This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Moderate signalThe release includes a critical security directive to override vulnerable transitive packages in runtime dependencies and several feature/bugfix enhancements across UI, Helm charts, task handling, comment system, daemon runtime, and desktop styling.
Why it matters: Override vulnerable transitive packages (severity 70) immediately; all other changes have severity 40 and introduce new capabilities or fixes.
Summary
AI summaryBroad release touches views, chat, daemon, and MUL-4856.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Add per-component affinity and tolerations in Helm charts. Add per-component affinity and tolerations in Helm charts. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Introduce archived notifications sub-view in inbox. Introduce archived notifications sub-view in inbox. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Reuse workdir on manual retry and gate session based on error class in task handling. Reuse workdir on manual retry and gate session based on error class in task handling. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Block draft-fixing actions while attachments are uploading in views. Block draft-fixing actions while attachments are uploading in views. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Rename Linux executable to multica-desktop. Rename Linux executable to multica-desktop. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Explain unavailable Antigravity live events in transcript UI. Explain unavailable Antigravity live events in transcript UI. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Feature | Low |
Add macOS Intel downloads to landing page on web. Add macOS Intel downloads to landing page on web. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Dependency | High |
Override vulnerable transitive packages in dependencies. Override vulnerable transitive packages in dependencies. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Restore autopilot @mention delegation authority in comments. Restore autopilot @mention delegation authority in comments. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Safely bound completion fallback output in comments. Safely bound completion fallback output in comments. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Bound silent OpenCode streams in daemon. Bound silent OpenCode streams in daemon. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Provide writable per‑task HOME for Linux Codex sandbox. Provide writable per‑task HOME for Linux Codex sandbox. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fade tab separators on hover and correct their weight in desktop UI. Fade tab separators on hover and correct their weight in desktop UI. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Drop underline mark so pasted rich text stops emitting ++ in editor. Drop underline mark so pasted rich text stops emitting ++ in editor. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Attach labels in the create transaction for issues. Attach labels in the create transaction for issues. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Render create picker trigger content for issues. Render create picker trigger content for issues. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Preserve completed status on GPT-5.6 Sol -32603 close handshake in kiro. Preserve completed status on GPT-5.6 Sol -32603 close handshake in kiro. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Encode non‑ASCII filenames in Content-Disposition for storage. Encode non‑ASCII filenames in Content-Disposition for storage. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Drop native title that stacked on custom hover surfaces in UI. Drop native title that stacked on custom hover surfaces in UI. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Stop avatar hover cards from opening on brushed‑past avatars in views. Stop avatar hover cards from opening on brushed‑past avatars in views. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
| Bugfix | Low |
Prevent server version from stretching the help menu in views. Prevent server version from stretching the help menu in views. Source: granite4.1:30b@2026-07-16-audit Confidence: high |
— |
Full changelog
Changelog
- 983545b34d595f33ea762e4d905bd9379d697d24 KAP-867: retry safe Codex initialize timeouts
- d74aed1e07d32a16ff3be770cd3e4e7f0bcf8a1a MUL-4302 Remove legacy attribution invariant exemption (#5504)
- f8654b37c0e0ed20d2b9bb8778306563d4511566 MUL-4817: open issue tabs in dedicated windows (#5462)
- ea8511340e6949436c04edea00dabeeebba34233 MUL-4820: support custom property icons (#5468)
- cf1fc64671022c7eba96483da9babbde29d0b656 MUL-4824: fail closed on incomplete Claude-style result streams (#5522)
- f0d7a444ac3d45dc704cac5b3ae968c49a77d881 MUL-4860 fix(acp/kiro): GPT-5.6 Sol completion — object rawOutput + positive-proof guard (follow-up to #5511) (#5515)
- 2d9cf045d032b39ef406f441827badd7837f8302 MUL-4861: align runtime CLI update permissions (#5514)
- c52ebeaa0fbfc9311c77fd2ed182d7b5c9f2a486 MUL-4864 fix(chat): use a single New Chat draft, keyed by session not agent (#5519)
- 5664c0d7551e1bfac11cd41b3b23db31eb75ae44 MUL-4874: fix(execenv): seed Codex model cache in task homes (#5449)
- 59ca4641f7c11f1b10b66dfb10952bda7c2cbeb9 SNDBX-491 refresh autopilot project binding at dispatch (#5499)
- c5e004700f9fa552fd575f857461ae4686c442cb chore(deps): override vulnerable transitive packages (#5493)
- ad7b23896d266b4a6119d46aa85f8ddbd3d3d6ac docs(changelog): add v0.4.3 release entry (en/zh/ja/ko) (#5533)
- 7b89c5104cd48e7f28ab2ba237200fefad6cfaec feat(helm): add per-component affinity and tolerations (#5490)
- 6b2097ccbb3c0bf8ee2ebfc56872293a698f1739 feat(inbox): archived notifications sub-view (MUL-3736) (#5518)
- ae68799c6450685f08c7ed79f2d666bd82002594 feat(task): reuse workdir on manual retry, gate session on error class (MUL-4869) (#5525)
- 3b08456264d151ba38555d325901dae99b21f5fa feat(views): block draft-fixing actions while attachments upload (#5465)
- 69744241e8603bd53b2dcc9544202e0dc1ad4c42 fix(comment): restore autopilot @mention delegation authority (MUL-4857) (#5512)
- 24ea38dcb24f9451a33de926e338e96dd7d6688d fix(comments): safely bound completion fallback output (#5492)
- 5251a0958da6bce58b5d3d764d58f9f765a7b387 fix(daemon): bound silent OpenCode streams (#5523)
- b13b6d06bc0ee3719f21ab914a5dc1d4bdc2a157 fix(daemon): writable per-task HOME for Linux Codex sandbox (MUL-4856) (#5508)
- 849df8bb3b95ade808b91b0230edd3143d2220ae fix(desktop): fade tab separators on hover, correct their weight (MUL-4811) (#5500)
- 650f93336773d64142aadc7f2202b87984cc10a5 fix(desktop): rename Linux executable to multica-desktop (#5483)
- 032c7038ee42d986eb74d1d41e10cad395c3a6d0 fix(editor): drop underline mark so pasted rich text stops emitting ++ (#5471)
- 4fcb27a729f1a9868d607f3890245db2a255b397 fix(issues): attach labels in the create transaction (MUL-4832) (#5510)
- 0ec7c22901c3be388b2c2f18366ef4e0c75da2dc fix(issues): render create picker trigger content (#5491)
- dd692058d7bc050dbc5518d9470e1b4f4b51ab03 fix(kiro): preserve completed status on GPT-5.6 Sol -32603 close handshake (#5509) (#5511)
- a40481805a8ed0bfa322deef6b56e01043270bdb fix(storage): encode non-ASCII filenames in Content-Disposition
- 310634064f75b99a026b5b50c31e9c65ee079a4f fix(transcript): explain unavailable Antigravity live events (#5182)
- f9f41e991a6284ab327ada4400d11ed1b538666c fix(ui): drop native title that stacked on custom hover surfaces (MUL-4836) (#5502)
- e8ada0e89cb328f34a52df3a9fca1cc8cebff62b fix(views): stop avatar hover cards opening on brushed-past avatars (MUL-4827) (#5497)
- fa17e5c168e1f5f409624b1fcf8fb10eb9c0cad5 fix(views): stop server version from stretching the help menu (#5472)
- 47e9c8add59afe776ba4eaea0741e0ab2d9147b7 fix(web): add macOS Intel downloads to landing page (#5517)
- 10391939c012c13a8ad1981a0b8be0df1fc09d62 test(chat): de-flake use-chat-draft-restore reconciliation waitFor (MUL-4856) (#5516)
Breaking Changes
- Removed legacy attribution invariant exemption (MUL-4302)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About multica
The open-source managed agents platform. Turn coding agents into real teammates — assign tasks, track progress, compound skills.
Related context
Related tools
Earlier breaking changes
- v0.3.8 Removes custom_env from agent resources, adds audited env endpoint (MUL-2600)
Beta — feedback welcome: [email protected]