This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Affected surfaces
Summary
AI summaryFixes Codex MCP config, tokenizer backtrace, Windows browser hardening, workspace delete cache handling, agent output trimming, daemon task safety, desktop electron bin resolution, GitHub PR list filtering, issues stage naming and UI actions, runtime whitelist addition, search index fallback, server issue‑task assignment stability, squad leader wake‑up, sweeper wall‑clock gating, attachment upload multi‑select, release migration concurrency, README runtime sync, custom runtime profile base qoder support, agent list search feature.
Full changelog
Changelog
- 5dfb0bec0690cc6a5b4c782d98ea93a05c3d7b03 Fix Codex MCP allowlist config rendering (#4949)
- ebd0248be25a1675bce29b580b046454074c344e MUL-4016: fix mention tokenizer stacktrace backtracking (#4889)
- 083e045ec617b6c6117eed650207e98be24090d2 MUL-4103: harden Windows browser MCP config (#4976)
- 152edab8d0fbb94d026a4eb8559b60d14be19ca8 Revert "fix(workspace): drop workspace from list cache while delete is pendin…" (#4982)
- b2db309618a344bdbd659186ae571552b0d5f309 Skip local directory lock for squad leaders (#4951)
- 3f17c2717b6723d9491d1ebd47ae63b78508534a WS-1465 fix autopilot duplicate issue dispatch (#4936)
- c5f0618cafb8930e075a279ef307f971d8703c75 docs(changelog): add v0.3.39 (2026-07-06) release notes (#4985)
- 466fe2ca0b560481d8d239c4eaf46b640680020b docs(readme): sync runtime list, drop retired Gemini (#4990)
- 129efb768841f24e9528e72e99005fdc6a1f1619 feat(runtime): allow qoder as a custom runtime profile base (#4883) (#4912)
- 7183ec9b6d4f78b53b0030552655458119ca5652 feat: add agent list search (#4988)
- e3de28ecd70f676cde9535e185f448f91ef05058 fix(agent): pi agent final output excludes intermediate steps (#4894) (MUL-4030)
- 4c510dfef6a96602faaee3e43889ada662b91ef3 fix(daemon): harden background-task-safety brief against background-and-yield (MUL-4140) (#4998)
- 12d901638ec9572c97f30f109f3189a3e9a6ad8c fix(desktop): resolve electron-vite bin via PATH in dev script (#4992)
- 7116691c07f4b3799d4c99104ee7608ba4d7e289 fix(github): hide reference-only PR links from the issue PR list (#4611)
- cc1f5cda8a143a38b92b0a6384348a67651b7d64 fix(issues): don't call an intermediate stage final in child-done comment (MUL-4062) (#4932)
- a48b6f70ef2992e0960c2e6d8525b9668de80b1b fix(issues): replace nested "More" action submenu with "Relations" (MUL-3972) (#4847)
- 346f818206ea18da2a8f5394d2e1c22a4aee1a24 fix(runtime): add traecli to custom runtime profile whitelist (#4972)
- 359ef61dc3609ca5f1cd64cfacdd81e713884ab4 fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)
- 39ccb7d34207cda8daef6670f98f715be0cca3c6 fix(server): do not cancel issue tasks on assignee change (MUL-4113, #4963) (#4975)
- 5901997bf61c38af889b505a00f5a4f62f6dfb24 fix(squad): wake private-leader squad parent leader on child-done (MUL-4063) (#4934)
- a69d969fb18216db365092a96c85e3d99389a3af fix(sweeper): gate running-task wall clock on runtime liveness (MUL-4107) (#4978)
- c84a939c8324f16db554e8eb4bec21be0e138cc9 fix(views): enable multi-file selection on all attachment upload buttons (#4962)
- f9b7e5035a58bedf3a702099fc096efa690d6765 fix(workspace): drop workspace from list cache while delete is pending (MUL-4129) (#4980)
- f67f0bc9d8b87b67c7d4b995ece9e8c86d5e4a9c fix: block claude settings flag for antigravity (#4974)
- 75e8bd5b64f6a8f35734aace03030e81dcbb40b5 fix: make release index migrations concurrent (#4995)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About multica
The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.
Related context
Related tools
Earlier breaking changes
- v0.3.8 Removes custom_env from agent resources, adds audited env endpoint (MUL-2600)
Beta — feedback welcome: [email protected]