Formbricks

What’s Changed

• fix(survey-ui): make the calendar day hover state meet WCAG AA by @pandeymangg in https://github.com/formbricks/formbricks/pull/8723
• fix: enforce tenant scoping on workspace teamIds and response contact/display links (ENG-1922, ENG-1923) by @xernobyl in https://github.com/formbricks/formbricks/pull/8669
• fix(i18n): stop the translation scanner CLI running on import by @itsjavi in https://github.com/formbricks/formbricks/pull/8708
• chore: split lint check from autofix and add ESLint to pre-commit by @mattinannt in https://github.com/formbricks/formbricks/pull/8677
• fix(web): exit non-zero when typegen env validation fails by @Dhruwang in https://github.com/formbricks/formbricks/pull/8730
• fix(helm): bound Hub worker API wait by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8727
• docs(self-hosting): add v5.3 migration guide by @Dhruwang in https://github.com/formbricks/formbricks/pull/8731
• fix(unify-feedback): restrict record delete/update to org owners and managers by @pandeymangg in https://github.com/formbricks/formbricks/pull/8675
• fix(auth): stop truncating the localhost warning on the OAuth consent screen [ENG-2120] by @itsjavi in https://github.com/formbricks/formbricks/pull/8720
• fix(surveys): make Cal.com scheduler header legible and honor style override by @Dhruwang in https://github.com/formbricks/formbricks/pull/8729
• docs(helm): document taxonomy observability by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8737
• fix(unify-feedback): stop polling a reaped taxonomy run, and declare service_unavailable in the spec by @xernobyl in https://github.com/formbricks/formbricks/pull/8717
• fix(logger): resolve OTEL transport from runtime root by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8744
• fix(deps): patch vite and js-yaml advisories in @formbricks/workflows by @Dhruwang in https://github.com/formbricks/formbricks/pull/8724
• fix(charts): pin rating/CSAT Y-axis on ungrouped measure charts [ENG-2226] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8749
• feat(billing): provision metered workflow_runs price on scale subscriptions by @Dhruwang in https://github.com/formbricks/formbricks/pull/8735
• fix(mcp): surface the missing OAuth scope and fix recall search [ENG-2120] by @itsjavi in https://github.com/formbricks/formbricks/pull/8718
• fix(workflows): report a blocked autosave state for an empty name by @Dhruwang in https://github.com/formbricks/formbricks/pull/8733
• fix(workflows): scope send_email recipients to workspace access by @itsjavi in https://github.com/formbricks/formbricks/pull/8736
• fix(mcp,api): audit logging, OAuth scope parity, Prisma 7 constraint fields and dry-run scopes by @xernobyl in https://github.com/formbricks/formbricks/pull/8743
• docs(helm): enable trace correlation in the observability example by @xernobyl in https://github.com/formbricks/formbricks/pull/8748
• chore: update hub to 0.8.3 by @xernobyl in https://github.com/formbricks/formbricks/pull/8758
• fix(survey): use validated SURVEY_SCHEDULING_TIME_ZONE for archive purge by @Dhruwang in https://github.com/formbricks/formbricks/pull/8767
• docs: state the minimum mobile SDK versions for interaction-based segments by @pandeymangg in https://github.com/formbricks/formbricks/pull/8769
• fix: prevent duplicate otel log export by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8770
• fix(survey): keep lists and non-URL attributes in follow-up email bodies [ENG-2120] by @itsjavi in https://github.com/formbricks/formbricks/pull/8719
• docs: fix Linear auto-linking guidance in the PR template by @mattinannt in https://github.com/formbricks/formbricks/pull/8726
• fix(ci): don’t mislabel PRs breaking-change; tolerate a hand-removed label by @xernobyl in https://github.com/formbricks/formbricks/pull/8763
• refactor: move Sentry client init to instrumentation-client by @mattinannt in https://github.com/formbricks/formbricks/pull/8725
• ci: enforce prettier formatting in the lint job by @mattinannt in https://github.com/formbricks/formbricks/pull/8777
• fix(helm): support graceful container shutdown by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8775
• fix(security): tie the contact detail page to the workspace in the URL [ENG-2290] by @mattinannt in https://github.com/formbricks/formbricks/pull/8789
• fix(segments): bound caller-controlled surveyIds before the Prisma IN query by @pandeymangg in https://github.com/formbricks/formbricks/pull/8772
• fix(link-survey): don’t serialize the survey PIN into the public page (ENG-2098) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8793
• docs: update SSO callback URIs for the Better Auth path change [ENG-1973] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8792
• docs: clarify custom subpath storage setup by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8785
• fix(hub): mount dev Google credentials and make a Hub outage legible (ENG-1916) by @xernobyl in https://github.com/formbricks/formbricks/pull/8662
• feat(analytics): add PostHog AI and MCP observability by @harshsbhat in https://github.com/formbricks/formbricks/pull/8774
• fix(charts): wrap long x-axis labels on cartesian charts (ENG-2061) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8705
• chore: move CodeRabbit config into the repo as .coderabbit.yaml (ENG-2268) by @mattinannt in https://github.com/formbricks/formbricks/pull/8778
• feat(dashboards): add dashboard-level date filter (ENG-1553) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8773
• fix(security): bump js-yaml to 4.3.1 for !!omap quadratic-CPU DoS [ENG-2278][ENG-2279] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8799
• docs: document accepted risk for pnpm audit oauth-provider finding by @mattinannt in https://github.com/formbricks/formbricks/pull/8656
• fix(ci): stop E2E merge-queue stalls from unused Playwright browser install by @mattinannt in https://github.com/formbricks/formbricks/pull/8780
• fix: canonicalize client IP resolution by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8796
• refactor: normalize package entry points and version pinning by @mattinannt in https://github.com/formbricks/formbricks/pull/8784
• feat(support): brand the Plain chat widget with Formbricks colors by @Dhruwang in https://github.com/formbricks/formbricks/pull/8810
• feat: add org-level display timezone for response export timestamps by @Dhruwang in https://github.com/formbricks/formbricks/pull/8791
• fix(unify-feedback): exclude draft surveys from feedback source suggestions by @jobenjada in https://github.com/formbricks/formbricks/pull/8803
• fix(surveys): stop no-overlay surveys blocking the host page (ENG-2304) by @pandeymangg in https://github.com/formbricks/formbricks/pull/8804
• refactor(jobs): declare recurring background jobs once by @xernobyl in https://github.com/formbricks/formbricks/pull/8765
• refactor(storybook): single Tailwind v4 CSS entry and document the workspace CSS invariant by @itsjavi in https://github.com/formbricks/formbricks/pull/8782
• refactor(email): treat package as source-consumed and reconcile Tailwind on v4 by @itsjavi in https://github.com/formbricks/formbricks/pull/8781
• fix(survey-ui): announce validation errors to screen readers - a11y [ENG-1292] by @itsjavi in https://github.com/formbricks/formbricks/pull/8766
• fix(email): resolve the whitelabel logo path for workflow and follow-up emails by @jobenjada in https://github.com/formbricks/formbricks/pull/8817
• docs: clarify production self-hosting guidance by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8820
• fix(deps): remediate container image vulnerabilities by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8828
• fix(feedback-records): gate API-key record mutations on unshared datasets and manage [ENG-2189, ENG-2083] by @xernobyl in https://github.com/formbricks/formbricks/pull/8741
• fix(surveys): expose progress and auto-close countdown to assistive tech [ENG-1070] by @itsjavi in https://github.com/formbricks/formbricks/pull/8776
• fix(security): restrict the onboarding invite path to organization owners [ENG-2169] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8813
• fix(deps): bump undici, socket.io-parser, fast-uri, ip-address for high-risk advisories by @Dhruwang in https://github.com/formbricks/formbricks/pull/8807
• fix(workflows): stop read-only members getting an interactive editor by @Dhruwang in https://github.com/formbricks/formbricks/pull/8811
• fix(security): bind MCP access-token audience to this resource server by @xernobyl in https://github.com/formbricks/formbricks/pull/8829
• refactor(turbo): scope build env per package and tighten task hashing by @xernobyl in https://github.com/formbricks/formbricks/pull/8800
• fix(surveys): open pasted links in a new tab and keep element text selectable by @jobenjada in https://github.com/formbricks/formbricks/pull/8812
• fix(unify-feedback): render feedback record value text as a textarea by @jobenjada in https://github.com/formbricks/formbricks/pull/8830
• docs: add Thank You card page to question types by @jobenjada in https://github.com/formbricks/formbricks/pull/8822
• docs: add Collect Google Reviews best practice by @jobenjada in https://github.com/formbricks/formbricks/pull/8823
• fix(security): bump hono to 4.12.34 and patch 4 advisories by @Dhruwang in https://github.com/formbricks/formbricks/pull/8847
• fix: clean up transient Prisma migrations directory after each run by @xernobyl in https://github.com/formbricks/formbricks/pull/8809
• refactor(env): route environment access through the validated env module (ENG-1685) by @pandeymangg in https://github.com/formbricks/formbricks/pull/8794
• chore: remove stale PostHog A/B experiment flags by @harshsbhat in https://github.com/formbricks/formbricks/pull/8827
• chore: update hub to 0.8.4 and the hub sdk to 0.12.0 by @xernobyl in https://github.com/formbricks/formbricks/pull/8833
• feat: wire the new feedback-record filters through v3 and the MCP tools by @xernobyl in https://github.com/formbricks/formbricks/pull/8836
• feat(unify-feedback): let a source choose whether partial responses reach Hub (ENG-2058) by @xernobyl in https://github.com/formbricks/formbricks/pull/8798
• fix(surveys): require draft-to-draft for skip-validation survey updates by @itsjavi in https://github.com/formbricks/formbricks/pull/8834
• fix(ci): stop path_filters from skipping every CodeRabbit review by @mattinannt in https://github.com/formbricks/formbricks/pull/8852
• fix: block native password-reset endpoints when PASSWORD_RESET_DISABLED (ENG-2105) by @xernobyl in https://github.com/formbricks/formbricks/pull/8816
• feat(helm): add scalable background embedding pool by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8843
• refactor(ui): unify table primitive defaults by @itsjavi in https://github.com/formbricks/formbricks/pull/8837
• refactor(ui): replace SettingsCard noPadding with bodyVariant by @itsjavi in https://github.com/formbricks/formbricks/pull/8838
• feat(ui): add settings table primitive by @itsjavi in https://github.com/formbricks/formbricks/pull/8839
• fix: stop the sentiment_score filter description from inviting -1/1 as a default by @xernobyl in https://github.com/formbricks/formbricks/pull/8856
• chore(ci): run pnpm typecheck on every PR [ENG-2261] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8853
• chore: add CODEOWNERS with CI validation by @mattinannt in https://github.com/formbricks/formbricks/pull/8851
• fix(settings): hide the workspace breadcrumb on organization and account settings by @itsjavi in https://github.com/formbricks/formbricks/pull/8818
• refactor(settings): move enterprise license features onto SettingsTable by @itsjavi in https://github.com/formbricks/formbricks/pull/8840
• fix: block unauthenticated account creation on closed instances via raw signup endpoint [ENG-2293] by @xernobyl in https://github.com/formbricks/formbricks/pull/8821
• refactor(settings): move the api keys table onto SettingsTable by @itsjavi in https://github.com/formbricks/formbricks/pull/8871
• refactor(settings): move team access and feedback directories onto SettingsTable by @itsjavi in https://github.com/formbricks/formbricks/pull/8841
• fix(security): bump nanoid to 3.3.18 and patch advisory [ENG-2403] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8881
• refactor(settings): move organization teams onto SettingsTable by @itsjavi in https://github.com/formbricks/formbricks/pull/8842
• chore(eslint): restore type-aware rules dropped in the flat-config migration by @pandeymangg in https://github.com/formbricks/formbricks/pull/8850
• fix(unify-feedback): drop the inert import-mode control from the edit source modal by @Dhruwang in https://github.com/formbricks/formbricks/pull/8879
• fix: assign exactly one reviewer via a single team code owner by @mattinannt in https://github.com/formbricks/formbricks/pull/8887
• fix(integrations): read Google Sheets integration server-side when linking a sheet by @Dhruwang in https://github.com/formbricks/formbricks/pull/8854
• fix(surveys): reject script-capable schemes in survey link URLs [ENG-2411] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8885
• chore: move all QA onto the PR and slim the PR template by @mattinannt in https://github.com/formbricks/formbricks/pull/8888
• fix(integrations): stop returning OAuth credentials from integration actions by @Dhruwang in https://github.com/formbricks/formbricks/pull/8860
• docs: warn about stale package dist after a branch switch by @xernobyl in https://github.com/formbricks/formbricks/pull/8762
• fix(security): tie survey pages to the workspace in the URL [ENG-2101] by @mattinannt in https://github.com/formbricks/formbricks/pull/8783
• feat(charts): show question type icons in the question pick-list and widen it by @Dhruwang in https://github.com/formbricks/formbricks/pull/8883
• fix(security): bind email-change tokens to credential state [ENG-2106] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8848
• chore: monorepo config audit cleanups [ENG-1695] [ENG-1696] [ENG-1697] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8898
• fix(surveys): open overflowing welcome and CTA cards at the top [ENG-2289] by @itsjavi in https://github.com/formbricks/formbricks/pull/8902
• feat: auto-update feedback source mappings when survey changes (ENG-2064) by @xernobyl in https://github.com/formbricks/formbricks/pull/8824
• fix(auth): fail closed on an unrecognized minPermission by @Dhruwang in https://github.com/formbricks/formbricks/pull/8866
• refactor(mcp): migrate MCP to latest protocol (SDK v2) and reject undeclared tool arguments by @xernobyl in https://github.com/formbricks/formbricks/pull/8859
• fix(analysis): stop the pie tooltip showing the internal measure key [ENG-2346] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8903
• fix(security): scope response file deletion to the owning workspace [ENG-2291] by @pandeymangg in https://github.com/formbricks/formbricks/pull/8861
• fix(unify): retire stale coming-soon on feedback source options by @xernobyl in https://github.com/formbricks/formbricks/pull/8908
• fix(api): restore legacy environmentId on API v1 surveys and webhooks by @Dhruwang in https://github.com/formbricks/formbricks/pull/8855
• ci: drive the breaking-change label from a checkbox (ENG-2332) by @Dhruwang in https://github.com/formbricks/formbricks/pull/8862
• fix(entitlements): treat null self-hosted workspace license as unlimited by @Dhruwang in https://github.com/formbricks/formbricks/pull/8865
• refactor(settings): move the last four settings tables onto SettingsTable by @itsjavi in https://github.com/formbricks/formbricks/pull/8891
• fix(auth): tag Better Auth error captures with the request endpoint (ENG-2259) by @xernobyl in https://github.com/formbricks/formbricks/pull/8907
• fix(a11y): give the public survey a semantic heading structure [ENG-2336] by @itsjavi in https://github.com/formbricks/formbricks/pull/8919
• docs: expand single-use links guide by @jobenjada in https://github.com/formbricks/formbricks/pull/8904
• chore: add consistent UTM tags to all outbound formbricks.com links by @harshsbhat in https://github.com/formbricks/formbricks/pull/8928
• fix(security): bump deepmerge-ts to 8.0.1 by @Dhruwang in https://github.com/formbricks/formbricks/pull/8926
• fix(surveys): close the editor by navigating, not by history [ENG-2476] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8918
• fix(a11y): identify the active language in the survey language switcher [ENG-2335] by @itsjavi in https://github.com/formbricks/formbricks/pull/8920
• fix(a11y): title public survey pages per step and keep instructions reachable [ENG-2334] by @itsjavi in https://github.com/formbricks/formbricks/pull/8923
• fix(sentry): fix source map uploads and stop them failing silently by @pandeymangg in https://github.com/formbricks/formbricks/pull/8927
• chore(typecheck): include test files in the typecheck graph by @pandeymangg in https://github.com/formbricks/formbricks/pull/8890
• docs(pr-template): say how to look up the model and effort for the agent note by @itsjavi in https://github.com/formbricks/formbricks/pull/8934
• chore(rustfs): upgrade RustFS from 1.0.0-alpha.93 to 1.0.0-rc.2 by @BhagyaAmarasinghe in https://github.com/formbricks/formbricks/pull/8925
• fix(surveys): keep mount autofocus from painting an option as hovered or selected [ENG-2288] by @itsjavi in https://github.com/formbricks/formbricks/pull/8932
• fix(analysis): close the chart gaps found rebuilding a customer dashboard [ENG-2473] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8921
• feat(unify-feedback): purge a feedback dataset’s records from dataset settings (ENG-2129) by @xernobyl in https://github.com/formbricks/formbricks/pull/8844
• fix(security): stop publishing the bundled Valkey session store to the host [ENG-2184] by @mattinannt in https://github.com/formbricks/formbricks/pull/8922
• fix(navigation): keep the current organization when deleting a workspace and in account settings (ENG-2142) by @jobenjada in https://github.com/formbricks/formbricks/pull/8815
• fix(integrations): await Google Sheets writes instead of throwing in callbacks [ENG-2250] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8905
• fix(responses): bounds-check the response modal index on delete [ENG-2130] by @Dhruwang in https://github.com/formbricks/formbricks/pull/8906
• chore(deps): adopt pnpm catalogs for shared dependency versions by @mattinannt in https://github.com/formbricks/formbricks/pull/8937
• feat(charts): add chart display settings by @Dhruwang in https://github.com/formbricks/formbricks/pull/8884
• fix(storage): delete uploaded files when a survey’s responses are reset by @jobenjada in https://github.com/formbricks/formbricks/pull/8930
• docs: state that we do not offer bug bounties by @mattinannt in https://github.com/formbricks/formbricks/pull/8944
• feat: show completed responses in survey overview (ENG-1784) by @jobenjada in https://github.com/formbricks/formbricks/pull/8808
• chore(deps): upgrade Better Auth to 1.7.0 and migrate MCP OAuth to the resource model by @xernobyl in https://github.com/formbricks/formbricks/pull/8835

Full Changelog: https://github.com/formbricks/formbricks/compare/5.3.4…5.4.0-rc.1