What hoppscotch/hoppscotch shipped
Written by FoxPlug from the repository's own releases; not affiliated with Hoppscotch. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/hoppscotch/hoppscotch; Hoppscotch did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 26, 2026
What shipped
- The desktop app and agent now validate TLS against the host trust store, including the macOS keychain and the Windows ROOT store, so certificates already trusted by the operating system work without extra configuration. Pull request #6662
- Version 2026.10.0 shipped with system trust store support in the desktop app plus fixes for the update and sign-in flow. Release
- The default self-host Docker Compose profile no longer publishes PostgreSQL on 0.0.0.0:5432 with static postgres/testpass credentials, and the shipped data encryption key placeholder was hardened. Pull request #6639
- A security patch for high and critical advisories in the backend dependency chain and the production Node.js image landed in the 2026.10.0 dependency chain, limited to lockfiles, package manifests and the production Dockerfile with no source changes. Pull request #6746
- The desktop setup server now picks its auth port on the IPv4 loopback address, so port selection works on kernels booted with IPv6 disabled instead of failing the bind on the unspecified address. Pull request #6729
- The desktop updater now shows the Restart button only after the install step finishes, rather than while installation is still in progress. Pull request #6715
- The monorepo version was bumped from 2026.9.0 to 2026.10.0 and the desktop app from 26.9.0 to 26.10.0, with version strings only and no functional changes. Pull request #6759
Why it matters
This week is mostly about trust and safety for people running Hoppscotch themselves or on the desktop: system certificate support removes manual configuration, the default self-host deployment no longer ships known-weak database credentials, and dependency advisories in the backend and production image were patched. Desktop also got fixes to port selection and to when the update restart prompt appears.
Changelog entry
- Desktop: validate TLS against the host trust store, macOS keychain and Windows ROOT store. Pull request #6662
- Release 2026.10.0 with system trust store support and update and sign-in flow fixes. Release
- Harden default self-host deployment secrets, removing static database credentials and a functional data encryption key placeholder. Pull request #6639
- Patch high and critical dependency advisories in the backend chain and production Node.js image. Pull request #6746
- Desktop: pick the auth port on the IPv4 loopback so it works with IPv6 disabled. Pull request #6729
- Desktop: emit the restart prompt only after the update install completes. Pull request #6715
- Bump monorepo version to 2026.10.0 and desktop app to 26.10.0. Pull request #6759
Hoppscotch 2026.10.0 is out. The desktop app now uses your system trust store, so OS-trusted certificates work with no extra setup. Also in: hardened default self-host secrets in Docker Compose, a dependency security patch, and desktop fixes for port picking and the update restar
Hoppscotch 2026.10.0 is out, focused on stability, security and the desktop experience. The desktop app and agent now validate TLS against the host trust store, including the macOS keychain and the Windows ROOT store, so certificates your operating system already trusts work without extra configuration. The update and sign-in flows also received fixes. For self-hosters, the default Docker Compose profile no longer publishes PostgreSQL with static credentials, and the shipped data encryption key placeholder was hardened. A separate patch covers high and critical advisories in the backend dependency chain and the production Node.js image, with no source changes. On desktop, the auth port is now picked on the IPv4 loopback so setup works on kernels booted with IPv6 disabled, and the restart p
Week of September 21, 2026
What shipped
- Added an AI assistant pane to hoppscotch-common that can edit, run, and save requests, and manage collections, environments, documentation and mock servers through tool calls. Pull request #6670
- Fixed the allShortcodes query to accept userEmail filter without throwing a Bad Request exception. Pull request #6679
- Added 110 missing Turkish locale keys so data-driven collection runs, desktop settings, OpenAPI export, inherited scripts, GraphQL subscriptions, and host-only cookies display in Turkish instead of English. Pull request #6654
- Improved Chinese translations by adding missing strings for cookies modal, export features, desktop settings, and unified workspace. Pull request #6611
- Corrected seven Afrikaans translation placeholders that were being hardcoded instead of interpolated, fixing literal token display to users. Pull request #6648
- Released version 2026.8.2 to sync with Hoppscotch Enterprise Edition. Release
Why it matters
This week brings an AI assistant for request management alongside fixes for backend query handling and broad internationalization improvements. Users in Turkish and Afrikaans-speaking regions now see properly translated and interpolated UI text, while Chinese speakers get better coverage of export and workspace features.
Changelog entry
- Added AI assistant pane to hoppscotch-common for editing, running, and saving requests, and managing collections, environments, documentation, and mock servers Pull request #6670
- Fixed allShortcodes query to properly handle userEmail filter parameter Pull request #6679
- Added 110 missing Turkish locale keys for collection runs, settings, OpenAPI export, scripts, GraphQL subscriptions, and cookies Pull request #6654
- Improved Chinese translations for cookies modal, export features, desktop settings, and unified workspace Pull request #6611
- Fixed Afrikaans translation placeholders that were rendering as literal tokens instead of interpolated values Pull request #6648
- Bumped version to 2026.8.2 across the monorepo Pull request #6668
Chat assistant for editing requests and managing collections. Fixed userEmail filtering in shortcodes. Translation improvements for Turkish, Chinese, and Afrikaans. Version 2026.8.2 released.
This week's updates include a new AI chat assistant pane for managing requests and collections, a fix for userEmail filtering in the allShortcodes query, and significant internationalization work. Turkish users gain 110 missing UI translations covering collection runs, settings, exports, and subscriptions. Chinese translations expanded for cookies, exports, and workspace features. Afrikaans interpolation placeholders corrected. Version 2026.8.2 released.
More from hoppscotch/hoppscotch on GitHub
Merged pull requests
- feat(common): add AI chat bot (#6670, merged September 24, 2026 by nivedin) (source)
- fix(backend): allow userEmail filter in allShortcodes query (#6679, merged September 24, 2026 by mirarifhasan) (source)
- chore(common): add missing Turkish locale keys (#6654, merged September 23, 2026 by qwist1233-cpu) (source)
- chore(common): improve Chinese translations (#6611, merged September 21, 2026 by jiangzm) (source)
- fix(common): correct Afrikaans translation placeholders (#6648, merged September 21, 2026 by owgreen-dev) (source)
- feat: REST-GQL Unified workspace (#6545, merged August 28, 2026 by nivedin) (source)
- feat(common): data-driven collection runs with datasets (#6513, merged August 27, 2026 by pmondal-int) (source)
- fix(common): preserve request tab description on documentation save (#6592, merged August 27, 2026 by nivedin) (source)
- chore: security patch for the dependency chain
v2026.8.0(#6604, merged August 26, 2026 by mirarifhasan) (source) - fix(common): distinguish host-only cookies (#6585, merged August 25, 2026 by CuriousCorrelation) (source)
- fix(common): agent Set-Cookie header fallback (#6586, merged August 24, 2026 by CuriousCorrelation) (source)
- fix(desktop): probe auth before instance resume (#6587, merged August 24, 2026 by CuriousCorrelation) (source)