What Kong/insomnia shipped
Written by FoxPlug from the repository's own releases; not affiliated with Insomnia. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/Kong/insomnia; Insomnia did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Path containment checks were added to restoreBackup, the data directory IPC handler and the git filesystem client, and the userData folder guard moved into its own path-guard module. Pull request #10443
- Environment data exported to git no longer comes out with the wrong field order. Pull request #10580
- The environment model now uses a Zod schema, and environment related types are exported from that schema and used in the import parser. Pull request #10516
- The base model now uses a Zod schema with inferred types, plus a utility that makes nested schema parts strict. Pull request #10515
- Several dependencies were bumped, including xmldom, dompurify, ajv, es-toolkit and swagger-parser. Pull request #10444
- The faker dependency was bumped from 9.7.0 to 10.6.0, resolving a reported CVE. Pull request #10569
- The app version was bumped to 13.3.1. Pull request #10579
- Version 13.3.1 was released. Release
- A run now starts only for people who can write to the repository. Pull request #10578
Why it matters
This week brings a set of fixes and groundwork: path containment checks limit where backup, data directory and git file operations can act, environment export order is corrected, and environment and base models move to Zod schemas with inferred types. Dependency bumps, including one that resolves a reported CVE, keep the app current, and version 13.3.1 is out.
Changelog entry
- Validate paths stay within their intended base directory in restoreBackup, the data directory IPC handler and the git fs client. Pull request #10443
- Fix environment schema git export field order issue. Pull request #10580
- Unify and migrate the environment model to a Zod schema and infer type. Pull request #10516
- Add base model schema and a deep strict utility. Pull request #10515
- Bump dependencies including xmldom, dompurify, ajv, es-toolkit and swagger-parser. Pull request #10444
- Bump @faker-js/faker from 9.7.0 to 10.6.0, resolving CVE-2026-73231. Pull request #10569
- Bump app version to 13.3.1. Pull request #10579
- Release 13.3.1. Release
- Start a run only for people who can write to the repository. Pull request #10578
Insomnia 13.3.1 is out. This week: path containment checks for backup, data dir and git fs operations, fixed environment export field order, environment and base models moved to Zod schemas, dependency bumps including a CVE fix.
Insomnia 13.3.1 is out. This week's changes include containment checks in restoreBackup, the data directory IPC handler and the git fs client, so a supplied path cannot resolve outside the directory it is meant to operate in. The environment schema export order issue is fixed, and the environment and base models now use Zod schemas with inferred types, with a utility for deep strict nested schemas. Dependencies were bumped, including faker 10.6.0 which resolves a reported CVE, and a run now starts only for people who can write to the repository.
Week of September 28, 2026
What shipped
- Cookie source tags (manual vs response) now survive Insomnia-to-Insomnia export and import cycles instead of being flattened to manual. Pull request #10533
- Collection Runner data upload now correctly parses CSV fields with commas inside quotes per RFC 4180 instead of splitting them across columns. Pull request #10557
- Environment variables and key-value editor tables no longer swallow spaces typed after other characters, fixing the need to manually reposition typed text. Pull request #10563
- Toast notification animations no longer intercept clicks meant for underlying interface elements. Pull request #10553
- Import deep-link cURL auto-scan smoke test fixed to run reliably on CI instead of failing intermittently. Pull request #10555
Why it matters
These fixes address data integrity issues with cookies and CSV imports, improve input handling in common workflows like environment variable editing, and resolve UI interaction problems with notifications. The fixes cover both user-facing features and test reliability.
Changelog entry
- Feat: preserve cookie source (manual/response) through v5 format export and import Pull request #10533
- Fix: collection runner CSV data upload now handles quoted fields with commas correctly Pull request #10557
- Fix: key-value editor typeahead no longer swallows spaces in typed text Pull request #10563
- Fix: toast animations no longer intercept clicks on underlying page elements Pull request #10553
- Fix: import deep-link cURL scan smoke test reliability on CI Pull request #10555
This week: cookies preserve their source through exports, CSV imports handle quoted fields correctly, spaces stop disappearing in variable editors, and toasts stop blocking clicks.
New fixes in Insomnia: cookie metadata now persists through export/import cycles, CSV parsing respects RFC 4180 quoted fields, the environment variables editor stops eating spaces, toast notifications won't steal clicks, and improved test stability for import features.
Week of September 21, 2026
What shipped
- Version 13.3.0 released with fixes for database change notifications, JSON vault config display, and codemirror assertions. Release
- Added Export OpenAPI Spec option to the collection context menu, letting users export as YAML or JSON directly from the sidebar. Pull request #10538
- Variable and template interpolation converted from async to sync in the scripting environment using liquidjs's synchronous method. Pull request #10523
- Fixed git-sync and legacy-folder writes to validate model types, preventing non-syncable singleton documents from being written. Pull request #10531
- Fixed event-stream response pane incorrectly reading HTTP body as NDJSON event log when Accept header is set to text/event-stream. Pull request #10522
- Constrained the file template tag to only access responses/, version-control/ subdirectories, tmpdir, and user-configured data folders. Pull request #10528
- Fixed Add/Delete Item in MCP Parameter Builder for nested object properties by bumping @rjsf dependencies to 6.0.0-beta.19. Pull request #10546
- Fixed environment editor to treat empty JSON content as invalid JSON and properly update table view when switching between JSON and table views. Pull request #10540
- Fixed sidebar collection filter crash when switching workspaces by handling non-string document fields properly. Pull request #10525
- Fixed plugin yarn info command running in wrong directory, eliminating spurious license-field warnings in stderr. Pull request #10505
Why it matters
Version 13.3.0 brings improvements to API exports, variable interpolation reliability, data sync safety, and fixes several UI crashes in the sidebar and environment editor. These changes address structural issues found during Konnect investigation while improving core functionality for OpenAPI workflows.
Changelog entry
- Fix: constrain file template tag to responses/, version-control/, tmpdir, and user-configured data folders Pull request #10528
- Feat(export): add Export OpenAPI Spec option to collection context menu with YAML or JSON format selection Pull request #10538
- Fix(script): convert variable/template interpolation from async to sync using liquidjs parseAndRenderSync Pull request #10523
- Fix: restrict git-sync and legacy-folder writes to validate syncable model types Pull request #10531
- Fix(event-stream): prevent event-stream response pane from reading plain HTTP body as NDJSON event log Pull request #10522
- Fix(mcp): correct Add/Delete Item for nested object params in Parameter Builder by bumping @rjsf to 6.0.0-beta.19 Pull request #10546
- Fix(environment-editor): treat empty JSON content as invalid and sync table view when switching from JSON view Pull request #10540
- Fix(sidebar): prevent collection filter crash on non-string document fields when switching workspaces Pull request #10525
- Fix(insomnia): run plugin yarn info in controlled temp directory to eliminate spurious stderr warnings Pull request #10505
- Refactor(sidebar): consolidate project shell in single layout route to fix race condition issues Pull request #10541
Insomnia 13.3.0 is out. Export OpenAPI specs directly from collections, improved environment editor stability, and fixes for git-sync safety and event-stream handling.
Insomnia 13.3.0 is available now. This release adds Export OpenAPI Spec to the collection menu for easier API documentation workflows, converts variable interpolation to sync for better reliability, and fixes several critical issues including git-sync validation and sidebar crashes. Download the latest version to get these improvements.
Week of September 14, 2026
What shipped
- Konnect projects now move into a global Control Planes organization, consolidating projects that were previously spread across multiple organizations. Pull request #10315
- V13.3 onboarding content added with a new API Collection merging legacy collection and document types, plus a setting to hide legacy unit test suites. Pull request #10476
- Sidebar drag and drop reordering fixed with improved drop indicators showing precisely where items will land. Pull request #10435
- Import modal can now be opened with a selected tab via bare deep-link parameters using the insomnia://app/import schema. Pull request #10488
- Both spec and collection now allow importing test suites in git sync. Pull request #10524
- Cookies from Set-Cookie responses are now excluded from being rendered into WebSocket, Socket.IO, and HTTP requests, with only manually-set cookies from the jar available. Pull request #10475
- Konnect organization visibility is now re-checked before restoring on cold start to prevent users getting stuck when access is revoked server-side. Pull request #10518
- The Konnect control planes migration notice now only appears after the user finishes choosing which organization data to keep. Pull request #10521
- One-line editor fixed to prevent entering and displaying multiple lines. Pull request #10514
- Read-only one-line editors no longer trigger flush on blur. Pull request #10534
Why it matters
This week brings major improvements to Konnect organization management and collection handling in V13.3, with Control Planes consolidation and API Collection as core new features. Several critical fixes address edge cases in Konnect migration, drag-and-drop UX, and cookie handling that improve reliability and user experience.
Changelog entry
- Konnect projects now move into a global Control Planes organization [INS-3148] Pull request #10315
- Added V13.3 onboarding content with new API Collection type and legacy unit test suite visibility setting [INS-3733] Pull request #10476
- Fixed sidebar drag and drop with improved drop indicators [INS-2887] Pull request #10435
- Import modal can be opened with selected tab via insomnia://app/import deep-link [INS-3768] Pull request #10488
- Test suite imports now allowed in git sync for both spec and collection Pull request #10524
- Response Set-Cookie headers excluded from being rendered into requests [INS-3620] Pull request #10475
- Konnect organization visibility re-checked on cold start [INS-3850] Pull request #10518
- Konnect control planes migration notice now appears only after organization selection [INS-3836] Pull request #10521
- Project organization cache revalidated when parent organization changes [INS-3850] Pull request #10513
- One-line editor fixed to prevent multiple line input Pull request #10514
- Read-only one-line editors no longer flush on blur Pull request #10534
- Test tab visibility improved in collection view based on enableLegacyUnitTests setting Pull request #10504
- Collection API improved with Spec and Tests tabs and auto-generated requests from spec import [INS-3803] Pull request #10503
- Onboarding content no longer displays after first view Pull request #10493
Insomnia V13.3 ships with Control Planes organization consolidation, improved drag-and-drop sidebar reordering, and fixes for Konnect migration edge cases. Test suite imports in git sync and cleaner cookie handling included.
This week's Insomnia updates focus on consolidating Konnect organization management through the new Control Planes organization, improving the overall workspace structure. V13.3 introduces API Collections merging legacy types, fixes sidebar drag-and-drop precision, and resolves critical Konnect migration issues. Test suite git sync imports and refined cookie handling round out the improvements.