What NangoHQ/nango shipped
Written by FoxPlug from the repository's own releases; not affiliated with Nango. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/NangoHQ/nango; Nango did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- GitHub App install and OAuth callbacks without a state parameter now redirect to the fixed server base URL instead of the attacker-controlled Referer header, closing an open redirect. Pull request #7485
- Disabling a flow now checks that the sync config belongs to the caller's environment, so a caller can no longer disable another account's flow or clear its error notifications. Pull request #7715
- The overdue invoices banner is hidden for Enterprise plans through a new plan flag, since dunning already handles collection for those accounts. Pull request #7866
- Incoming webhooks are no longer dispatched to disabled syncs, which previously matched and then failed in jobs with Sync not found for connection. Pull request #7774
- When an action fails on a GraphQL API, the errors array is passed through so the failure summary names the reason instead of a generic HTTP call error. Pull request #7845
- Confirming a plan change no longer spins the dialog indefinitely while waiting for the plan change webhook. Pull request #7819
- Connection_config is interpolated into refresh and token params before a refresh runs. Pull request #7807
- Sentry MCP support was added to integrations. Pull request #7866
- Intercom webhooks are now supported. Pull request #7838
- Internal credentials are now EdDSA JWTs with an issuer, subject and key id header, replacing the previous token shape. Pull request #7676
Why it matters
This week tightened security around redirects, flow control and stale automation, and fixed several long-standing reporting and error-message gaps. It also added more providers and webhook sources, giving users more services to connect without writing their own integration. The internal auth change and the agent session refactors are groundwork that keeps behavior the same for existing callers.
Changelog entry
- Fixed an open redirect in GitHub App install and OAuth callbacks. Pull request #7485
- Scoped flow disabling to the caller's environment. Pull request #7715
- Hid the overdue invoices banner for Enterprise plans. Pull request #7866
- Skipped disabled syncs when dispatching webhooks. Pull request #7774
- Passed GraphQL error messages to the failure summary when an action fails. Pull request #7845
- Fixed the plan change dialog hanging on a webhook. Pull request #7819
- Interpolated
connection_configin refresh and token params before refresh. Pull request #7807 - Surfaced the ActionError reason when a payload has no error key. Pull request #7843
- Added the NANGO_IGNORE_HEADERS environment variable to ignore extra headers in redaction. Pull request #7836
- Added support for Sentry MCP. Pull request #7865
- Added support for Intercom webhooks. Pull request #7838
- Unified internal auth tokens as EdDSA JWTs. Pull request #7676
Weekly roundup: GitHub App OAuth open redirect fixed, flow disable scoped to the caller's environment, webhooks no longer dispatched to disabled syncs, GraphQL errors surfaced in action failures, plus more provider integrations.
This week we closed an open redirect in the GitHub App install and OAuth callbacks and scoped flow disabling to the caller's own environment. Webhooks are no longer dispatched to disabled syncs, and GraphQL error messages now reach the failure summary so action failures name the reason. Plan change dialogs no longer hang on a slow webhook. On the integrations side we added support for Sentry MCP, Intercom webhooks, and several new providers and API key connections.
Week of September 28, 2026
What shipped
- V0.71.12 released with Azure Key Vault support for DEK wrapping, integration templates sync for Sanity, and unverified webhook handling options. Release
- Azure Key Vault added as a DEK wrapping provider, selectable with NANGO_AZURE_KMS_KEY_ID and supporting AKS Workload Identity. Pull request #7717
- Function invocation endpoint refactored from /functions/invocations to /connections/:uuid/functions/:uuid/invocations with X-Nango-Invocation-Id header support. Pull request #7724
- Integrations can now allow unverified webhooks, with missing or unverifiable signatures processed and flagged rather than rejected. Pull request #7726
- Slack app configuration tokens added as a provider for managing Slack app manifests via Nango. Pull request #7669
- Discord Bot provider added to support bot-scoped API endpoints with bot tokens alongside the existing OAuth2 user token provider. Pull request #7678
- Linear provider fixed to omit empty
client_secretvalues from token and refresh requests due to Linear's recent rejection of such requests. Pull request #7769 - Proxy requests now timeout after 5 minutes without receiving data and abort when a runner script is cancelled. Pull request #7709
- Airtable webhook signatures now verified against the macSecretBase64 stored for each connection's webhook. Pull request #7628
- Mailtrap added as a supported integration for transactional email with both production and sandbox API support. Pull request #7150
Why it matters
This week includes infrastructure improvements for encryption key management and webhook security alongside new integrations and OAuth providers. The endpoint refactoring for function invocations improves the API structure, and proxy timeout handling prevents stalled requests from consuming resources indefinitely.
Changelog entry
- Azure Key Vault now available as a DEK wrapping provider via NANGO_AZURE_KMS_KEY_ID with DefaultAzureCredential support. Pull request #7717
- Function invocation endpoint moved from POST /functions/invocations to POST /connections/:uuid/functions/:uuid/invocations with X-Nango-Invocation-Id header. Pull request #7724
- Integration option added to allow unverified webhooks, off by default; unverifiable signatures are processed and flagged, invalid signatures always rejected. Pull request #7726
- Slack-app-configuration provider added for managing Slack app manifest creation, updates, and deletion. Pull request #7669
- Discord-bot provider added for bot-scoped API endpoints requiring bot tokens alongside existing discord OAuth2 provider. Pull request #7678
- Linear provider fixed to omit empty
client_secretfrom token/refresh requests due to Linear's rejection policy. Pull request #7769 - Proxy requests timeout and fail after 5 minutes without receiving data; cancelling a runner script aborts its waiting request. Pull request #7709
- Airtable webhooks now verified against macSecretBase64 signature with unsigned deliveries allowed only for legacy-allowlisted accounts. Pull request #7628
- Mailtrap integration added with production send API and Email Sandbox support via API key authentication. Pull request #7150
- Discogs added with oauth (OAuth 1.0a PLAINTEXT) and discogs-token (personal access token) authentication modes. Pull request #7340
- Integration templates sync added to Sanity integration. Pull request #7554
- Server and CLI events renamed to follow analytics taxonomy; plan-change and deployment events updated. Pull request #7753
V0.71.12 ships Azure Key Vault support, function invocation endpoint refactoring, Slack app config tokens, Discord Bot provider, and webhook verification improvements.
V0.71.12 adds Azure Key Vault for DEK wrapping with AKS Workload Identity support, refactors function invocation endpoints, introduces Slack app configuration and Discord Bot providers, enables unverified webhook handling, verifies Airtable webhook signatures, and implements 5-minute proxy timeouts for stalled requests.
Week of September 21, 2026
What shipped
- Live catalog actions can now run as invocable actions through HTTP triggers and the dashboard. Pull request #7613
- Salesforce webhooks now require verification using a Nango webhook secret in the X-Nango-Webhook-Secret header. Pull request #7630
- Unsigned webhook providers (Affinity, Fillout, ShipStation) now require the webhookSecret stored in connection metadata. Pull request #7629
- CLI now supports on-events trigger for functions, allowing functions to run when events occur. Pull request #7634
- Omnisend API-key authentication provider added to Nango Core. Pull request #7515
- MCP_OAUTH2_GENERIC integrations can now be created and managed through the public API. Pull request #7529
- Fixed inaccessible Upgrade links in tooltips by moving them outside tooltip triggers. Pull request #7467
- Removed SWR from webapp and migrated remaining hooks to react-query for consistent cache clearing. Pull request #7635
- Disabled autocapture events sent to PostHog, reducing ingestion by approximately 90%. Pull request #7655
Why it matters
Webhook security improvements across multiple providers now enforce signature verification. Live catalog actions bring new capabilities to function invocation. API improvements extend management functionality while webapp and event tracking changes improve reliability and reduce costs.
Changelog entry
- Live catalog actions can be invoked through HTTP triggers and the dashboard Pull request #7613
- Salesforce webhooks require X-Nango-Webhook-Secret header for verification Pull request #7630
- Unsigned webhooks (Affinity, Fillout, ShipStation) require webhookSecret in X-Nango-Webhook-Secret header or nangoWebhookSecret query param Pull request #7629
- CLI supports on-events trigger for functions Pull request #7634
- MCP_OAUTH2_GENERIC integrations can be created and managed through the public API Pull request #7529
- Added Omnisend API-key provider Pull request #7515
- Added Tracify Analytics API-key provider Pull request #7507
- Added PostHog Capture provider Pull request #7645
- Added JobNimbus provider Pull request #7638
- Added eWay CRM provider Pull request #7637
- Added UKG Pro WFM CC provider Pull request #7636
- Fixed inaccessible Upgrade links in tooltips Pull request #7467
- Migrated remaining SWR hooks to react-query Pull request #7635
Webhooks now verify signatures for Salesforce, Affinity, Fillout, and ShipStation. Live catalog actions run as invocable functions. MCP integrations work through the public API. Six new provider integrations added.
This week brings webhook security enhancements across Salesforce and unsigned providers, requiring secrets for verification. Live catalog actions are now executable through HTTP triggers and the dashboard. MCP_OAUTH2_GENERIC integrations gain public API support. The CLI accepts on-events triggers for functions. Six new integrations added: Omnisend, Tracify, PostHog Capture, JobNimbus, eWay CRM, UKG Pro WFM. Webapp improvements reduce costs and fix accessibility issues.
Week of September 14, 2026
What shipped
- Scheduled functions now execute as the same entity type as regular functions, with optional logId and variant fields in the orchestrator payload. Pull request #7563
- Dashboard login and consent flow added to the OAuth server, with cookies on api.nango.dev to reuse existing session cookies. Pull request #7481
- Free plans now have a 10 GB monthly data-transfer cap enforced across proxy, webhooks, functions, and record reads. Pull request #7413
- Neon MCP added as a dynamically registered OAuth2 provider with read and write scopes. Pull request #7545
- Stripe App Sandbox appDomain moved from per-connection to per-integration configuration. Pull request #7227
- Hex MCP provider support added. Pull request #7578
- Autumn, a billing and subscription layer, added as an API key provider. Pull request #7576
- Linkly URL shortener added as an API key provider. Pull request #7516
- Dashboard redirects to the originally requested page after login instead of the home page. Pull request #7520
- Growth add-on management cron runs hourly to report, activate, and terminate add-ons. Pull request #7530
Why it matters
The week focused on integrations (five new providers added), billing features (data transfer cap and add-on scheduling), and platform improvements (scheduled functions, OAuth consent flow, billing deep links). These changes address both integration coverage and subscription management for growing deployments.
Changelog entry
- Feat(integrations): add support for hex mcp Pull request #7578
- Fix(webapp): land billing deep links on the right section Pull request #7567
- Feat(providers): move stripe-app-sandbox appDomain to
integration_configPull request #7227 - Refactor(records): share one helper for composite model names Pull request #7415
- Fix(connect-ui): stop the theme flashing before the dialog loads Pull request #7497
- Feat(integrations): add Autumn (API key) Pull request #7576
- Feat: scheduled functions can execute Pull request #7563
- Feat(oauth): add dashboard login and consent flow Pull request #7481
- Feat(integrations): add Linkly (API key) Pull request #7516
- Feat(auth): return to the requested page after login Pull request #7520
- Feat(usage): cap free-plan data transfer at 10 GB monthly Pull request #7413
- Feat(integrations): add Neon MCP support Pull request #7545
- Feat(plans): growth add-on management cron Pull request #7530
This week: scheduled functions unified in orchestrator, Free plans now have 10GB monthly data transfer cap, Neon MCP added, plus Hex, Autumn, and Linkly integrations. Dashboard now returns you to your original page after login.
This week in Nango: scheduled functions unified in the orchestrator payload, Free plans now enforce a 10 GB monthly data-transfer cap, Neon MCP added as a dynamically registered provider. Three new integrations: Autumn (billing layer), Linkly (URL shortener), and Hex. Platform improvements include dashboard returning you to your originally requested page after login and Stripe App Sandbox configuration moving to the integration level.