2026.4.0

This release introduces collection-level pre-request and test scripts, desktop settings with manual update controls, refinements to the API documentation experience, and self-hosted improvements, including SMTP OAuth2 authentication, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-4-0.

What's Changed

• refactor(cli): match test-result helper name to documented contract by @Basavaraj8143 in #6122


• feat(backend): use stateless OAuth2 state store by @mirarifhasan in #6098


• fix(common): handle non-string values in Postman collection import by @okxint in #6137


• fix(common): correct environment locale wording by @PallavSarkar2005 in #6117


• fix(data): make $randomUUID predefined variable RFC 4122 compliant by @Grizouforever in #6125


• chore(common): complete missing Spanish translations by @Pakvothe in #6109


• chore(common): complete missing Turkish translations by @onwp in #6071


• chore(common): modify Chinese translation of words by @jiangzm in #5996


• fix(common): add missing aria-labels to icon-only sidenav links by @rayrishu19-wq in #6160


• fix(common): variable hover tooltip was not clickable (disappeared) by @AaronFortG in #6155


• feat: add SMTP OAuth2 authentication support by @mirarifhasan in #6141


• fix: resolve invalid environment validation when publishing docs in personal workspace by @sahilkhan09k in #5962


• feat(common): improve API documentation publishing UX by @nivedin in #6116


• fix: remediate quinn-proto vulnerability across native packages by @CuriousCorrelation in #6174


• docs: security threat model and policy update by @CuriousCorrelation in #6158


• fix(common): apply platform default proxy URL on load and reset by @nivedin in #6142


• feat: add collection-level pre-request and test scripts by @johnan319 in #5745


• fix(common): support id_token in Authorization Code OAuth flow by @anwarulislam in #6144


• feat(desktop): settings phase 0 - infra and update check by @CuriousCorrelation in #6172


• feat(selfhost-web): make webapp-server timeouts configurable by @rkferreira in #6147


• fix(common): restore magic-link sign-in flow on cloud for orgs by @jamesgeorge007 in #6237


• fix(desktop): unified store scope and migration reroute by @CuriousCorrelation in #6238


• chore: security patch for the dependency chain v2026.4.0 by @mirarifhasan in #6191


• fix(backend): harden onboarding config endpoint by @mirarifhasan in #6240


• fix(common): set domain url as mockserver environment by @nivedin in #6185


• fix(common): subfolder add-new in team collections respects write access by @nivedin in #6243


• fix(common): preserve string contract for GQL history responses by @jamesgeorge007 in #6244

New Contributors

• @Basavaraj8143 made their first contribution in #6122


• @okxint made their first contribution in #6137


• @PallavSarkar2005 made their first contribution in #6117


• @Grizouforever made their first contribution in #6125


• @Pakvothe made their first contribution in #6109


• @onwp made their first contribution in #6071


• @rayrishu19-wq made their first contribution in #6160


• @sahilkhan09k made their first contribution in #5962


• @johnan319 made their first contribution in #5745


• @rkferreira made their first contribution in #6147

Full Changelog: 2026.3.1...2026.4.0