What's Changed

• fix: Previous response will show after a request is sent successfully by @cwangsmv in #10239
• fix(INS-2933): let empty-input request creation and re-focus the first-request input on project switch by @pavkout in #10240
• fix: button size by @notjaywu in #10241
• feat(templating): capability-aware sandbox context construction (C2) by @jackkav in #10226
• feat(INS-2933): add request_url_length to Request Created analytics event by @pavkout in #10243
• chore: enable retries for playwright smoke tests by @fiosman in #10234
• fix: don't count auto-derived file name as a changed field in new workspace modal by @fiosman in #10246
• fix: handle lint process error by terminating it and resetting the reference by @ZxBing0066 in #9871
• feat(templating): surface profiles + ceiling + migration warning (P1) by @jackkav in #10242
• fix: cloud sync test flaky by @CurryYangxx in #10238
• Feat/basic components m0 by @CurryYangxx in #10230
• chore: emit and upload junit test results per shard by @fiosman in #10253
• fix(import): always show collection picker by @ryan-willis in #10262
• feat(undo): broaden undo-history persistence via a stable historyKey by @jackkav in #10233
• feat: add a tooltip for show/hide secret on auth tab by @shelby-moore in #10263
• feat(templating): vetted npm libraries in the sandbox — uuid + ajv (M3) by @jackkav in #10244
• fix: stop reusing blank-row ids in key-value editors [INS-2598] by @pavkout in #10260
• fix: restore visible keyboard focus indicators across the app by @pavkout in #10268
• fix: route v3 spaces SDK through proxy-aware fetch by @Ali-Sab in #10265
• fix(first-request): polish input UI and fix cURL method detection [INS-3055] by @pavkout in #10267
• feat: show number of matches when filtering a JSON response by @fiosman in #10261
• fix: deep-link mcp workspace matching by @ryan-willis in #10269
• perf: rewrite command palette search to eliminate UI freezes and stale results by @ZxBing0066 in #10257
• feat(templating): multi-file plugins via in-sandbox module map (M4) by @jackkav in #10256
• fix: collection runner ux by @ryan-willis in #10271
• fix(sidebar): deduplicate repeated request IDs by @ryan-willis in #10179
• fix: support prompt tag in main process by @CurryYangxx in #10251
• fix: guard against infinite loops by @ryan-willis in #10281
• fix: prevent blur-flush from persisting empty rows or re-enabling disabled rows in EnvironmentKVEditor by @pavkout in #10278
• fix(first-request): remove double focus outline and stop cURL method sync while typing by @pavkout in #10287
• fix(first-request): add spacing below quick actions/examples row (treatment A) by @pavkout in #10288
• feat(templating): (L1) discover user-plugin exports in the sandbox instead of nodeRequire (PR 9) by @jackkav in #10276
• feat(templating): (H1) route user-plugin request hooks through the sandbox (PR 10a) by @jackkav in #10279
• fix: workspace import targeting by @ryan-willis in #10291
• fix: show full value on hover for truncated single-line fields by @fiosman in #10273
• chore: bump app version to 13.1.0 by @insomnia-infra in #10296
• feat(templating): (H1) route user-plugin response hooks through the sandbox (PR 10b) by @jackkav in #10286
• fix: Prevent redundant backend requests by @xiaodemen in #10284
• fix: Add unique ids for cloud sync remote files by @cwangsmv in #10303
• feat: Add a new option to disable launch browser automatically for MCP oauth workflow by @cwangsmv in #10266
• feat: Enhance response viewer behavior when receives large response content by @cwangsmv in #9740
• feat(undo): preserve editor undo history across tab changes by @jackkav in #10299
• fix(smoke-test): add missing /v3/users/me/onboarding mock endpoint by @ZxBing0066 in #10309
• chore: bump node-libcurl for electron 43 and windows arm support [INS-3111] by @ryan-willis in #10305
• feat(templating): (A1) route user-plugin actions through the sandbox by @jackkav in #10293
• fix: consolidate user-agent disable logic by @ryan-willis in #10310
• chore: hide 'generate-docs' command and skip hidden commands in documentation generation by @ZxBing0066 in #10314
• fix(templating): re-verify symlink containment on response.setBody writes by @kwburns-kong in #10301
• feat: surface OAuth2 request logs in Console timeline (INS-1284) by @yaoweiprc in #10250
• fix(ci): resolve cloudsmith authz error by @notjaywu in #10321
• fix: Add textValue to method selector to avoid dev build warnings by @cwangsmv in #10323
• chore(ci): add step-security/harden-runner in audit mode by @kwburns-kong in #10300
• fix(script): setting invalid value to environment value should be rejected - INS-2957 by @ihexxa in #10249
• feat(templating): (T1) flip trust model — pluginSandboxEnabled + per-plugin elevated opt-in by @jackkav in #10318
• feat: Persistent link of vault tag with local credential item by @cwangsmv in #10221
• feat(templating): (S1) capability & bridge-handler scoping audit by @jackkav in #10320
• feat: Add app data service and enhance the sidebar cache logic by @cwangsmv in #10333
• fix: e2e smoke test flaky by @cwangsmv in #10348
• fix(plugins): missing plugins (#10295) INS-3364 by @kwburns-kong in #10317
• fix(templating): resolve the QuickJS sandbox engine module before any plugin's code runs by @kwburns-kong in #10345
• refactor: org features fetching by @CurryYangxx in #10354
• fix: Plugin actions is missing in the workspace dropdown on sidebar- #10356 by @cwangsmv in #10358
• fix: large responses now download correctly [INS-2365] by @arora-r in #9807
• feat: add enterprise user activity events for request/document actions by @fiosman in #10337
• fix: prevent Git credential overwrite when authorizing a second account of the same provider [INS-3035] by @pavkout in #10316
• feat(git): name app-managed git folders after their project instead of a bare hex id by @pavkout in #10349
• feat: add sidebar collection focus mode (INS-2912) by @pavkout in #10324
• fix: remove horizontal scrollbar in Plugins settings tab [INS-3490] by @pavkout in #10366
• fix: Sidebar data not updated when offline by @cwangsmv in #10369
• Chore: Refine the workspace data hook and add a pending state for sidebar by @cwangsmv in #10359
• Apply runner filters to requests/iterations as well as tests [INS-3348] by @godfrzero in #10353
• fix: Create workspace below the focus item when created in sidebar by @cwangsmv in #10370
• fix(undo): keep undo history when toggling markdown write/preview and request-script tabs by @jackkav in #10351
• fix(git): recover gracefully when a push fails after a successful commit [INS-3013] by @pavkout in #10372
• feat(settings): add proxyIntegrations option for first-party integrations by @gatzjames in #10363
• fix(script): .response.cookies.toObject() should return an object by @ihexxa in #10307
• fix: Navigation issue when create workspace from shortcut & workspace dropdown issue by @cwangsmv in #10383
• refactor(templating): retire templateTagSandboxEnabled, unify on pluginSandboxEnabled by @jackkav in #10364
• fix(deps): security dependency bumps by @kwburns-kong in #10347
• fix(INS-2766): Land on the parent folder/collection root when deleting a request's last open tab by @pavkout in #10375
• fix(git): return success:true after a completed pull in GitProjectSyncDropdown by @pavkout in #10385 New Contributors
• @arora-r made their first contribution in #9807 Full Changelog: https://github.com/Kong/insomnia/compare/[email protected]@13.2.0