Formbricks 5.3.0 release notes

What’s Changed

🚀 Features

feat(helm): add Hub volume extension points by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8504
feat(auth): reject breached passwords via Have-I-Been-Pwned on password set (ENG-1587) by @xernobyl in https://github.com/formbricks/formbricks/pull/8508
feat(dashboards): add duplicate action to dashboard widgets by @itsjavi in https://github.com/formbricks/formbricks/pull/8541
feat(charts): prefill chart name from AI-generated chart by @itsjavi in https://github.com/formbricks/formbricks/pull/8545
feat(charts): use semantic colors for sentiment buckets by @itsjavi in https://github.com/formbricks/formbricks/pull/8546
feat(charts): language-stable option grouping via value_id + canonical value_text [ENG-1673] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8464
feat(mcp): add a list_workspaces tool (ENG-1776) by @xernobyl in https://github.com/formbricks/formbricks/pull/8577
feat(segments): interaction-based segment filter (ENG-1275) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8588
feat: soft-delete (archive) surveys (ENG-1042) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8609
feat(surveys): add Vietnamese, Traditional Chinese, Urdu and Indonesian translations by @mattinannt in https://github.com/formbricks/formbricks/pull/8678
feat(surveys): default link surveys to the cardless card arrangement by @jobenjada in https://github.com/formbricks/formbricks/pull/8688
feat(support): migrate in-product chat from Chatwoot to Plain [ENG-1984] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8654
feat: add feedbackRecord MCP tools to the XM Suite MCP server by @xernobyl in https://github.com/formbricks/formbricks/pull/8650
feat(license): add Workflows to the enterprise licensed features list by @jobenjada in https://github.com/formbricks/formbricks/pull/8689
feat(auth): block mailbox.org and yeah.net email domains by @jobenjada in https://github.com/formbricks/formbricks/pull/8606
feat: formbricks workflows - epic PR by @itsjavi in https://github.com/formbricks/formbricks/pull/8281
feat(billing): charge trial upgrades immediately at full price [ENG-1968] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8659
feat(billing): provision metered workflow_runs price on scale subscriptions (backport #8735 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8751

🐛 Fixes

fix: let MCP clients request surveys:write and correct validate_survey scope by @xernobyl in https://github.com/formbricks/formbricks/pull/8509
fix: prevent infinite re-render loop when authenticated actions refresh the route by @pandeymangg in https://github.com/formbricks/formbricks/pull/8507
fix: resolve hydration errors in RatingSmiley table markup by @itsjavi in https://github.com/formbricks/formbricks/pull/8514
fix(database): seed Better Auth credential accounts so seed users can log in by @itsjavi in https://github.com/formbricks/formbricks/pull/8512
fix: prevent auth-action route-refresh loop in chart edit and feedback record modals by @pandeymangg in https://github.com/formbricks/formbricks/pull/8518
fix(web): stop infinite server-action refresh loop on survey analysis pages by @itsjavi in https://github.com/formbricks/formbricks/pull/8513
fix(api-keys): stop truncating the org-access note in the API key modal by @Dhruwang in https://github.com/formbricks/formbricks/pull/8519
fix(ui): keep InputCombobox chevron right-aligned when the dropdown is empty by @Dhruwang in https://github.com/formbricks/formbricks/pull/8520
fix: verify password against the credential account for email change and 2FA by @xernobyl in https://github.com/formbricks/formbricks/pull/8532
fix(charts): correct rating measure labels and stale “Run Query” empty-state copy by @itsjavi in https://github.com/formbricks/formbricks/pull/8543
fix(api): reject response updates on a closed survey (ENG-1654) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8536
fix(api): reject publishing an app survey with zero triggers by @pandeymangg in https://github.com/formbricks/formbricks/pull/8547
fix(billing): refresh plan state after a successful upgrade (ENG-1790) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8534
fix(charts): remove leading gap on category bar charts by @itsjavi in https://github.com/formbricks/formbricks/pull/8542
fix(charts): scale rating chart Y-axis to the question’s scale by @itsjavi in https://github.com/formbricks/formbricks/pull/8540
fix(charts): close chart dialog on Escape and show chart name in edit title by @itsjavi in https://github.com/formbricks/formbricks/pull/8544
fix(account): redirect SSO account deletion to the post-deletion survey (ENG-1780) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8530
fix: header-only CSV crash in Unify source creation (ENG-1799) by @xernobyl in https://github.com/formbricks/formbricks/pull/8533
fix(helm): wait for PostgreSQL before migrations [QA 5.2] by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8550
fix(navigation): center icons in the collapsed sidebar by @itsjavi in https://github.com/formbricks/formbricks/pull/8563
fix(sso): stop requiring RFC 9207 issuer param for Azure (ENG-1800) by @xernobyl in https://github.com/formbricks/formbricks/pull/8561
fix(api): allow displayLimit recontact + independent displayPercentage in v3 surveys by @pandeymangg in https://github.com/formbricks/formbricks/pull/8537
fix: return 409 for duplicate creates under the Prisma 7 driver adapter (ENG-1801) by @xernobyl in https://github.com/formbricks/formbricks/pull/8565
fix(docker): validate environment before migrations [QA 5.2] by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8551
fix: sync Better Auth TwoFactor table so 2FA login works after enabling by @xernobyl in https://github.com/formbricks/formbricks/pull/8559
fix(unify): disable active write controls for read-only members on Feedback Data by @pandeymangg in https://github.com/formbricks/formbricks/pull/8570
fix(auth): read the correct field from the OAuth consent response (MCP) by @xernobyl in https://github.com/formbricks/formbricks/pull/8575
fix(surveys): screen-reader semantics for survey elements by @itsjavi in https://github.com/formbricks/formbricks/pull/8567
fix(surveys): visual a11y polish for the survey player by @itsjavi in https://github.com/formbricks/formbricks/pull/8568
fix(turbo): exclude .next/cache and .next/dev from web build outputs by @Dhruwang in https://github.com/formbricks/formbricks/pull/8553
fix(taxonomy): make failed runs actionable and recoverable by @pandeymangg in https://github.com/formbricks/formbricks/pull/8582
fix(sso): normalize IdP display name & accept common name punctuation (ENG-1743) by @pandeymangg in https://github.com/formbricks/formbricks/pull/8574
fix: correct Helm release image validation by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8589
fix: enforce organization/workspace scoping across API keys, surveys, quotas, and integrations (ENG-1749) by @xernobyl in https://github.com/formbricks/formbricks/pull/8596
fix(auth): block billing-role members from workspace product data [ENG-1763] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8592
fix: bump tar to 7.5.19 to patch decompression DoS (ENG-1947) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8604
fix(scheduling): drop NEXT_PUBLIC_ prefix from survey scheduling env vars (ENG-1665) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8601
fix: enforce workspace-level access in getWorkspaceAuth [ENG-1769] by @xernobyl in https://github.com/formbricks/formbricks/pull/8591
fix(surveys): enforce link-survey PIN on the client response API [ENG-1579] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8506
fix(web): unoptimize external next/image srcs instead of a host wildcard by @mattinannt in https://github.com/formbricks/formbricks/pull/8501
fix(i18n): heal empty default-language keys that reject valid choice responses [ENG-2001] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8614
fix(billing): stop reverse trial laundering into active paid plan [ENG-1968] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8602
fix: bump next to 16.2.11 to patch 9 Next.js CVEs by @mattinannt in https://github.com/formbricks/formbricks/pull/8633
fix(web): match protocol in isExternalImageSrc against remotePatterns (#ENG-2003) by @mattinannt in https://github.com/formbricks/formbricks/pull/8616
fix: apply API-key creator-role clamp to team creation (ENG-1765) by @mattinannt in https://github.com/formbricks/formbricks/pull/8634
fix: stop echoing raw error.message in v1 API 500 responses by @xernobyl in https://github.com/formbricks/formbricks/pull/8622
fix: resolve pnpm audit dependency vulnerabilities by @mattinannt in https://github.com/formbricks/formbricks/pull/8638
fix: proxy feedback records in local development by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8646
fix(deps): bump brace-expansion@5 to 5.0.8 and align postcss pins by @mattinannt in https://github.com/formbricks/formbricks/pull/8641
fix: disable external pre-aggregations for bundled Cube by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8652
fix(docker): remove npm from runtime image by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8660
fix: declare js-core’s real dependency, drop dead database coupling (#ENG-1681) by @mattinannt in https://github.com/formbricks/formbricks/pull/8645
fix: load typegen env from a file instead of inline placeholders by @mattinannt in https://github.com/formbricks/formbricks/pull/8640
fix(a11y): allow overriding Alert role and use role=“status” for static banners by @itsjavi in https://github.com/formbricks/formbricks/pull/8626
fix: give each package its own lint:report output file (#ENG-1694) by @mattinannt in https://github.com/formbricks/formbricks/pull/8632
fix: hard-gate contacts page PII reads on the contacts entitlement (#ENG-1768) by @mattinannt in https://github.com/formbricks/formbricks/pull/8618
fix(api): bind management response file uploads to authorized workspace [ENG-1981] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8647
fix(security): scope historical response import to the authorized workspace [1/4 critical] by @mattinannt in https://github.com/formbricks/formbricks/pull/8679
fix(auth): resolve login-path deadlock and stop over-capturing auth failures by @xernobyl in https://github.com/formbricks/formbricks/pull/8637
fix: prevent feedback-source ingestion crash on malformed choice elements (ENG-1939) by @xernobyl in https://github.com/formbricks/formbricks/pull/8600
fix(surveys): return structured 422 when AI generation hits the output token limit (ENG-1891) by @itsjavi in https://github.com/formbricks/formbricks/pull/8585
fix(security): close the high-severity auth, authz and exposure gaps [2/4 high] by @mattinannt in https://github.com/formbricks/formbricks/pull/8680
fix(hub): bind feedback records gateway API key access to target organization [ENG-1980] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8648
fix(security): close the medium-severity bypass and disclosure gaps [3/4 medium] by @mattinannt in https://github.com/formbricks/formbricks/pull/8681
fix: count only finished responses for survey response limit by @jobenjada in https://github.com/formbricks/formbricks/pull/8673
fix(security): harden the low-severity storage, authz and abuse paths [4/4 low] by @mattinannt in https://github.com/formbricks/formbricks/pull/8682
fix(editor): support nested lists via Tab in the rich text editor [ENG-1747] by @itsjavi in https://github.com/formbricks/formbricks/pull/8631
fix: consistent edit-caution modal CTAs across survey list & summary by @jobenjada in https://github.com/formbricks/formbricks/pull/8674
fix(surveys): stop the focus trap recursing into a stack overflow (ENG-2090) by @pandeymangg in https://github.com/formbricks/formbricks/pull/8700
fix(taxonomy): map Hub 404 to 404 instead of a blanket 502 (ENG-1886) by @pandeymangg in https://github.com/formbricks/formbricks/pull/8707
fix(auth): send the verification email on invite sign-up and bind invites to the invited address [ENG-2091] by @xernobyl in https://github.com/formbricks/formbricks/pull/8691
fix(web): exit non-zero when typegen env validation fails (backport #8730 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8732
fix(survey-ui): make the calendar day hover state meet WCAG AA (backport #8723 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8740
fix(logger): resolve OTEL transport from runtime root (backport #8744 to release/5.3) by @xernobyl in https://github.com/formbricks/formbricks/pull/8747
fix(helm): bound Hub worker API wait (backport #8727 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8738
fix(surveys): make Cal.com scheduler header legible and honor style override (backport #8729 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8739
fix(charts): pin rating/CSAT Y-axis on ungrouped measure charts (backport #8749 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8750
fix(workflows): report a blocked autosave state for an empty name (backport #8733 to release/5.3) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8752
fix(workflows): scope send_email recipients to workspace access (backport #8736 to release/5.3) by @itsjavi in https://github.com/formbricks/formbricks/pull/8754
fix(mcp,api): OAuth challenge parity, audit logging, Prisma 7 constraint fields and dry-run scopes (backport #8718 + #8743 to release/5.3) by @xernobyl in https://github.com/formbricks/formbricks/pull/8755

🔧 Refactors

refactor(surveys): WCAG-compliant keyboard and focus model for survey elements by @itsjavi in https://github.com/formbricks/formbricks/pull/8566
refactor: extract shared Prisma unique-constraint error helper by @xernobyl in https://github.com/formbricks/formbricks/pull/8394

⚡ Performance

perf(e2e): small CI cleanup + measured findings on the real bottlenecks by @mattinannt in https://github.com/formbricks/formbricks/pull/8619
perf(database): speed up Prisma migrations on empty databases by @mattinannt in https://github.com/formbricks/formbricks/pull/8627

📚 Docs

docs: update license table workspaces pricing to pay per workspace by @jobenjada in https://github.com/formbricks/formbricks/pull/8549
docs(unify-feedback): rename “Feedback Directories” to “Feedback Datasets” by @jobenjada in https://github.com/formbricks/formbricks/pull/8584
docs(self-hosting): add v5.2 migration guide by @Dhruwang in https://github.com/formbricks/formbricks/pull/8593
docs(pr): require an agent-maintained QA / Test Plan section on every PR by @Dhruwang in https://github.com/formbricks/formbricks/pull/8595
docs(pr): retarget PR template for agent-authored, Linear-driven PRs by @mattinannt in https://github.com/formbricks/formbricks/pull/8620
docs(surveys): refine in-prod targeting docs by @jobenjada in https://github.com/formbricks/formbricks/pull/8611
docs: remove embedded YouTube videos from docs by @jobenjada in https://github.com/formbricks/formbricks/pull/8664
docs: document built-in survey interface languages by @jobenjada in https://github.com/formbricks/formbricks/pull/8672
docs(surveys): add product screenshots to link survey quickstart by @jobenjada in https://github.com/formbricks/formbricks/pull/8696
docs(unify-feedback): add Enrichment page and promote MCP to a top-level nav tab by @harshsbhat in https://github.com/formbricks/formbricks/pull/8642

⚙️ CI

ci: fall back to db:migrate:dev when db:migrate:ci is absent by @Dhruwang in https://github.com/formbricks/formbricks/pull/8661
chore(ci): remove inert Turbo remote cache and unify pnpm store caching by @mattinannt in https://github.com/formbricks/formbricks/pull/8635

🧹 Chores

chore: document SIGNUP_DOMAIN_CHECK_ON_INVITES in .env.example by @Dhruwang in https://github.com/formbricks/formbricks/pull/8528
chore(pnpm): activate supply-chain release cooldown by @mattinannt in https://github.com/formbricks/formbricks/pull/8498
chore(node): unify Node.js version across dev, CI and production by @mattinannt in https://github.com/formbricks/formbricks/pull/8500
chore(pnpm): remove legacyPeerDeps no-op, document node-linker decision by @mattinannt in https://github.com/formbricks/formbricks/pull/8499
chore(vitest): remove dead environmentMatchGlobs, adopt projects layout by @mattinannt in https://github.com/formbricks/formbricks/pull/8502
chore(pnpm): declare dependencies previously resolved only via hoisting by @mattinannt in https://github.com/formbricks/formbricks/pull/8511
chore(deps): patch 13 Dependabot security alerts (ENG-1988..ENG-1999) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8612
chore(deps): patch Dependabot security alerts across 7 packages by @mattinannt in https://github.com/formbricks/formbricks/pull/8623
chore(eslint): migrate to ESLint 9 flat config by @mattinannt in https://github.com/formbricks/formbricks/pull/8505
chore: remove dead nextBundleAnalysis config from root package.json by @mattinannt in https://github.com/formbricks/formbricks/pull/8657
chore(deps): drop 17 obsolete pnpm overrides by @mattinannt in https://github.com/formbricks/formbricks/pull/8663
chore: add email domain to PostHog organization group identify by @harshsbhat in https://github.com/formbricks/formbricks/pull/8605
chore: add breaking changes section to PR template by @Dhruwang in https://github.com/formbricks/formbricks/pull/8684
chore: remove runtime react deps from root package.json (#1693) by @mattinannt in https://github.com/formbricks/formbricks/pull/8695
chore: update hub to 0.8.3 (backport #8758 to release/5.3) by @xernobyl in https://github.com/formbricks/formbricks/pull/8761

Full Changelog: https://github.com/formbricks/formbricks/compare/5.2.2…5.3.0