This release introduces collection-level pre-request and test scripts, desktop settings with manual update controls, refinements to the API documentation experience, and self-hosted improvements, including SMTP OAuth2 authentication, alongside security patches and bug fixes.

Read more at: https://hoppscotch.com/blog/hoppscotch-v2026-4-0.

What's Changed

• refactor(cli): match test-result helper name to documented contract by @Basavaraj8143 in refactor(cli): match test-result helper name to documented contract #6122
• feat(backend): use stateless OAuth2 state store by @mirarifhasan in feat(backend): use stateless OAuth2 state store #6098
• fix(common): handle non-string values in Postman collection import by @okxint in fix(common): handle non-string values in Postman collection import #6137
• fix(common): correct environment locale wording by @PallavSarkar2005 in fix(common): correct environment locale wording #6117
• fix(data): make $randomUUID predefined variable RFC 4122 compliant by @Grizouforever in fix(data): make $randomUUID predefined variable RFC 4122 compliant #6125
• chore(common): complete missing Spanish translations by @Pakvothe in chore(common): complete missing Spanish translations #6109
• chore(common): complete missing Turkish translations by @onwp in chore(common): complete missing Turkish translations #6071
• chore(common): modify Chinese translation of words by @jiangzm in chore(common): modify Chinese translation of words #5996
• fix(common): add missing aria-labels to icon-only sidenav links by @rayrishu19-wq in fix(common): add missing aria-labels to icon-only sidenav links #6160
• fix(common): variable hover tooltip was not clickable (disappeared) by @AaronFortG in fix(common): variable hover tooltip was not clickable (disappeared) #6155
• feat: add SMTP OAuth2 authentication support by @mirarifhasan in feat: add SMTP OAuth2 authentication support #6141
• fix: resolve invalid environment validation when publishing docs in personal workspace by @sahilkhan09k in fix: resolve invalid environment validation when publishing docs in personal workspace #5962
• feat(common): improve API documentation publishing UX by @nivedin in feat(common): improve API documentation publishing UX #6116
• fix: remediate quinn-proto vulnerability across native packages by @CuriousCorrelation in fix: remediate quinn-proto vulnerability across native packages #6174
• docs: security threat model and policy update by @CuriousCorrelation in docs: security threat model and policy update #6158
• fix(common): apply platform default proxy URL on load and reset by @nivedin in fix(common): apply platform default proxy URL on load and reset #6142
• feat: add collection-level pre-request and test scripts by @johnan319 in feat: add collection-level pre-request and test scripts #5745
• fix(common): support id_token in Authorization Code OAuth flow by @anwarulislam in fix(common): support id_token in Authorization Code OAuth flow #6144
• feat(desktop): settings phase 0 - infra and update check by @CuriousCorrelation in feat(desktop): settings phase 0 - infra and update check #6172
• feat(selfhost-web): make webapp-server timeouts configurable by @rkferreira in feat(selfhost-web): make webapp-server timeouts configurable #6147
• fix(common): restore magic-link sign-in flow on cloud for orgs by @jamesgeorge007 in fix(common): restore magic-link sign-in flow on cloud for orgs #6237
• fix(desktop): unified store scope and migration reroute by @CuriousCorrelation in fix(desktop): unified store scope and migration reroute #6238
• chore: security patch for the dependency chain v2026.4.0 by @mirarifhasan in chore: security patch for the dependency chain v2026.4.0 #6191
• fix(backend): harden onboarding config endpoint by @mirarifhasan in fix(backend): harden onboarding config endpoint #6240
• fix(common): set domain url as mockserver environment by @nivedin in fix(common): set domain url as mockserver environment #6185
• fix(common): subfolder add-new in team collections respects write access by @nivedin in fix(common): subfolder add-new in team collections respects write access #6243
• fix(common): preserve string contract for GQL history responses by @jamesgeorge007 in fix(common): preserve string contract for GQL history responses #6244

New Contributors

• @Basavaraj8143 made their first contribution in refactor(cli): match test-result helper name to documented contract #6122
• @okxint made their first contribution in fix(common): handle non-string values in Postman collection import #6137
• @PallavSarkar2005 made their first contribution in fix(common): correct environment locale wording #6117
• @Grizouforever made their first contribution in fix(data): make $randomUUID predefined variable RFC 4122 compliant #6125
• @Pakvothe made their first contribution in chore(common): complete missing Spanish translations #6109
• @onwp made their first contribution in chore(common): complete missing Turkish translations #6071
• @rayrishu19-wq made their first contribution in fix(common): add missing aria-labels to icon-only sidenav links #6160
• @sahilkhan09k made their first contribution in fix: resolve invalid environment validation when publishing docs in personal workspace #5962
• @johnan319 made their first contribution in feat: add collection-level pre-request and test scripts #5745
• @rkferreira made their first contribution in feat(selfhost-web): make webapp-server timeouts configurable #6147

Full Changelog: 2026.3.1...2026.4.0