v1.0.38

## What's Changed

Version bumped from 1.0.37 to 1.0.38

### Recent Changes
- fix(SKY-10653): stop browser profile dropdown clipping its last item (#6378) (d74864843)
- feat(SKY-9957): clarify Browsers vs Browser Profiles subheader copy (#6377) (2b8db6a23)
- SKY-10578: Add credential folders (frontend) (#6376) (817cc9f07)
- security: fix 5 high-severity pip vulnerabilities in langchain integration (#6353) (3985d49ef)
- SKY-10578: Add credential folders (backend) (#6375) (7e6ea829d)
- fix(SKY-10622): clean up child entities on workflow run timeout (#6374) (66d1fe98d)
- Bump version to 1.0.38 (#6371) (80541ee50)
- feat: generic remote CDP browser type(SKY-10648) (#6373) (207e99b16)
- feat(SKY-10415): consolidate prompt-input sanitization onto template-level boundary (#6372) (7fc8c1655)
- Update changelog — May 21 through June 3, 2026 (#6370) (6270559c2)
- fix(SKY-9781): port prebuilt-UI Dockerfile + entrypoint from cloud (#5998) (a0fc148a1)
- perf(SKY-10319): add caller/timeout span attrs to animation wait (#6369) (07da90666)
- Move schedule button beside save (#6368) (9a93281c1)
- SKY-10562 Ground Copilot block authoring in observations (#6363) (abf5e7660)
- fix(SKY-10627): restore session cookies on saved browser profile reuse (#6362) (47c6e0f26)
- fix(SKY-10626): cap raw HTML + screenshots in the max-retries failure summary (#6361) (13376f12d)
- fix: widen browser-profile session-persist wait in credential test and save (#6360) (1be6d5608)
- fix(SKY-10635): extend credential test poll timeout to 10 minutes (#6359) (ae729099a)
- fix(cli): add OpenCode MCP setup with API key auth (#6100) (bc6c681d5)
- chore: remove forgotten ENABLE_SPEED_OPTIMIZATIONS experiment flag (#6358) (eff31f671)
- SKY-10642 Simplify Workflow Copilot LLM lanes (#6355) (72445267e)
- fix: recover TOTP code from non-strict-JSON webhook bodies (#6354) (d2632bc5b)
- feat(SKY-10628): captcha timeout circuit breaker (#6349) (1704b3fdb)
- fix(SKY-8316): select filtered search dropdown options (#6348) (a32e28896)
- feat(SKY-10628): improve captcha solve timing before protected submit (#6347) (aa230156f)
- security: fix critical vitest vulnerability CVE-2026-47429 (CVSS 9.8) (#6329) (361ede768)
- Enable OSS workflow schedules (#6344) (60b5728dc)
- fix(SKY-10567): solid status pills + ghost data-table row buttons (#6343) (33e750ce0)
- SKY-10613 keep composition precheck out of tool steering (#6339) (57a617eb8)
- SKY-10590 gate click-reached composition evidence (#6338) (84fed76b6)
- fix(SKY-10474): make Copilot activity results product-safe (#6337) (98fba7773)
- fix(SKY-10328): compose after discovered entrypoint (#6336) (f9fc0421c)
- SKY-10562: scout goal pages with fast MCP browser tools before authoring (#6335) (7c52d3268)
- feat(tagging): add ?tags= filter to GET /workflows (SKY-10103) (#6334) (32e3febfd)
- feat(SKY-10355): onboarding-state POST endpoint + workflow save/run milestone hooks (SKY-10356) (#6333) (2cad4401e)
- feat(SKY-6661): whimsical loading + error copy across browser streams (#6332) (fae6a2a8b)
- fix(SKY-10478): render block prompts in workflow version comparison (#6331) (ca160b118)
- revert: narrow autocomplete input triggers from #9417 (#6330) (e7a5356a0)
- fix: align integration CTA styling (#6328) (42e767ec4)
- fix(SKY-10591): use explicit column filter in get_scripts aggregate subquery (#6327) (62f88248f)
- Standardize data tables with a consistent Linear/Apollo-style design (#6326) (486d78cda)
- SKY-10576: gate copilot recognition and persistence on runtime outcome evidence, not run status (#6323) (ae42d0470)
- feat(SKY-10204): add Feature Preview opt-in section to /settings (#6318) (dbaba4029)
- perf(SKY-10319): check budget/max-steps before awaiting speculative task (#6313) (9224df71e)
- fix(SKY-10327): skip duplicate PDF viewer auto-download to unblock LLM actions (#6314) (da9ea1a07)
- Fix DB session reuse across asyncio tasks (#6312) (01f245159)
- SKY-10598: move undo/redo back to the canvas toolbar (#6310) (fd6e502f6)
- SKY-10589: simplify workflows UI top bar + fix Agent System Prompt rendering (#6309) (797bdce5b)
- SKY-10593: align Agent Copilot panel colors with app dark-mode tokens (#6308) (da57d1f8b)
- fix(SKY-10452): select proxy from first block URL before script SDK creates browser (#6306) (5dfda2242)
- perf(SKY-10319): replace fixed upload-file sleeps with page readiness wait (#6305) (6af2e02e4)
- fix(SKY-10476): add waitUntil degradation to extraction scrape reload (#6304) (3a0d67ae1)
- fix(SKY-10408): prevent duplicate/corrupt file downloads via XHR staging (#6303) (6d78b45c5)
- security: ignore npm lifecycle scripts in skyvern-ts/client (#6289) (92e5eacde)
- SKY-10586: modernize OSS sidebar to match cloud (#6300) (a36824b82)
- SKY-5679: Add search to the credentials page (#6299) (8550cbcfd)
- SKY-10320: Keep local CDP debugger on live browser (#6297) (75799a06b)
- SKY-10398: rename Parameters → Inputs across the frontend UI (#6296) (f97a146bb)
- SKY-10585: seed copilot frontier starter URL (#6292) (bdcf0d151)
- fix(copilot): keep native tools registered for authority blockers (#6291) (e12da142e)
- SKY-10581: Fix live Copilot terminal rollups (#6290) (c7a7f736d)
- security: update axios to 1.16.1 to fix CVE-2026-44494 and CVE-2026-44492 (#6286) (d4ebd5bf9)
- SKY-10574: follow the live frontier in copilot chat during a run (#6283) (ba003033a)
- fix(SKY-10573): give the copilot turn-collapse control its own header lane (#6279) (b63dc2865)

**Full Changelog**: https://github.com/Skyvern-AI/skyvern/compare/v1.0.37...v1.0.38


## What's Changed
* fix(SKY-10573): give the copilot turn-collapse control its own header lane by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6279
* SKY-10574: follow the live frontier in copilot chat during a run by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6283
* security: update axios to 1.16.1 to fix CVE-2026-44494 and CVE-2026-44492 by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6286
* SKY-10581: Fix live Copilot terminal rollups by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6290
* fix(copilot): keep native tools registered for authority blockers by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6291
* SKY-10585: seed copilot frontier starter URL by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6292
* SKY-10398: rename Parameters → Inputs across the frontend UI by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6296
* SKY-10320: Keep local CDP debugger on live browser by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6297
* SKY-5679: Add search to the credentials page by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6299
* SKY-10586: modernize OSS sidebar to match cloud by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6300
* security: ignore npm lifecycle scripts in skyvern-ts/client by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/6289
* fix(SKY-10408): prevent duplicate/corrupt file downloads via XHR staging by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6303
* fix(SKY-10476): add waitUntil degradation to extraction scrape reload by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6304
* perf(SKY-10319): replace fixed upload-file sleeps with page readiness wait by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6305
* fix(SKY-10452): select proxy from first block URL before script SDK creates browser by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/6306
* SKY-10593: align Agent Copilot panel colors with app dark-mode tokens by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6308
* SKY-10589: simplify workflows UI top bar + fix Agent System Prompt rendering by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6309
* SKY-10598: move undo/redo back to the canvas toolbar by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/6310
* Fix DB session reuse across asyncio tasks by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/6312
* fix(SKY-10327): skip duplicate PDF viewer auto-download to unblock LLM actions by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6314
* perf(SKY-10319): check budget/max-steps before awaiting speculative task by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6313
* feat(SKY-10204): add Feature Preview opt-in section to /settings by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6318
* SKY-10576: gate copilot recognition and persistence on runtime outcome evidence, not run status by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6323
* Standardize data tables with a consistent Linear/Apollo-style design by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6326
* fix(SKY-10591): use explicit column filter in get_scripts aggregate subquery by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6327
* fix: align integration CTA styling by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6328
* revert: narrow autocomplete input triggers from #9417 by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6330
* fix(SKY-10478): render block prompts in workflow version comparison by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6331
* feat(SKY-6661): whimsical loading + error copy across browser streams by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6332
* feat(SKY-10355): onboarding-state POST endpoint + workflow save/run milestone hooks (SKY-10356) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6333
* feat(tagging): add ?tags= filter to GET /workflows (SKY-10103) by @trevor-cheung in https://github.com/Skyvern-AI/skyvern/pull/6334
* SKY-10562: scout goal pages with fast MCP browser tools before authoring by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6335
* fix(SKY-10328): compose after discovered entrypoint by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6336
* fix(SKY-10474): make Copilot activity results product-safe by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6337
* SKY-10590 gate click-reached composition evidence by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6338
* SKY-10613 keep composition precheck out of tool steering by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6339
* fix(SKY-10567): solid status pills + ghost data-table row buttons by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6343
* Enable OSS workflow schedules by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6344
* security: fix critical vitest vulnerability CVE-2026-47429 (CVSS 9.8) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/6329
* feat(SKY-10628): improve captcha solve timing before protected submit by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6347
* fix(SKY-8316): select filtered search dropdown options by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6348
* feat(SKY-10628): captcha timeout circuit breaker by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6349
* fix: recover TOTP code from non-strict-JSON webhook bodies by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/6354
* SKY-10642 Simplify Workflow Copilot LLM lanes by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6355
* chore: remove forgotten ENABLE_SPEED_OPTIMIZATIONS experiment flag by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/6358
* fix(cli): add OpenCode MCP setup with API key auth by @Shiven0504 in https://github.com/Skyvern-AI/skyvern/pull/6100
* fix(SKY-10635): extend credential test poll timeout to 10 minutes by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/6359
* fix: widen browser-profile session-persist wait in credential test and save by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/6360
* fix(SKY-10626): cap raw HTML + screenshots in the max-retries failure summary by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/6361
* fix(SKY-10627): restore session cookies on saved browser profile reuse by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/6362
* SKY-10562 Ground Copilot block authoring in observations by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6363
* Move schedule button beside save by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/6368
* perf(SKY-10319): add caller/timeout span attrs to animation wait by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6369
* fix(SKY-9781): port prebuilt-UI Dockerfile + entrypoint from cloud by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/5998
* Update changelog — May 21 through June 3, 2026 by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/6370
* feat(SKY-10415): consolidate prompt-input sanitization onto template-level boundary by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/6372
* feat: generic remote CDP browser type(SKY-10648) by @LawyZheng in https://github.com/Skyvern-AI/skyvern/pull/6373
* Bump version to 1.0.38 by @celalzamanoglu in https://github.com/Skyvern-AI/skyvern/pull/6371

## New Contributors
* @Shiven0504 made their first contribution in https://github.com/Skyvern-AI/skyvern/pull/6100

**Full Changelog**: https://github.com/Skyvern-AI/skyvern/compare/v1.0.37...v1.0.38