This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
ReleasePort's take
Moderate signalThe agent resources API removes the custom_env field and introduces an audited env endpoint.
Why it matters: All integrations using custom_env in agent resources must migrate to the new audited env endpoint before upgrade; failure will break configuration retrieval.
Summary
AI summaryBroad release touches views, desktop, squad, and MUL-2624.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Removes custom_env from agent resources, adds audited env endpoint (MUL-2600) Removes custom_env from agent resources, adds audited env endpoint (MUL-2600) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds Multica for iOS — first version (MUL-2337) Adds Multica for iOS — first version (MUL-2337) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds Helm chart for Kubernetes self‑host deployment (MUL-2377) Adds Helm chart for Kubernetes self‑host deployment (MUL-2377) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds repository search to resource pickers (MUL-3126) Adds repository search to resource pickers (MUL-3126) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds squad popover hover card to ActorAvatar (MUL-3176) Adds squad popover hover card to ActorAvatar (MUL-3176) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds use‑cases content pipeline with welcome page (MUL-2349) Adds use‑cases content pipeline with welcome page (MUL-2349) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Adds description field to workspace repository settings (MUL-3198) Adds description field to workspace repository settings (MUL-3198) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Medium |
Includes repo description in agent brief (MUL-3203) Includes repo description in agent brief (MUL-3203) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Feature | Low |
Truncates trailing activity block to most recent 8 entries Truncates trailing activity block to most recent 8 entries Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Feature | Low |
Tracks costs for DeepSeek, Kimi K2.6, and Zhipu GLM in pricing UI Tracks costs for DeepSeek, Kimi K2.6, and Zhipu GLM in pricing UI Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Medium |
Fixes duplicate desktop back navigation issue (MUL-3210) Fixes duplicate desktop back navigation issue (MUL-3210) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Bugfix | Medium |
Fixes editor sync when defaultValue changes externally (MUL-2565) Fixes editor sync when defaultValue changes externally (MUL-2565) Source: llm_adapter@2026-05-25 Confidence: high |
— |
| Bugfix | Low |
Closes stdin pipe in Pi adapter to deliver EOF Closes stdin pipe in Pi adapter to deliver EOF Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Disables Codex native auto‑memory in per‑task config.toml Disables Codex native auto‑memory in per‑task config.toml Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Declares phantom dependencies and deduplicates react-query in desktop renderer Declares phantom dependencies and deduplicates react-query in desktop renderer Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Preserves tab scroll position across Activity visibility cycles in desktop app Preserves tab scroll position across Activity visibility cycles in desktop app Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Retries tab scroll restore until virtualized content rehydrates in desktop app Retries tab scroll restore until virtualized content rehydrates in desktop app Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Copies source.config.ts into web deps stage during Docker build Copies source.config.ts into web deps stage during Docker build Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Extends self‑healing delete guard to list row menu in runtimes UI Extends self‑healing delete guard to list row menu in runtimes UI Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Prices claude‑opus‑4‑7[1m] at standard Opus tier in pricing UI Prices claude‑opus‑4‑7[1m] at standard Opus tier in pricing UI Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Derives local port URLs from environment variables in self‑host deployment Derives local port URLs from environment variables in self‑host deployment Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Skips leader on agent reply to explicit member @‑mention (reverted change) Skips leader on agent reply to explicit member @‑mention (reverted change) Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Moves member count from header badge to section label in squad popover Moves member count from header badge to section label in squad popover Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Sorts timeline entries by created_at on WebSocket append Sorts timeline entries by created_at on WebSocket append Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
| Bugfix | Low |
Upgrades github.com/jackc/pgx/v5 to version 5.9.2 Upgrades github.com/jackc/pgx/v5 to version 5.9.2 Source: granite4.1:30b@2026-05-25-audit Confidence: low |
— |
Full changelog
Changelog
- f9dfb3b9fccb3dc4eaed47e6491646a4dc0dc254 Fix duplicate desktop back navigation (#3210)
- 6261ea45fd672999eae6d511127d5cfc7eaefc53 Improve board and squad hover cards (#3188)
- 6703072241c94834d204ded61d81dcaf19978126 Improve landing header CTA hierarchy (#3197)
- 2b3e408db1a544471ae99465b456983c238119cb Revert "fix(squad): skip leader on agent reply to explicit member @-mention (MUL-2624) (#3217)" (#3222)
- 993cf550ad75f159631fe1a04f280dec64e6073c docs(readme): add Autopilots to features list (#3155)
- 13f74e651a57ea92019925136fa3f6b17216c187 feat(agents): remove custom_env from agent resources, add audited env endpoint (MUL-2600) (#3209)
- 441fa18db413a5419e12f069762c4180c5712901 feat(issues): truncate trailing activity block to most recent 8 (MUL-2628) (#3219)
- fd0fe1d08a18784462fc1ceb363adfbb31601878 feat(mobile): Multica for iOS — first version (#2337)
- 1c5e483b1c25e4d3f14ff2301219b7b447b3155b feat(pricing): add DeepSeek, Kimi K2.6, and Zhipu GLM cost tracking (MUL-2606) (#3204)
- 3df26ddd28cbfa2f68ab9a15f19c781678d997b4 feat(self-host): add Helm chart for Kubernetes deployment (#2377)
- 3e1066a638f41be397565bf9e6c78ccad0fc13aa feat(ui): add repository search to resource pickers (#3126)
- 44ee74eb253c6f1d220077674febec036570e89d feat(views): add squad popover hover card to ActorAvatar (#3176)
- 5f1f08e4669a6cb74e61ac70dadfa4e50e69de4a feat(web): add use-cases content pipeline with welcome page (MUL-2349) (#2795)
- a8cda1bd96355c50a7574c3ae025af19f5d44115 feat: add description field to workspace repository settings (#3198)
- 8e9df90d329e81f5fa9022601e2621794277ee11 feat: include repo description in agent brief (#3203)
- cfc652aa5fc33dd7f257f3757098603f1b3ae5af fix(daemon): close stdin pipe in Pi adapter to deliver EOF (#2188) (#3118)
- cd71b0fe05cc2bcd709d899b3500ffa2a6b3880a fix(daemon): disable Codex native auto-memory in per-task config.toml (#3202)
- e351f89843ea4e10a66e2e8eeaaa6db94cd1515c fix(desktop): declare phantom deps + dedupe react-query in renderer (MUL-2651) (#3232)
- 90455abd8dc5a7655633e70d44b079605beb9542 fix(desktop): preserve tab scroll position across Activity visibility cycles (MUL-2602) (#3196)
- b9bf2653be204d6d8cbbe0969c5a078471784060 fix(desktop): retry tab scroll restore until virtualized content rehydrates (#3214)
- bf1e375015f0bb6e2f736eaeb53ee1fa5cd84bdd fix(docker): copy source.config.ts into web deps stage (MUL-2649) (#3227)
- c280fc0879c201f29b28e0410e8571b82f08505a fix(editor): sync TitleEditor when defaultValue changes externally (MUL-2565) (#3080)
- 636fa1adb45d28cf4dbd4c94073ac3705a905c26 fix(issues): hide activity-block header while only recent entries are shown (#3226)
- 9d5c023145775ec38a5d728548a498e4f4f778fd fix(markdown): disable code ligatures (#3038)
- 660e27b981705a6ceeadc22eb67a432b45525e32 fix(runtimes): extend self-healing delete guard to list row menu (MUL-2569) (#3081)
- ba945c1141db9a45176d3093cb6f9084d445d6d5 fix(runtimes): price claude-opus-4-7[1m] at standard Opus tier (MUL-2584) (#3152)
- bfb7c85491d5f7e8b1f6469d029c04c874be7640 fix(selfhost): derive local port URLs from env (MUL-2506) (#2939)
- ce98b1c9efdfde01fedfcf37abcc7f48cf5ff5ae fix(squad): skip leader on agent reply to explicit member @-mention (MUL-2624) (#3217)
- f0c32d57281f0658892ced857f6a80554248f793 fix(views): move member count from header badge to section label in squad popover (MUL-2586) (#3178)
- 077bc055f716c72e4eab5bddc3bcc79d023d30a7 fix(views): sort timeline entries by created_at on WebSocket append (MUL-2582) (#3139)
- be54e79f380310dc84c9298c95baea9d0ed1de4b fix: upgrade github.com/jackc/pgx/v5 to 5.9.2 (#3192)
- 5c1fad450862e25e687a0843ef3ceaa01bb7c37b refactor(editor): split rich text styles (#3211)
Breaking Changes
- Removed custom_env from agent resources (MUL-2600) – use audited env endpoint instead
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About multica
The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.
Related context
Related tools
Beta — feedback welcome: [email protected]