3.35.10

Budibase/budibase3.35.10Apr 21, 2026by calexiou

AI Summary

This release focuses on security hardening, UI improvements for automation side panels, and bug fixes.

Key Highlights

Fixed SSRF vulnerability in plugin URL upload via tar.gz bypass
Improved automation side panel with a 480px default width and resizable feature
Fixed button icons visibility for table row buttons

New Features

Resizable automation side panel
Button icons now showing

Full Release Notes

## What's Changed
* Bump follow-redirects from 1.15.11 to 1.16.0 in the all-non-major-security group across 1 directory by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18540
* [GHSA-4f9j-vr4p-642r] Set budibase:auth cookie with secure flag by @jvcalderon in https://github.com/Budibase/budibase/pull/18571
* Bump protobufjs from 7.5.4 to 7.5.5 by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18574
* Button icons are now showing for table row buttons by @mohagan9 in https://github.com/Budibase/budibase/pull/18474
* Automation side panel: 480px default width + resizable by @melohagan in https://github.com/Budibase/budibase/pull/18460
* Fix automation logs for branches in loop steps by @gootik in https://github.com/Budibase/budibase/pull/18551
* Bump the all-non-major-security group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18572
* Fix svelte-check by @adrinr in https://github.com/Budibase/budibase/pull/18577
* Fixing pre-commit by @adrinr in https://github.com/Budibase/budibase/pull/18570
* [VUL-53] Fix SSRF in plugin URL upload via trivial tar.gz bypass by @jvcalderon in https://github.com/Budibase/budibase/pull/18569
* Emit lifecycle telemetry events for AI agents by @jvcalderon in https://github.com/Budibase/budibase/pull/18576

## New Contributors
* @gootik made their first contribution in https://github.com/Budibase/budibase/pull/18551

**Full Changelog**: https://github.com/Budibase/budibase/compare/3.35.9...3.35.10