Formbricks - Package Updates

[Package Updates]

[2.9.11]

• Update formbricks to 5.1.2
• Full Changelog
• fix: avoid undefined workspace redirect (Backport) [ENG-1463] (#8300) by @Dhruwang in #8304

[Package Updates]

[2.9.12]

• Update formbricks to 5.1.3
• Full Changelog

[Package Updates]

[2.9.13]

• Update formbricks to 5.1.4
• Full Changelog

[Package Updates]

[2.10.0]

• Update formbricks to 5.2.0
• Full Changelog
• feat: add dynamic pricing tooltip to billing plan cards by @jobenjada in #8247
• feat(auth): migrate authentication from NextAuth to Better Auth [ENG-1054] by @xernobyl in #8384
• feat: cardless link surveys by @jobenjada in #8273
• feat: support app surveys in the v3 Surveys API by @xernobyl in #8307
• feat(teams): gate bulk invite behind Scale plan and rate-limit invites by @Dhruwang in #8331
• fix: enforce action-aware role checks on storage routes by @Dhruwang in #8242
• fix: redact webhook signing secrets from management API responses by @Dhruwang in #8269
• fix: prevent manager privilege escalation via v2 organization-users API [ENG-1518] by @pandeymangg in #8438
• fix: reject scheme-relative callback URLs in login redirect [ENG-1636] by @xernobyl in #8462
• fix(survey-ui): scope Tailwind v4 global CSS to #fbjs to stop host-page pollution by @Dhruwang in #8378

[Package Updates]

[2.10.1]

• Update formbricks to 5.2.1
• Full Changelog
• fix: enforce organization/workspace scoping across API keys, surveys, quotas, and integrations (ENG-1749) (backport to release/5.2) by @xernobyl in #8598
• fix: bump tar to 7.5.19 to patch decompression DoS (backport #8604 to release/5.2) by @Dhruwang in #8607

[Package Updates]

[2.10.2]

• Update formbricks to 5.2.2
• Full Changelog
• fix(billing): stop reverse trial laundering into active paid plan (backport #8602 to release/5.2) by @Dhruwang in #8658
• fix(security): scope historical response import to the authorized workspace (backport #8679 to release/5.2) by @mattinannt in #8686

[Package Updates]

[2.11.0]

• Update formbricks to 5.3.0
• Full Changelog
• feat(helm): add Hub volume extension points by @BhagyaAmarasinghe in #8504
• feat(auth): reject breached passwords via Have-I-Been-Pwned on password set (ENG-1587) by @xernobyl in #8508
• feat(segments): interaction-based segment filter (ENG-1275) by @Dhruwang in #8588
• feat: soft-delete (archive) surveys (ENG-1042) by @Dhruwang in #8609
• feat: formbricks workflows - epic MR by @itsjavi in #8281
• fix: let MCP clients request surveys:write and correct validate_survey scope by @xernobyl in #8509
• fix: enforce organization/workspace scoping across API keys, surveys, quotas, and integrations (ENG-1749) by @xernobyl in #8596
• fix(security): scope historical response import to the authorized workspace [1/4 critical] by @mattinannt in #8679
• fix(security): close the high-severity auth, authz and exposure gaps [2/4 high] by @mattinannt in #8680
• fix: bump next to 16.2.11 to patch 9 Next.js CVEs by @mattinannt in #8633

[Package Updates]

[2.11.1]

• Update formbricks to 5.3.2
• Full Changelog
• fix: prevent duplicate otel log export (backport release/5.3) by @BhagyaAmarasinghe in #8771
• fix(survey): use validated SURVEY_SCHEDULING_TIME_ZONE for archive purge (backport #8767 to release/5.3) by @Dhruwang in #8768

[Package Updates]

[2.11.2]

• Update formbricks to 5.3.3
• Full Changelog
• fix(security): tie the contact detail page to the workspace in the URL (backport #8789 to release/5.3) by @Dhruwang in #8790

[Package Updates]

[2.11.3]

• Update formbricks to 5.3.4
• Full Changelog
• fix(surveys): stop no-overlay surveys blocking the host page (backport #8804 to release/5.3) by @pandeymangg in #8814

[Package Updates]

[2.12.0]

• Update formbricks to 5.4.1
• Full Changelog
• fix(sso): strip the live local auth factors on SSO recovery (backport 5.4) by @xernobyl in #8998
• fix(auth): stop paging on client-caused OAuth state rejections (ENG-2471) [backport 5.4] by @xernobyl in #9011
• fix(sso): stop Microsoft SSO failing on a multi-tenant authority (backport #9017 to release/5.4) by @xernobyl in #9028
• fix(sso): stop generic OIDC failing on a Microsoft multi-tenant authority (backport #9023 to release/5.4) by @xernobyl in #9057
• feat(observability): record the outcome of every SSO callback (backport #9026 to release/5.4) by @xernobyl in #9058
• fix(auth): keep MCP OAuth resource seeding recoverable (backport #9065 to release/5.4) by @xernobyl in #9070
• feat(billing): provision metered workflow_runs price on scale subscriptions by @Dhruwang in #8735
• feat(analytics): add PostHog AI and MCP observability by @harshsbhat in #8774
• feat(dashboards): add dashboard-level date filter (ENG-1553) by @Dhruwang in #8773
• feat: add org-level display timezone for response export timestamps by @Dhruwang in #8791

[Package Updates]

[2.12.1]

• Update formbricks to 5.4.2
• Full Changelog
• fix: keep Redis connections alive (backport #9124 to release/5.4) by @BhagyaAmarasinghe in #9127
• fix: fall back to database for Redis session errors (backport #9125 to release/5.4) by @BhagyaAmarasinghe in #9126
• fix: support Redis 6 verification token consumption (backport #9129) by @BhagyaAmarasinghe in #9130
• fix: make CSAT and CES scale labels translatable (backport #9136 to release/5.4) by @Dhruwang in #9142

[Package Updates]

[2.12.2]

• Update formbricks to 5.4.3
• Full Changelog
• fix(security): bump next to 16.3.3 for two critical RCE advisories (backport #9225 to release/5.4) by @xernobyl in #9266
• fix(responses): bound the "Other" response filter instead of permuting every subset (backport #9253 to release/5.4) by @xernobyl in #9256
• fix(helm): support Gateway API v1.5 clusters (backport #9291 to release/5.4) by @BhagyaAmarasinghe in #9293
• Full Changelog: https://github.com/formbricks/formbricks/compare/5.4.2...5.4.3

[Package Updates]

[2.12.3]

• Update to 5.4.5
• Full Changelog

[Package Updates]

[3.0.0]

• Update formbricks to 6.1.2
• Full Changelog
• fix(link-survey): gate the link page, its routes and actions on a servable survey (backport #9702 to release/6.1) [ENG-4032] by @xernobyl in #9780
• fix(saml): cap XPath-selected elements by local name before jackson parses (backport to release/6.1) [ENG-6648] by @xernobyl in #9807
• fix(security): bump next to 16.4.1 and patch 2 advisories (backport #9804 to release/6.1) by @Dhruwang in #9830
• fix(link-survey): require the single-use link in the public PIN and verify-email actions (backport #9790 to release/6.1) [ENG-4041] by @xernobyl in #9839
• fix(email): send every email to exactly one recipient (backport #9796 to release/6.1) [ENG-6658] by @xernobyl in #9840
• Encrypted single-use links stop working. Links created before 6.1 with URL encryption on (the default) are rejected after the upgrade. Re-create and re-send them. If you need more time, set SINGLE_USE_LEGACY_UNSIGNED_UNTIL to a date in YYYY-MM-DD format, for example 2026-11-15: old links keep working until 00:00 UTC on that day.
• Ending-card URLs need a real host. buttonLink and url on ending cards (v1, v2 and v3 survey create and update) must use a hostname with a dot (intranet.example.com), localhost or an IP address. A host like http://intranet now returns 400.
• Hidden fields can't share a name with a question. Adding one on POST or PUT /api/v1/management/surveys returns 400.
• feat(authorization): survey visibility and its operational model [ENG-3282] by @Dhruwang in #9412
• feat: dark mode and Custom CSS for surveys by @itsjavi in #9549
• feat(surveys): import Qualtrics surveys from .qsf files by @pandeymangg in #9595

[Package Updates]

[3.1.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra certificate vulnerability