This release brings Cloud for Organizations to the desktop app, adds admin workspace visibility, keyboard shortcut support for non-English layouts, and optional SMTP authentication, alongside security patches and bug fixes.
Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-3-0.
What's Changed
- fix(common): persist OAuth2 code challenge method selection by @umutkeltek in #5921
- chore(common): update Chinese translations by @jiangzm in #5979
- fix(common): prevent stored XSS in team member overflow tooltip by @jamesgeorge007 in #5984
- fix(common): fetch full team collection tree on workspace import by @chhaviG22 in #5792
- fix: restore tooltips on icon-only buttons inside popover triggers by @nikhilmahato21 in #5935
- fix(common): prevent infinite auth refresh retry loop on permanent token failure by @danielalanbates in #5893
- fix(desktop): add native Edit menu to enable clipboard shortcuts on Linux by @umutkeltek in #5920
- fix(common): prevent open redirect in enter page by @jamesgeorge007 in #5982
- chore: security patch for the dependency chain
v2026.3.0by @mirarifhasan in #6013 - fix(backend): prevent stored XSS via mock server responses and cross-team request moves by @mirarifhasan in #6006
- feat: add
MAILER_SMTP_IGNORE_TLSand optional SMTP auth by @mirarifhasan in #5972 - feat: show user workspace memberships in admin dashboard by @mirarifhasan in #5968
- refactor(common): route mock server and published docs operations through platform backend by @nivedin in #6036
- feat(desktop): cloud for orgs support - phase 3 by @CuriousCorrelation in #6043
- fix: keyboard shortcuts on non-English layouts by @CuriousCorrelation in #6009
- fix(common): use operation title as fallback in OpenAPI import by @hypergadam in #5950
- fix(common): handle File objects in HAR postData text resolution by @sh3xu in #5917
- fix(desktop): add missing backport changes by @CuriousCorrelation in #6047
- fix: validate device-login redirect_uri to prevent token theft via DNS wildcard bypass by @nahidhasan94 in #6012
- feat(common): fall back to
ref_idin remove functions whenidis missing by @anwarulislam in #5898 - chore: patch dependency vulnerabilities and harden production image by @mirarifhasan in #6055
- fix: use team.findMany for fetching user teams by @mirarifhasan in #6057
- fix(common): resolve history schema mismatch on page reload by @nivedin in #6068
- chore: align Tauri plugin-shell versions by @CuriousCorrelation in #6069
- fix(common): newly created folder not shown in save-as dialog by @majiayu000 in #6059
New Contributors
- @umutkeltek made their first contribution in #5921
- @nikhilmahato21 made their first contribution in #5935
- @danielalanbates made their first contribution in #5893
- @hypergadam made their first contribution in #5950
- @nahidhasan94 made their first contribution in #6012
- @majiayu000 made their first contribution in #6059
Full Changelog: 2026.2.1...2026.3.0
SOCIAL SHARE CARD GENERATOR