Skip to content

Superset

vdesktop-v1.17.0 scope: desktop Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agentic-ai ai-agents claude-code cli codex coding-agents
+13 more
cursor-agent desktop-app developer-tools electron git-worktree llm mcp opencode orchestration parallel-agents tui vibe-coding worktrees

Affected surfaces

deps

Summary

AI summary

Broad release touches desktop, marketing, host-service, and api.

Full changelog

What's Changed

  • feat(mobile): diff review surface — inline comments, native review toolbar, rebuilt diff renderer by @saddlepaddle in https://github.com/superset-sh/superset/pull/5838
  • fix(desktop): remove misleading auth_completed event + label pageview pathnames by @saddlepaddle in https://github.com/superset-sh/superset/pull/5841
  • chore(desktop): bump version to 1.16.1 by @Kitenite in https://github.com/superset-sh/superset/pull/5842
  • fix(desktop): link hiring banner CTA to YC job board by @saddlepaddle in https://github.com/superset-sh/superset/pull/5848
  • fix(desktop,marketing,web): make PostHog tracking integrity-first by @saddlepaddle in https://github.com/superset-sh/superset/pull/5849
  • fix(panes): match tab bar background to inactive tabs, active tab flows into content by @Kitenite in https://github.com/superset-sh/superset/pull/5851
  • chore(deps): bump hono to 4.12.27 and @hono/node-server to 2.0.5 by @Kitenite in https://github.com/superset-sh/superset/pull/5857
  • fix(agents): restore defaults and add settings deep links by @Kitenite in https://github.com/superset-sh/superset/pull/5864
  • fix(desktop): remove browser pane tooltips and restyle pane/preset tooltips by @AviPeltz in https://github.com/superset-sh/superset/pull/5870
  • fix(db): drop stale automations v2_project_id FK blocking automation creation by @saddlepaddle in https://github.com/superset-sh/superset/pull/5878
  • fix(desktop,host-service): show Cursor Composer instead of stale Claude for Cursor sessions by @saddlepaddle in https://github.com/superset-sh/superset/pull/5882
  • fix(desktop): open in IDE broken in v2 workspaces — isolate workspaceTrpc React context by @saddlepaddle in https://github.com/superset-sh/superset/pull/5877
  • fix(desktop): enable workspace drag reordering in collapsed v2 sidebar by @AviPeltz in https://github.com/superset-sh/superset/pull/5871
  • feat(cli,host-service): single-host reads with explicit host targeting by @saddlepaddle in https://github.com/superset-sh/superset/pull/5885
  • feat(desktop): replace sidebar activity strip with port/agent chips and bulk-close hover cards by @saddlepaddle in https://github.com/superset-sh/superset/pull/5887
  • fix(desktop): report true commit count when branch exceeds 500-commit display cap by @saddlepaddle in https://github.com/superset-sh/superset/pull/5890
  • fix(marketing): bootstrap hero experiment flag for instant, sticky assignment by @saddlepaddle in https://github.com/superset-sh/superset/pull/5884
  • fix(trpc): honor organization header for JWT callers by @DivyamTalwar in https://github.com/superset-sh/superset/pull/5468
  • feat(desktop): restore Workspaces tab with host-scoped workspace list by @saddlepaddle in https://github.com/superset-sh/superset/pull/5908
  • fix(host-service): restore workspace_created/deleted telemetry lost in local-first migration by @saddlepaddle in https://github.com/superset-sh/superset/pull/5909
  • feat(marketing,api,docs): agent-readiness surfaces — markdown twins, MCP discovery, agent auth metadata by @saddlepaddle in https://github.com/superset-sh/superset/pull/5910
  • fix(desktop): invert window-drag regions so chrome stays clickable, add drag strips to uncovered screens by @saddlepaddle in https://github.com/superset-sh/superset/pull/5911
  • feat(desktop): surface editor and terminal appearance controls by @Roshvan in https://github.com/superset-sh/superset/pull/5775
  • feat(docs,api,marketing): docs MCP server, /mcp alias, agent_auth identity types, reinstated OpenAPI spec by @saddlepaddle in https://github.com/superset-sh/superset/pull/5912
  • fix(host-service): refresh non-default base branches before forking new workspaces by @kkjcheng in https://github.com/superset-sh/superset/pull/5913
  • fix(marketing,web,admin,api,docs): replace bordered favicon with flat brand icon, add missing apple-touch-icons by @saddlepaddle in https://github.com/superset-sh/superset/pull/5916
  • fix(marketing): header breakpoint cleanup + tighter hero copy by @saddlepaddle in https://github.com/superset-sh/superset/pull/5902
  • feat(desktop): create blank projects from Superset by @Roshvan in https://github.com/superset-sh/superset/pull/5906
  • feat(mcp-v2,docs,api): MCP server instructions and destructive/read-only tool annotations by @saddlepaddle in https://github.com/superset-sh/superset/pull/5917
  • chore(sdk): declare homepage/repository/bugs/keywords in package.json by @saddlepaddle in https://github.com/superset-sh/superset/pull/5918
  • feat(marketing): source agent skills from superset-sh/skills, drop monorepo copy by @saddlepaddle in https://github.com/superset-sh/superset/pull/5919
  • fix(deps): patch next, postcss, @hono/node-server security advisories by @AviPeltz in https://github.com/superset-sh/superset/pull/5920

Full Changelog: https://github.com/superset-sh/superset/compare/desktop-v1.16.1...desktop-v1.17.0

Security Fixes

  • Patch security advisories in next, postcss, and @hono/node-server dependencies

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Superset

Get notified when new releases ship.

Sign up free

About Superset

Code Editor for the AI Agents Era - Run an army of Claude Code, Codex, etc. on your machine

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]