Changelog

All notable changes to this project will be documented in this file.

[8.3.1] - 2026-10-29

Bug Fixes

• Private project filter in deprecated playground endpoint

• Write strategy removed events when an import deletes strategies

• Restore feature type on SDK responses

Documentation

• Update CHANGELOG.md

Features

• Add variant pills to new strategy form

• New constraint legal values multi-select UI

• Show survey one question at the time

Miscellaneous Tasks

• Remove required hint

• Protect feature flag export with private project access checks

• Remove feature lifecycle stage prometheus metrics

• Change the layout of survey creator

• Adds flag for managing new OAuth flow according to Slacks guidelines

• Remove flag and enable semver lte + gte operators

Changelog

Secure token storage

Unleash now stores API tokens securely by default. Every backend, frontend, personal access, and service account token you create in v8.3 or later is a secure token: Unleash stores a selector and a verifier in its database instead of the complete token, so the token can't be recovered from the database or its backups. You can recognize a secure token by the v2_ prefix in its secret.

Because Unleash never stores the complete token, it shows the token only once, when you create it. Copy it immediately and store it in a secrets manager. If you lose a secure token, rotate it.

Tokens created in v8.2 or earlier are legacy tokens and keep working after you upgrade. To replace them with secure tokens, rotate each legacy token, including tokens created from the INIT_*_API_TOKENS environment variables. If you use Unleash Edge, upgrade to Edge v20.5.0 or later for improved token telemetry.

For self-hosted v8.2 instances, you can opt in before upgrading. Set the environment variables for the token types you use and restart Unleash:

These settings affect newly generated tokens only. From v8.3, secure storage is the default and these environment variables are not required.

Simplified Add strategy dialog

The Add strategy dialog now presents three options instead of a list of every strategy type, so you can pick the right one without comparing similar choices:

• Use project default applies the default strategy your team has defined for the environment in this project.
• Set up manually opens the gradual rollout form, where you choose the rollout percentage, targeting, and variants.
• Start from a template applies a release template with a predefined sequence of milestones. [Enterprise]

The IPs and Hosts advanced strategies and your custom strategies are available under More strategies. See Strategy types.

Delete tags

You can now delete a tag that you no longer need. Go to Configure > Tag types, select the tag type, and click Delete next to the tag value. The list shows how many flags use each value. Deleting a tag removes it from every feature flag that uses it, while the tag type and its other values stay in place. You can also delete tags with the delete tag endpoint.

Flag links moved into Flag details

External links now live in a Resources section at the bottom of the Flag details panel on the flag's Overview page, instead of in a separate box. Click Add link in that section to add a link. Everything else about links works as before.

Feedback reports from the MCP server

The Unleash MCP server can now send anonymous diagnostic reports to Unleash when a tool call fails, returns an unexpected result, or you ask for something the server can't do yet. Unleash uses these reports to prioritize fixes and new tools. Reports never include flag names, project IDs, code, raw error messages, or tokens.

Regex, IP address, and SemVer constraint operators

New constraint operators give you more precise targeting in activation strategies and segments. The regex and IP address operators are available in beta.

The regex operator matches a context field against a regular expression in RE2 syntax, so you can target patterns such as ID formats, email domains, or application names that the other string operators can't express. You can test sample values against your expression in the Admin UI before you save.

The IP address operator checks whether a context field, typically remoteAddress, falls within a list of IP addresses or CIDR ranges. Both IPv4 and IPv6 are supported.

The SemVer operators now include SEMVER_GTE and SEMVER_LTE, so you can target versions greater than or equal to, or less than or equal to, a given version with a single constraint.

All three operators require an SDK version that supports them. See SDK compatibility for the minimum version per SDK.

[8.3.0] - 2026-10-27

Bug Fixes

• Hide SSO options on the invitation screen (#12622)

• Make client registration writes resilient to deadlocks (#12619)

• Show more honest graphs / align time series

• Avoid cleaning the negative cache

• Harden the signup endpoint

• Help announcement colors

• Count every environment toggle attempt, not just confirmed dialogs

• Apply the OSS default-project rule in project read model

• Clean up v2 token clients

• Apply the OSS default-project rule to personal dashboard flags

• New strategies flow - apply ui feedback

• Reject duplicate strategy parameter names (#12632)

• Cross-project IDOR in feature links (GHSA-65r2-v52f-778r)

• SSRF guard bypass via IPv6 transition addresses

• ReDoS via feature-naming regex

• Race condition in password-reset/invite token allows single-use bypass and silent password overwrite

• Clear announcer timeouts

• Small playground ui issues

• Reflected XSS in admin email-preview endpoint (GHSA-5c47-jgc3-3gm4)

• Flag env name typo

• Update regex SDK requirements

• Playground sidebar minor fixes

• Evaluate "parent must be off" dependencies like the SDK

• Update dependency ip-address to v10.5.1 [security] (#12686)

• Keep line breaks in string variant payloads

• Update dependency ip-address to v10.7.1 [security] (#12694)

• Feature lifecycle project belonging check

• Remove duplicated description

• Strategy env check

• Segment strategy project and env check

• Update dependency ip-address to v10.7.2 (#12702)

• Update dependency @fern-api/search-widget to v0.5.6 (#12701)

• Return sensitive fields as masked on update/create

• Show the safeguard trigger window on closed change requests

• Drain scheduled jobs before database shutdown

• Use Dockerfile Node version by default in Bake (#12713)

• CSP rules can't depend on the dynamic flag

• Require frontend E2E success in PR build gate (#12715)

• Remove usage of node:util in the frontend app

• Force OIDC re-auth behind sessionTimeouts (EG-4756)

• Hydrate streaming state and revision from one database snapshot

• Don't force ChangeRequestTable width to avoid breaking layout on smaller breakpoints

• Adjust CreateProjectDialog modal sidebar height regardless of content scroll

• Disable keyboard shortcut when its triggers are hidden, resolve modifiers exactly

• Flag name placeholder shows the project's naming example

• Document the empty response of the environment toggle endpoints

• Add endSession() and call it from six different modules

• Tell a missing session start from an unreadable one

• Incorrect bulk-tag assignment

• Silent errors on assigning single-emoji tag

• Reviewer button layout

• Stop useLocalStorageState from writing outdated values on re-render

• Don't render an empty div if there is no limit warning

• Compare users.updated_at at ms precision in user sync

• Say when a logout was the session's timeout

• Start recurring interval after the initial jitter

• Clean up never-seen system API tokens

• Reduce the focus outline on Radio, Checkbox and Switch controls

• Initialize revision baseline alongside frontend cache warming

• Exclude potentially-stale and lifecycle events from configuration revisions

• Share token validation caches with Edge

• Remove RecentlyUsedSegments from new Strategy form

• Disable Modal focus trap when Unleash Toolbar is enabled

• Compact dialog header and truncate long project names

• Make chip text selectable on constraint editor

• Enforce hard max-age regardless of the sessionTimeouts flag

• Use UTC dates for the default event log range (#12731)

• Write flag events when an environment is removed from a project

• [breaking] Remove administrative metadata from Client API configuration

• Skip existing links and roll back failed startup environment overrides

• Only compare strategies for the stale data dialog

• Add max height and dismiss button to the stale data dialog

• Await segment insertion instead of fire and forget

• Wrong tooltip title for link actions

• Api token list permission checks

• Does no lo...

Changelog

All notable changes to this project will be documented in this file.

[8.2.1] - 2026-10-22

Bug Fixes

• Bump Node to 22.23.4 to distrust compromised eMudhra CAs (#12744)

Documentation

• Update CHANGELOG.md

Release Notes

New in Unleash page for Open Source

The New in Unleash page is now also available in Unleash Open Source. It shows the latest capabilities added to Unleash and indicates which of them are Enterprise features. From the page, you can get started with a feature, read more in the documentation, request access to beta features, and see what we are working on next. You can find it in the Help & Resources menu in the top navigation.

Filter flags by creator

The flags overview now includes a Created by filter, so you can filter flags by the user who created them.

Changelog

All notable changes to this project will be documented in this file.

[8.2.0] - 2026-09-08

Bug Fixes

• Don't claim success when marking a flag stale fails

• Use teams icon for teams workflow

• Announce toast messages to screen readers

• Re-announce repeated messages in the announcer

• Don't show skip link on pages that don't have a nav target

• Button in button in release plans

• Stop toolbar flag reads from re-rendering during render

• Invoke scheduled database pool metrics sampler

• Background color in impact metric modal

• Empty groupId in default strategy

• Replace linear token scan with a Map lookup

• Delete variant button placement

• Avoid relying on secret shape in the UI

• System token cleanup: wrote no audit events

• Safely rate limit authenticated token traffic

• Make system token cleanup delete and audit atomically

• Keep the access log list visible while changing sort order (#12573)

• Edge issued tokens should not count towards token limit

• Dedupe react and mui in vite to prevent duplicate copies (#12578)

• Accept semver build metadata in constraint values

• Make mutations and audit events transactional

• Disconnect the access log skeleton from the users-list loading (#12580)

• Onboarding checklist in safari showing corners after drag

• Invalidate tokens when environments are deleted

• Feature status tooltip

• No tooltip on healthy and unknown flag status

• Cross-project variant overwrite

• Url normalizing in query

• Update dependency @fern-api/search-widget to v0.5.4 (#12614)

• Prevent dark mode email templates

• Sets description as title and the description of description as helptext

• Restate long label in the tooltip so that you have a chance to read it

• Treat single-character templates as valid in ServiceNow and webhook addons

• Cross-project IDOR on feature-dependency routes

Documentation

• Fix dead Code Kitchen podcast link in README (#12579)

• Update CHANGELOG.md

Features

• Hide copy action for secure project tokens

• Track flag page header actions

• Gate Remote MCP admin UI to Enterprise plan

• Flags overview - enable filtering flags by creators

• Track flag page tag actions

• Securely store personal and service account tokens

• Uxtweak survey adapter — flag discovery and survey card

• Add unique eventId to custom tracking events to prevent deduplication

• Track sustained hovers on the lifecycle tooltip

• Include secure PAT metadata

• Audit service account token lifecycle

• New users tabbed design (#12523)

• Impact metrics labels loading indicator

• Add generic dialog-dismissed tracking

• Optimize label lookups for impact metrics

• Impact metrics ui fetching optimization

• Emit dialog dismissals as journey events

• Track project status modal engagement

• Track environment toggles on project flags list

• Track the shape of strategies people configure

• Add resumable scheduled job buckets

• Add automations on release plan templates

• Survey question UI

• Instrument the API token caches (v1 + v2)

• Add token cache watermark

• Add automations to release templates from UI

• Add exposure transition condition type

• Allow exposure based transition behind flag

• Add inactive users tab to the tabbed users admin page (#12540)

• Add generated orval models for the user access log (#12557)

• Add Access log tab to the users admin page (#12552)

• Mount UxTweakWidgets in the app shell

• Gate uxtweak surveys behind an internal feature flag

• Make the access log pagination bar stick to the bottom (#12575)

• Shortest time frame by default in impact metrics and safegaurds

• Ask ai docs widget

• Add a bounded single-flight cache

• Add exposures option and transition condition union types

• Support exposure-based automations in release plans and templates

• Add flag controlling single-flight caching

• 7-day grace period between uxtweak surveys

• Further uxtweak survey hardening

• Show automations in CR release plan from template

• Synchronize token caches across pods

• Analytics has info about automation type used in template

• Cap how often an ignored survey is shown

• Add user-agent in login/logout events - EG-4692

• Mutation tracking hook and form template events

• Track segment journeys

• Track context field journeys

• Track flag row actions and lifecycle

• Track project settings journeys

• Track project access journeys

• Simpler strategy setup - part 1 : add a flag and placeholder screen

• Surface project-scoped Slack integrations in project settings

• Strenghten the requirement around appName (#11628)

• Make the winning survey deterministic across page loads

• Simpler strategy setup - part 2: extract shared hooks + regression test

• Submit survey answers to the UX Tweak server

• Add totalUsage to feature usage metrics, behind flag

• Simpler strategy setup - part 3: the two setup cards

Miscellaneous Tasks

• Show tooltip after closing Getting started checklist

• Don't run open animation all the time

• Mark real Unleash tour completion

• Hide advanced intro steps behind flag

• Remove projectReleaseTemplate flag

• Remove unused gh actions

• Onboarding checklist metrics

• Hide onboarding checklist if any project is onboarded already

• Enable pending access requests notifications

• Backend sharding

• Add missing key in map

• Remove redundant fragment

• Delete dead code

• Fix a number of minor lints

• Consistent flag names for the onboarding intro tour

• Remove unused title tracking

• Alias IFeatureStrategyPayload to FeatureStrategySchema

• Delete deprecated IFeatureStrategyPayload schema

• Remove IFeatureStrategyParameters in favor of ParametersSchema

• Intro tour tooltip

• Add releaseTemplatesAutomations flag

• Correct paths for onboarding avatras

• Add Enteprise tag to the new features

• Separate short tour description

• Reword automation button on template form

• Update texts and fix styling a little

• Chat help

• Add missing hubspot domain

• Second batch of hubspot domain exclusions

• Log alias usage and stop creating alias for edge

• Relax security for the chat

• Make sure we send data

• Fix chat unknown visitor

• Block hubspot tracking pixels

• Add back the pixel domain

• Check billing before relaxing CSP

• Remove sessionInspector flag

• Bump js-yaml to 4.3.1

• Add semverBuildMetadata flag

• Try improving delay before tour is marked as done

• Hide frontend support for semver metadata behind flag

• Close project onboarding when it's done

• Adds Slack integration project level flag -> slackIntegrationProjectLevel

• Regenerate all orval types

• Rate limit search features, set to p95 of current usage

• Skip the failing test ProjectFeatureToggles.test.tsx‎ 'shows archived batch actions when every selected flag is archived'

• Bump orval from 7.21.0 to 8.22.0

• Re-generate types with Orval 8.22.0

• Bump @faker-js/faker from 10.4.0 to 10.5.0

• Fix e2e tests with just a healthcheck (#12610)

• REST API Guidelines (#12544)

• Fix broken links in REST API guideline (#12618)

Performance

• Intern low-cardinality flag string constants (#12532)

• Intern constraint operator and contextName (#12538)

• Canonicalize strings at cache boundaries (#12541)

• Reduce feature search segment fan-out

Refactor

• Enable useExhaustiveDependencies for App.tsx and fix warnings

• Centralize secure token primitives

• Improve typing around strategy edits (remove deprecated IFeatureStrategyPayload)

• Unify transition condition component

• Share transition condition input state

• Centralize rate limits around authentication

• Move impact metrics modal to impact metrics header

Styling

• Polish floating onboarding checklist styling (#12528)

Testing

• Some missing tests for onboaring checklist

• Uxtweak survey adapter tests

• Avoid snapshotting the default config

• Survey question UI

• Fix flaky ProjectFeatureToggles archived-b...

Unleash v8.1.0

Improved projects overview

The projects page now gives you a quicker overview of the status of your projects. Project cards surface anything that needs your attention, such as pending change requests, remaining setup steps, flags that are ready to be cleaned up, and safeguards that have been triggered, so you can act without opening each project.

Streamlined flag lifecycle and archive views

It is now easier to follow how flags move through their entire lifecycle. You can switch between the different lifecycle phases, including archived flags, in one cohesive view instead of navigating to several places to find flags in different phases.

Clone context fields

You can now clone a context field from the context field list, both in the global admin view and in project settings. Cloning opens the create form pre-filled with the source field's description, legal values, and stickiness, so you can quickly recover from a typo in a context field name or create a similar field without retyping a long list of legal values.

Create impact metrics from the UI

You can now create an impact metric directly in the Admin UI. On the feature flag page, click Add impact metric in the impact metric banner. Previously, metrics could only be defined in code through an SDK.

New help menu

The top navigation has a new help menu that gathers useful links in one place: the Unleash Learning Lab, what is new in Unleash, documentation, GitHub, feedback, and the Slack community. Several of these links previously lived in the footer and are now easily accessible from anywhere in the Admin UI.

ServiceNow integration in beta

The new ServiceNow integration automatically tracks the state of your Unleash change requests in ServiceNow, giving you an audit trail of changes that are created, approved, and applied in Unleash.

Changelog

All notable changes to this project will be documented in this file.

[8.0.3] - 2026-07-10

Bug Fixes

• Linting errors (#12441)

• Close any open page before opening a new pageview (#12444)

• Normalize trailing slash in tracked page paths (#12445)

• Do not pollute global Mustache state (#1222)

• Do not pollute global Mustache state (#1222)

• Remove extra thick outline on help button (#1218)

• Do not pollute global Mustache state (#1222)

• Remove extra thick outline on help button (#1218)

• Don't allow cloning features across projects

• Strategy operations have previously only needed id

• Updating sort orders requires strategy to belong to feature

• Since title and display name is user entered have mustache filte…

• Added check that all toggles are part of the project in the url

• Prevent cross project segment update

• Project mode should not allow global access

Documentation

• Update CHANGELOG.md

Features

• Add SEMVER_GTE and SEMVER_LTE constraint operators (#11708)

• Frontend impression events (#12435)

• Correlate session id (#12437)

• Track engaged time per page view

• Remove logrocket event tracking setup (#12385)

• Add pathname to custom tracking events (#12452)

• Poll ServiceNow for open mapped change request states (#1197)

• Make project onboarding steps visible to LogRocket (#12453)

• Add active sessions inspector

• Project level release templates flag

• Project level release templates migration

• Add optional project to template store

• Specialized queries for release template variants

• Release template events project

• Render inputs with top (instead of floating) label behind flag

• Project release templates screen in project settings

• Add new permission for updating project release templates

• Project release template permission application

• Read-only project release templates list

• Pass Input descriptions as a prop, drop redundant ones

• Add custom AutocompleteField, migrate SelectSdk to it

• Context field cross project hardening

• Refresh feature view on interval

• Include global templates in project template resource

• Create, edit and archive project release templates

• Add custom SelectField, migrate BannerForm to it

• Disable release template actions while saving

• Add FormGroup and use it in BannerForm

• Track release template errors and scope

• List project release templates before global ones

Miscellaneous Tasks

• New in unleash page - groundwork (#1200)

• Run oss ci checks in enterprise (#1202)

• Sync OSS subtree from upstream

• New in unleash feature images (#1208)

• New in unleash feedback follow up (#1204)

• Update notify_enterprise.yaml (#12443)

• New in unlash set up last 3 features data

• New in unleash better images (#1213)

• Import OSS subtree with full history (#1212)

• New in unleash feature share your input

• Import OSS subtree with full history (#1212)

• New in unleash feature share your input

• Import OSS subtree with full history (#1212)

• New in unleash feature share your input

• Add a checked target we can enforce in CI

• New in unlash styling

• No early access features

• Rename flag to whatsNewPage

• Disable old new in unleash when whatsNewPage flag is on

• What's new - rename

• Add what's new to help & resources

• What's new - add events

• What's new fix inconsistent whitespace

• What's new Share your input - add a popup for showing the email

• What's new page - improve column widths

• Add snow icon

• Clean up flag hideTopmenuDocumentation

• What's new different milestone progression and safegrauds link

• Add topLabelInputs feature flag

• Tidy package lifecycle scripts

Refactor

• What's new fix styled component names

Testing

• Add story file for new in unleash card (#1207)

• Run OSS unit tests without per-file isolation

• Try fixing operational flaky test

Dev

• Lazy-load story modules in StoriesPage

• Enable _stories page on production with flag

• Lint styled component name

• Unify lint and lint:fix

• Allow exported component names to not have Styled prefix

• Remove not needed button stories

• Flag flagListCreatedByFilter

Changelog

All notable changes to this project will be documented in this file.

[8.0.2] - 2026-06-29

Bug Fixes

• Json editor cursor color (#12354)

• Infinite update loop (React error 185) when editing segment constraints with legal values (#12366)

• Change password should not be available with SSO (#12376)

• Don't trap curson on profile menu theme selection (#12393)

• Prevent nested json errors (#12408)

• Prevent nested json error pt2 (#12410)

• Make addons accept allowlists and deny private ip by default (#12419)

Documentation

• Update CHANGELOG.md

Features

• Add top movers modal (#12326)

• Create teamsworkflowaddon (#12344)

• Added htmlInput validation extension for joi schemas (#12377)

• Add flight recorder to event trackers (#12375)

• Add flightRecorderAdminEvents flag (#12378)

• Design system improvements — buttons + shared control foundation (#12294)

• Configure flight recorder url (#12379)

• Flush events on user leaving the page (#12381)

• Remove log rocket from event tracker (#12382)

• Use event tracker for search component (#12384)

• Allow csp flight recorder (#12387)

• Add registerProvider to AddonService (#12383)

• Anonymize flight recorder context (#12395)

• Gate servicenow addon behind serviceNowIntegration flag (#12398)

• Hash email context (#12397)

• Hash email upfront (#12403)

• Replace plausible tracker with event tracker (#12402)

• Add servicenow_change_references table (#12407)

• Add flightRecorderFrontend variant flag (#12413)

• Drive SDK flight recorder from feature flag (#12416)

Miscellaneous Tasks

• Simple code highlighting for onboarding (#12298)

• Onbording wrap your code min height (#12332)

• Help and resources learning lab variants handling (#12337)

• Add wrap to our main text element (#12349)

• Add teams-workflow and update links in schemas (#12352)

• Show help&resources when flags are enabled (#12350)

• Help&resources - report flag variant (#12353)

• Enable COEP for non-api requests (#12367)

• Update coep header to be credentialless, i.e. not include cooki… (#12374)

• Update pnpm to 11.8.0 (#12373)

• Better header for smaller screens (#12368)

• Fixing feedback list formatting (#12380)

• Feedback 5 start rating (#12386)

• New learning lab url (#12391)

• Fix invite users dropdown position (#12392)

• Fix help resources icon shape (#12394)

• Add servicenowintegration flag (#12396)

• Support arrow keys navigation in user profile theme selection (#12399)

• Update feature types descriptions (#12341)

• Cap codebox height (#12343)

• Use OIDC for static asset publishing (#12409)

• Access request notifications (#12406)

• Highlight access request (#12411)

• Bump @unleash/sdk-flight-recorder to 0.6.0 (#12418)

• Highlight access request with Highlight component (#12417)

• Remove highlights from access requests (#12423)

• Pending access request menu indicator (#12420)

• Bump flight recorder (#12424)

• Bump unleash-client to 6.11.1 (#12429)

• Add access-request-notifications events (#12430)

• Optimize frontend evaluation (#12428)

Refactor

• Simplify button (#12422)

Testing

• E2e groups failure (#12340)

• Try fixing e2e group deletion test (#12351)

Changelog

All notable changes to this project will be documented in this file.

[7.6.5] - 2026-06-29

Bug Fixes

• Nested json and addon url verification (#12434)

Documentation

• Update CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

[7.5.2] - 2026-06-29

Bug Fixes

• Handle json serialization and url validation for addons (#12436)

Documentation

• Update CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

[8.0.1] - 2026-06-16

Bug Fixes

• Invalidate other sessions on password change (#12262)

• Update lifecycle counts immediately after archiving/reviving/deleting flags (#12274)

• Keep stable legacy endpoints for a bit longer (#12307)

• Vulnerabilities (#12325)

Documentation

• Add unleash_test database creation step to setup guide (#12254)

• Update CHANGELOG.md

Features

• Support filtering feature search by the archived lifecycle stage (#12260)

• Update flags overview page to include archived (#12268)

• Allow impact views to use 3 months and 6 months window (#12276)

• Archived features in impact views (#12287)

• Select theme preference from user profile menu (#12300)

• Add wiring (#12318)

• Prepare details for modal (#12323)

Miscellaneous Tasks

• Onboarding php snippet update (#12256)

• Onboarding ios snippet update (#12261)

• Trust @unleash/proxy-client-react (#12269)

• Onboarding add Next.js snippet (#12273)

• Redirect /archive to flags page (#12279)

• Add react native to onboarding and add missing integrations (#12280)

• Add newProfileDropdown feature flag (#12290)

• Redesign user profile dropdown as MUI menu behind flag (#12289)

• Upgrade react router to v7 (#12241)

• Remove react-router-dom import (#12295)

• Move avatar section from user profile button to dropdown (#12291)

• Hide documentation from top header if flag enabled (#12297)

• Add release versions to endpoints (#12309)

• Enforce release definition (#12310)

• Add new help icon with menu (#12308)

• SelectSdk dropdown improvements (#12306)

• Show theme sub menu on hover (#12317)

• New help option and fix sizes (#12319)

• Basic events for help resources (#12320)

• Add TS safeguard around formatAssetPath trap (#12321)

Refactor

• Migrate project flags table ActionsCell to MUI Menu (#12277)

• One sdk icons list (#12288)

Testing

• Make flag name match in any html element (#12270)