fix: validate displayId ownership on response creation (ENG-825) by @mattinannt in https://github.com/formbricks/formbricks/pull/8046
- fix: remove isAIDataAnalysisEnabled (ENG-1039) by @mattinannt in https://github.com/formbricks/formbricks/pull/8109
- fix: pin DNS and block redirects on webhook delivery in the response pipeline by @pandeymangg in https://github.com/formbricks/formbricks/pull/8095
- fix: use Valkey for bundled Helm Redis by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8092
- fix: order Helm Hub migrations after Prisma by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8104
- fix: return 404 when response is deleted mid-update by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8049
- fix: limit JSON request body size by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8051
- docs: restructure into Platform, Surveys, and Unify Feedback tabs by @harshsbhat in https://github.com/formbricks/formbricks/pull/8114
- feat: cascade delete Hub feedback records on org deletion (ENG-973) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8055
- fix: harden Helm release secret lookups by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8118
- fix: restore logout and profile access for billing-role users by @Dhruwang in https://github.com/formbricks/formbricks/pull/8136
- fix: pin Dockerfile global package versions for reproducible builds by @mattinannt in https://github.com/formbricks/formbricks/pull/8123
- fix: move SAML jackson opts out of module scope into init() by @mattinannt in https://github.com/formbricks/formbricks/pull/8131
- feat(a11y): honor prefers-reduced-motion in framer-motion previews by @mattinannt in https://github.com/formbricks/formbricks/pull/8127
- fix: remove invalid placeholder ARIA roles from membership role controls by @mattinannt in https://github.com/formbricks/formbricks/pull/8125
- fix: add CSRF protection to integration OAuth flows by @xernobyl in https://github.com/formbricks/formbricks/pull/8041
- fix: add missing JSX key props in segment-filter SelectItem lists by @mattinannt in https://github.com/formbricks/formbricks/pull/8124
- fix: clean up setTimeout schedules in contact-attribute effects by @mattinannt in https://github.com/formbricks/formbricks/pull/8126
- chore: drop unused exports flagged by only-export-components by @mattinannt in https://github.com/formbricks/formbricks/pull/8130
- fix: fixes read only webhook issue by @pandeymangg in https://github.com/formbricks/formbricks/pull/8117
- fix: bind storage uploads to survey elements by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8044
- fix: Hungarian translation by @xernobyl in https://github.com/formbricks/formbricks/pull/8140
- fix: unify upgrade UI in settings by @jobenjada in https://github.com/formbricks/formbricks/pull/8050
- fix: restore "Label Color" rename in styling settings locales (ENG-976) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8150
- fix: fixes app surveys sdk migration link by @pandeymangg in https://github.com/formbricks/formbricks/pull/8156
- fix: remove hardcoded plan names from upgrade banners by @mattinannt in https://github.com/formbricks/formbricks/pull/8162
- fix: fixes survey card scroll position and segment modal width by @pandeymangg in https://github.com/formbricks/formbricks/pull/8143
- fix: back button not visible on dark backgrounds by @itsjavi in https://github.com/formbricks/formbricks/pull/8110
- fix: resolve language alias for link survey previews (ENG-674) by @mattinannt in https://github.com/formbricks/formbricks/pull/8160
- fix: resolve SonarQube warnings by @Dhruwang in https://github.com/formbricks/formbricks/pull/8146
- fix: reject reCAPTCHA-protected requests when server keys are unconfigured by @mattinannt in https://github.com/formbricks/formbricks/pull/8157
- fix: keep "Feedback Records" highlighted on Topics & Subtopics tab (ENG-1030) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8170
- fix: stamp Linear release version before completing release by @mattinannt in https://github.com/formbricks/formbricks/pull/8164
- chore: mechanical react-doctor sweep (Tailwind shorthands + button type) by @mattinannt in https://github.com/formbricks/formbricks/pull/8132
- fix: rate-limit isSurveyResponsePresentAction and validateSurveyPinAction (ENG-942) by @mattinannt in https://github.com/formbricks/formbricks/pull/8094
- fix(helm): wire bundled cube runtime env by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8167
- fix: prevent client environment cache null crash by @xernobyl in https://github.com/formbricks/formbricks/pull/8142
- fix: contacts csv semicolon delimeter fix by @pandeymangg in https://github.com/formbricks/formbricks/pull/8172
- ci: auto-create Linear issues from Dependabot alerts by @mattinannt in https://github.com/formbricks/formbricks/pull/8173
- chore: resolve blocker + clear-path high SonarQube issues by @mattinannt in https://github.com/formbricks/formbricks/pull/8122
- chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/formbricks/formbricks/pull/8082
- chore: api v3 get survey by @xernobyl in https://github.com/formbricks/formbricks/pull/8043
- fix: clear user's pending invites before account deletion (ENG-1057) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8149
- fix: enable ENTER key to submit login and signup forms by @jobenjada in https://github.com/formbricks/formbricks/pull/8139
- ci: create Helm update PRs with app token by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8184
- feat: add response IDs and contact activity improvements by @jobenjada in https://github.com/formbricks/formbricks/pull/8023
- chore: v3 post survey by @xernobyl in https://github.com/formbricks/formbricks/pull/8073
- fix: pin minimatch@10 to 10.2.5 to bypass ReDoS (ENG-1113) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8190
- style: align main and settings nav icon styling by @itsjavi in https://github.com/formbricks/formbricks/pull/8186
- fix: resolve all pnpm audit vulnerabilities by @mattinannt in https://github.com/formbricks/formbricks/pull/8193
- fix: fixes ces rating question's email embed UI by @pandeymangg in https://github.com/formbricks/formbricks/pull/8180
- fix: move "Create new organization" CTA to Organization → General (ENG-809) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8171
- fix: restore Microsoft SSO account lookup by @xernobyl in https://github.com/formbricks/formbricks/pull/8168
- fix: S3 internal server error for older images by @pandeymangg in https://github.com/formbricks/formbricks/pull/8195
- fix: validate empty "Other" text in optional multi-select by @itsjavi in https://github.com/formbricks/formbricks/pull/8159
- fix(regression): disable video uploads on welcome card logo uploader by @itsjavi in https://github.com/formbricks/formbricks/pull/8188
- fix: use cursor pagination for Dependabot alerts + dry-run dispatch by @mattinannt in https://github.com/formbricks/formbricks/pull/8183
- fix: revalidate survey path in response mutations instead of unauthenticated tab-click action by @mattinannt in https://github.com/formbricks/formbricks/pull/8129
- feat: add connect app snippet card by @jobenjada in https://github.com/formbricks/formbricks/pull/8198
- feat: add v3 survey patch endpoint by @xernobyl in https://github.com/formbricks/formbricks/pull/8121
- refactor: extract or rename nested PascalCase definitions by @mattinannt in https://github.com/formbricks/formbricks/pull/8128
- fix: color picker fills container in logo background-color toggle (ENG-977) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8204
- fix: support Gemini 3.5 Flash multi-region endpoints by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8189
- fix: point Connect Your App "Learn more" to the correct docs URL (ENG-1136) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8201
- feat(unify): paginate topics/subtopics semantic search by @Dhruwang in https://github.com/formbricks/formbricks/pull/8206
- refactor: rename Connector to FeedbackSource in Unify Feedback (ENG-1045) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8178
- fix(security): scope getDistinctAttributeValuesAction to the attribute key's workspace (ENG-1115) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8202
- refactor(survey-ui): strip inline styles for CSP compatibility by @Dhruwang in https://github.com/formbricks/formbricks/pull/8205
- feat: add MCP v3 surveys server by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8144
- fix: use node for cube compose healthcheck by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8216
- feat: include person attributes in response integrations and export (ENG-1116) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8194
- feat: generate example responses via LLM on empty survey (ENG-766) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8151
- chore(deps): bump vitest to 4.1.6 in @formbricks/jobs (ENG-1150, ENG-1149) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8214
- docs: improve guidance on testing for agents by @itsjavi in https://github.com/formbricks/formbricks/pull/8223
- fix: adds cheverons in survey editor by @pandeymangg in https://github.com/formbricks/formbricks/pull/8227
- fix: adds questions and blocks both to v1 api by @pandeymangg in https://github.com/formbricks/formbricks/pull/8226
- feat: restore "Copy to..." action on survey dropdown (ENG-1142) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8210
- fix: update docs handbook navigation by @jobenjada in https://github.com/formbricks/formbricks/pull/8229
- fix(ai-translation): resolve empty translation results in production by @Dhruwang in https://github.com/formbricks/formbricks/pull/8230
- fix: reduce space when AI is disabled on chart creation by @itsjavi in https://github.com/formbricks/formbricks/pull/8187
- feat(charts): polish chart visuals + fix dashboard height (ENG-1140, ENG-1033) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8212
- fix: fixes openapi example and adds both questions and blocks to v1 api example by @pandeymangg in https://github.com/formbricks/formbricks/pull/8231
- fix(empty-states): align read-only surveys + empty notifications with app conventions (ENG-1236) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8220
- feat: adds the openai compatible provider in the ai package by @pandeymangg in https://github.com/formbricks/formbricks/pull/8217
- docs: add Journey Management best practices section to Unify Feedback by @harshsbhat in https://github.com/formbricks/formbricks/pull/8232
- feat(surveys): generate surveys with AI by @itsjavi in https://github.com/formbricks/formbricks/pull/8199
- fix(deps): bump axios to 1.16.0 — closes ENG-1249, ENG-1250 by @Dhruwang in https://github.com/formbricks/formbricks/pull/8221
- fix: order Argo migrations after external secrets by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8218
- chore: clean up A/B experiments and add new onboarding trial conversion experiments by @harshsbhat in https://github.com/formbricks/formbricks/pull/8235
- fix: order Docker self-host migrations by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8234
- docs: add Qwen vLLM Helm AI configuration by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8237
- fix: all upgrade plan related issues from user research by @jobenjada in https://github.com/formbricks/formbricks/pull/8241
- chore: move pnpm security overrides by @xernobyl in https://github.com/formbricks/formbricks/pull/8238
- fix: show clear error when default survey label is missing by @itsjavi in https://github.com/formbricks/formbricks/pull/8228
- feat: Onboarding streamlining by @jobenjada in https://github.com/formbricks/formbricks/pull/8239
- fix(a11y): use div to avoid nesting a button inside another by @itsjavi in https://github.com/formbricks/formbricks/pull/8236
- chore: hungarian translations by @xernobyl in https://github.com/formbricks/formbricks/pull/8243
- fix: don't flag newly added survey questions as invalid on creation by @Dhruwang in https://github.com/formbricks/formbricks/pull/8244
- chore: prisma v7 migration by @xernobyl in https://github.com/formbricks/formbricks/pull/8208
- fix: improve semantic search confidence display by @xernobyl in https://github.com/formbricks/formbricks/pull/8222
- fix: [Backport] fixes rating and csat question single response card UI by @pandeymangg in https://github.com/formbricks/formbricks/pull/8254
- fix: [Backport] "Add logo" link 404 [ENG-1281] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8255
- fix: [Backport] AI translation marks complete without populating field [ENG-1286] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8257
- fix: [Backport] repair MCP survey tool schemas (#8256) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8258
- fix: [Backport] enforce action-aware role checks on storage routes (#8242) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8259
- fix: enforce surveys-exist guard on plan onboarding route [ENG-1290] (backport 5.1) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8263
- fix: improve self-hosted AI generation stability (backport 5.1) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8264
Full Changelog: https://github.com/formbricks/formbricks/compare/5.0.2...5.1.0
Security Fixes
- Scope getDistinctAttributeValuesAction to the attribute key's workspace — closes ENG-1115.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]