Release history
formbricks releases
Open Source Qualtrics Alternative
All releases
28 shown
Config change
5.0.0
Breaking risk
Breaking upgrade
Cube/Hub, Feedback Directories, Dashboards, Workspaces, AI
4.9.5
Bug fix
Minor fixes and improvements.
Full changelog
What's Changed
- fix: backport account deletion authorization (#7901) by @xernobyl in https://github.com/formbricks/formbricks/pull/7903
Full Changelog: https://github.com/formbricks/formbricks/compare/4.9.4...4.9.5
4.9.4
Security relevant
Security fixes
- SSRF vulnerability in webhook delivery prevented
Full changelog
What's Changed
- fix: (backport) password hash visibility improvement (#7814) by @xernobyl in https://github.com/formbricks/formbricks/pull/7833
- fix: fixes sentry ref issue (backport #7776) by @Dhruwang in https://github.com/formbricks/formbricks/pull/7872
- fix: prevent Airtable integration crash when token expires (backport #7811) by @Dhruwang in https://github.com/formbricks/formbricks/pull/7873
- fix: (backport) prevent SSRF via redirect following in webhook delivery (#7877) by @Dhruwang in https://github.com/formbricks/formbricks/pull/7892
Full Changelog: https://github.com/formbricks/formbricks/compare/4.9.3...4.9.4
4.9.3
Bug fix
## What's Changed * fix: prevent split offline responses on restore (backport #7767)
Full changelog
What's Changed
- fix: prevent split offline responses on restore (backport #7767) by @Dhruwang in https://github.com/formbricks/formbricks/pull/7777
Full Changelog: https://github.com/formbricks/formbricks/compare/4.9.2...4.9.3
4.9.1
Bug fix
## What's Changed * fix: restore legacy SSO auto-linking hotfix
4.9.0
Security relevant
Security fixes
- Cross-org IDOR vulnerability in server actions
- CSP violations in DOMPurify style attribute handling
- Session revocation on password reset
Notable features
- V3 surveys API
- Offline support for link surveys
- Single-use password reset links
4.8.7
Bug fix
Notable features
- Improved language switch handling to preserve survey orientation and auto-saved language
- Stabilized multilingual button layout to prevent overflow
- Enabled Arabic text rendering in the multilingual toggle
4.8.6
Bug fix
Fixed survey publishing state sync, auto-save conflicts, and language code case mismatches.
4.8.5
Bug fix
Fixed multi-language survey rendering, prevented duplicate subscription race conditions, resolved Stripe webhook reconciliation issues.
4.8.4
Bug fix
Fixed segment filtering logic and indirect segment activity tracking.
4.8.2
Bug fix
Fixed SDK initialization race conditions and loading page display issues.
4.8.0
New feature
Notable features
- Workflows navigation section
- PostHog analytics integration
- Impressions tracking
4.7.5
Bug fix
Fixed Docker image build by copying database files to runner stage.
4.7.4
New feature
Notable features
- Pod disruption budget for Helm
- Batched segment evaluation
4.7.2
Bug fix
Fixed CTA required elements, data type handling, segment operations, and API response validation.
4.7.0
New feature
Security fixes
- qs DoS vulnerability
- next and lodash vulnerabilities
- preact JSON injection vulnerability
Notable features
- Language variants
- Response ID tracking
- Hungarian language support
4.6.1
Bug fix
Optimized license checking to reduce Redis overhead and prevent memory crashes.
4.6.0
Security relevant
⚠ Upgrade required
- next.js and preact have been upgraded; verify compatibility with any custom next.js configurations
- Webhook integrations can now optionally use a webhook secret for verification — consider enabling it for improved security
Security fixes
- Upgraded react-email packages to fix transitive next.js vulnerability
- Upgraded next.js and preact to fix high-severity vulnerabilities
- Hardened CSP and X-Frame-Options headers
Notable features
- Optional IP address capture functionality for surveys
- Custom HTML scripts in link surveys
- Auto-save for draft surveys with Cmd+S hotkey
4.5.0
New feature
⚠ Upgrade required
- Projects have been renamed to workspaces. Review any internal tooling, documentation, or API references that reference 'projects' to ensure compatibility.
- isomorphic-dompurify replaced with sanitize-html in server components — verify sanitization behavior if you have custom content pipelines.
- V2 API OpenAPI paths updated to include full prefixes — check existing API integrations for path changes.
Breaking changes
- Projects renamed to workspaces — any documentation, bookmarks, integrations, or internal references using the term 'projects' will need to be updated.
Notable features
- UI to manage contact attribute keys and values
- Pretty URL UI components for survey sharing
- Custom favicon support