Full changelog: https://yaak.app/changelog/2026.7.0
🎁 New
- 🔗 Import from a URL (#551)
- 🕘 Filter history with pinning (#338, feedback)
- 📄 GraphQL schemas from a file (#462)
- 📥 New OpenAPI importer (#486, feedback)
- Create an environment for each OpenAPI server URL (#590, feedback)
- Force HTTP/1.1 or HTTP/2 per request, folder, or workspace (#609, feedback)
💄 Improved
- 🔌 Plugin API for reading response bodies (#560)
- Show the CLI update notice in non-interactive shells so agents see it
- Support OpenAPI 3.2 QUERY and additional operations on import (#591)
- Fill OAuth client ID and secret from environment variables on OpenAPI import (#587, feedback)
- Import spec-level OpenAPI security as workspace authentication (#601)
- Generate XML bodies and serialize deepObject, label, and matrix parameters on OpenAPI import (#602)
- Fill the OAuth redirect URI from an environment variable on OpenAPI import (#610, feedback)
🛠️ Fixed
- Honor workspace connection settings in CLI sends (#537)
- Include the request body in AWS SigV4 signatures (#430, feedback)
- Fix OAuth password grant tokens being reused when the username changes (#426)
- Restore HTTP/2 and client certificate support when TLS validation is disabled (#543)
- Follow the OS appearance when set to System without opening a new window (#540, feedback)
- Fix a sync watcher crash when the sync directory path traverses a symlink (#541)
- Don't save the response when the file dialog is cancelled (feedback)
- Fix client certificates on Linux when TLS validation is disabled (#554)
- Upgrade dependencies to resolve 29 security advisories (#562)
- Don't send scope on the OAuth authorization code token request (#579, feedback)
- Fix new workspaces defaulting to not sending or storing cookies (#573)
- Fix Timeline entries appearing in reverse order (#573)
- Read combined short flags as separate options when importing cURL (#577)
- Render all columns in irregular CSV responses (#584)
- Fix the app not activating after a relaunch on macOS (#583)
- Quote apostrophes and file paths when copying as cURL or gRPCurl (#593)
- Keep --data-urlencode values whole and tolerate a stray % on cURL import (#597)
- Preserve OpenAPI security requirement semantics on import (#586)
- Fix OpenAPI import of array $refs, cookie parameters, mid-segment path templates, and typed examples (#599)
- Preserve the base URL variable when an OpenAPI document omits servers (#585, feedback)
- Prevent the environment dropdown from opening alongside the environment editor
- Fix the System appearance always resolving to light on macOS 27 (#603)
- Send the signing key as the OAuth 1.0 PLAINTEXT signature (#605)
- Keep an = inside --url-query and form values on cURL import (#606)
- Escape control characters in the json.escape template function (#607)
- Render template values before plugin config forms use them, fixing the 1Password vault dropdown (#608)
- Check for updates on Linux deb, rpm, and Flatpak installs and say how to update (#604, feedback)
- Sign OAuth 1.0 requests with the token secret when no access token is set (#611)
