This release includes 1 security fix for security teams reviewing exposed deployments.
Published 2d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 1 known CVE
Topics
agentic-ai
ai-agents
claude-code
cli
codex
coding-agents
+13 more
cursor-agent
desktop-app
developer-tools
electron
git-worktree
llm
mcp
opencode
orchestration
parallel-agents
tui
vibe-coding
worktrees
Affected surfaces
deps
Summary
AI summaryBroad release touches desktop, marketing, host-service, and api.
Full changelog
What's Changed
- feat(mobile): diff review surface — inline comments, native review toolbar, rebuilt diff renderer by @saddlepaddle in https://github.com/superset-sh/superset/pull/5838
- fix(desktop): remove misleading auth_completed event + label pageview pathnames by @saddlepaddle in https://github.com/superset-sh/superset/pull/5841
- chore(desktop): bump version to 1.16.1 by @Kitenite in https://github.com/superset-sh/superset/pull/5842
- fix(desktop): link hiring banner CTA to YC job board by @saddlepaddle in https://github.com/superset-sh/superset/pull/5848
- fix(desktop,marketing,web): make PostHog tracking integrity-first by @saddlepaddle in https://github.com/superset-sh/superset/pull/5849
- fix(panes): match tab bar background to inactive tabs, active tab flows into content by @Kitenite in https://github.com/superset-sh/superset/pull/5851
- chore(deps): bump hono to 4.12.27 and @hono/node-server to 2.0.5 by @Kitenite in https://github.com/superset-sh/superset/pull/5857
- fix(agents): restore defaults and add settings deep links by @Kitenite in https://github.com/superset-sh/superset/pull/5864
- fix(desktop): remove browser pane tooltips and restyle pane/preset tooltips by @AviPeltz in https://github.com/superset-sh/superset/pull/5870
- fix(db): drop stale automations v2_project_id FK blocking automation creation by @saddlepaddle in https://github.com/superset-sh/superset/pull/5878
- fix(desktop,host-service): show Cursor Composer instead of stale Claude for Cursor sessions by @saddlepaddle in https://github.com/superset-sh/superset/pull/5882
- fix(desktop): open in IDE broken in v2 workspaces — isolate workspaceTrpc React context by @saddlepaddle in https://github.com/superset-sh/superset/pull/5877
- fix(desktop): enable workspace drag reordering in collapsed v2 sidebar by @AviPeltz in https://github.com/superset-sh/superset/pull/5871
- feat(cli,host-service): single-host reads with explicit host targeting by @saddlepaddle in https://github.com/superset-sh/superset/pull/5885
- feat(desktop): replace sidebar activity strip with port/agent chips and bulk-close hover cards by @saddlepaddle in https://github.com/superset-sh/superset/pull/5887
- fix(desktop): report true commit count when branch exceeds 500-commit display cap by @saddlepaddle in https://github.com/superset-sh/superset/pull/5890
- fix(marketing): bootstrap hero experiment flag for instant, sticky assignment by @saddlepaddle in https://github.com/superset-sh/superset/pull/5884
- fix(trpc): honor organization header for JWT callers by @DivyamTalwar in https://github.com/superset-sh/superset/pull/5468
- feat(desktop): restore Workspaces tab with host-scoped workspace list by @saddlepaddle in https://github.com/superset-sh/superset/pull/5908
- fix(host-service): restore workspace_created/deleted telemetry lost in local-first migration by @saddlepaddle in https://github.com/superset-sh/superset/pull/5909
- feat(marketing,api,docs): agent-readiness surfaces — markdown twins, MCP discovery, agent auth metadata by @saddlepaddle in https://github.com/superset-sh/superset/pull/5910
- fix(desktop): invert window-drag regions so chrome stays clickable, add drag strips to uncovered screens by @saddlepaddle in https://github.com/superset-sh/superset/pull/5911
- feat(desktop): surface editor and terminal appearance controls by @Roshvan in https://github.com/superset-sh/superset/pull/5775
- feat(docs,api,marketing): docs MCP server, /mcp alias, agent_auth identity types, reinstated OpenAPI spec by @saddlepaddle in https://github.com/superset-sh/superset/pull/5912
- fix(host-service): refresh non-default base branches before forking new workspaces by @kkjcheng in https://github.com/superset-sh/superset/pull/5913
- fix(marketing,web,admin,api,docs): replace bordered favicon with flat brand icon, add missing apple-touch-icons by @saddlepaddle in https://github.com/superset-sh/superset/pull/5916
- fix(marketing): header breakpoint cleanup + tighter hero copy by @saddlepaddle in https://github.com/superset-sh/superset/pull/5902
- feat(desktop): create blank projects from Superset by @Roshvan in https://github.com/superset-sh/superset/pull/5906
- feat(mcp-v2,docs,api): MCP server instructions and destructive/read-only tool annotations by @saddlepaddle in https://github.com/superset-sh/superset/pull/5917
- chore(sdk): declare homepage/repository/bugs/keywords in package.json by @saddlepaddle in https://github.com/superset-sh/superset/pull/5918
- feat(marketing): source agent skills from superset-sh/skills, drop monorepo copy by @saddlepaddle in https://github.com/superset-sh/superset/pull/5919
- fix(deps): patch next, postcss, @hono/node-server security advisories by @AviPeltz in https://github.com/superset-sh/superset/pull/5920
Full Changelog: https://github.com/superset-sh/superset/compare/desktop-v1.16.1...desktop-v1.17.0
Security Fixes
- Patch security advisories in next, postcss, and @hono/node-server dependencies
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Superset
Code Editor for the AI Agents Era - Run an army of Claude Code, Codex, etc. on your machine
Related context
Related tools
Earlier breaking changes
- vdesktop-v1.12.3 Remove the remote-control web terminal feature.
Beta — feedback welcome: [email protected]