✨ Features
- Allowlist: require HTTPS and validate redirects, block on policy failure #12619
- Allow callers to supply Goose session IDs #13098
🐛 Bug Fixes
- Linux window icons restored in desktop app #13120
- OpenRouter: resolve variant suffixes like
:freeand:nitroto the base model #12979 - Use catalog_provider_id for vision lookup on custom providers #12993
- Desktop: start the agent only once after a fork #13139
- Scheduler: use recipe settings in scheduled runs #13138
- Voice: use system trust for WebSockets #13075
- Prompt: surface MiniJinja render errors in custom system prompts #12794
- Providers: request summarized thinking from Claude models #13029
- Code-mode: keep recipe final_output tool for the model #13102
- CLI: configure unavailable default provider #13024
- Windows build error #13081
- Developer: terminate owned shell process trees on cancellation #12958
- ACP: fail session/prompt when a turn ends on an error #13043
- Databricks: send the system prompt as system on the MLflow chat route #13057
🔧 Improvements
- Bump zstd to 0.14.3 for RUSTSEC advisories #13162
- Remove jsonwebtoken to avoid ignoring its cargo-deny advisories #13141
- Address cargo-deny failures on main #13076
- Bump @modelcontextprotocol/sdk from 1.30.0 to 1.32.0 #13059
- Remove ACP client-delegated developer tools #13144
- Build release candidate even if there are conflicts #12780
