v1.0.51
immich-app/immichv1.0.51Aug 24, 2026by github-actions[bot]
AI Summary
This release focuses on security patches for npm vulnerabilities, enhanced Copilot capabilities including Google account notices and billing guidance, and infrastructure improvements for CDP selector engines and run minute tracking.
Key Highlights
- Security updates for fast-uri, postcss, jupyterlab, and npm vulnerabilities in frontend and dashboard
- Copilot improvements including reconnectable Google account notices and credential sharing across tools
- Infrastructure updates for CDP selector engine support and metric export configuration
- Task V3 enhancements for form controls, shadow roots, and validation text
New Features
- Show reconnectable Google account notices in Copilot
- Surface collapsed authentication options to Copilot
- Add selector engines Skyvern's producers emit to skycdp
- Recover zero-sized screenshot viewports
- Add growth-analytics skill with canonical metric definitions
Full Release Notes
## What's Changed Version bumped from 1.0.50 to 1.0.51 ### Recent Changes - Bump version to 1.0.51 (#8291) (10fd44bc4) - Carry obstruction controls through build-test results (SKY-14614) (#8293) (e8dd2d212) - Cap sweep-finalized run minutes at the run type's compute budget (#8292) (d1cfc46dd) - Refresh .test_durations from CI (#8290) (76699e887) - Local-dev browser sessions: in-process mode, CDP address, PBS reset (#8288) (47537c0e5) - Name the bounded replacement when a CodeBlock expect_* member is denied (SKY-14861) (#8286) (336360386) - Redact proxy values at all logging sinks (#8285) (15d59ef17) - Record the finally block's minutes instead of the run's body twice (SKY-14606) (#8284) (ef39e0892) - Make skyvern.com agent-readable: OAuth discovery, markdown negotiation, rate-limit headers, MCP manifest (#8283) (9cc113865) - SKY-14840 Share browser call outcomes across Copilot tools (#8281) (0cda14ac4) - SKY-14839 Return complete build-test packets to Copilot (#8280) (bea7dec10) - SKY-14836 Pair fresh page screenshots with their evidence (#8279) (58e02e0e2) - Treat an unreachable SOCKS proxy as proxy-sensitive, not a retriable navigation error (SKY-14862) (#8278) (b549b6716) - Workstation-persistent extension pairing approval with operator CLI bootstrap (SKY-14820) (#8277) (7df3f7718) - Task V3 observe: a "(required)" word marker on a per-field wrapper no longer starves the form's refusal banner (SKY-14818) (#8276) (236186f5e) - Attribute the copilot's guessed catalog picks to the acting model, with no product change (SKY-14540) (#8275) (0b5010314) - Recover zero-sized screenshot viewports (#8274) (580c4476e) - Validate run minutes against Redshift with a repeatable harness (SKY-14606) (#8273) (fe1961f34) - Correct why the fitted-launch recording size is pinned (SKY-14736) (#8269) (02ed2aad3) - security: update fast-uri and postcss in the TS client lockfiles (#8271) (42ebd89d9) - security: fix 15 npm vulnerabilities in skyvern-frontend (#8270) (ac7d1843f) - Return the browser's own failure facts instead of constants when a code block fails (SKY-14625) (#8266) (bfe921b79) - Attach uploaded files to agent runs so the run's end deletes them (#8265) (c2e591982) - Type into a field a decorative wrapper covers, or say so at once (#8264) (a72743eb5) - Task V3 observe: scan open component roots for the cross-origin iframes it reports (#8262) (cbc11aefc) - Task V3: address form controls inside repeated components by anchoring on their host (#8261) (e8234fd52) - Bound concurrent SDK actions per organization (SKY-14670) (#8260) (07222e7a7) - Task V3 observe: surface a rejection banner rendered inside a component (#8259) (58c53451b) - Task V3: list hidden native form controls behind styled proxies and act on them without the actionability timeout (#8258) (bc6c1beb2) - Genericize vendor design-system element prefixes in open-source-synced tests (#8257) (9073dae8a) - Make Task V3 perception see the named controls inside open shadow roots (#8256) (5638a617b) - Surface non-ARIA validation text and rejected fields in task_v3 observe (#8255) (e9c2e3bd1) - security: fix 15 npm vulnerabilities in internal-tools/dashboard (#8254) (b5d025e9b) - Recover split LLM responses that strand extra JSON fragments (SKY-12928) (#8253) (e3030f0a2) - Tag browser-session minutes with who actually ran the browser (#8252) (2a3a01478) - Turn off skyvern.cdp_proxy.* metric export to SigNoz (#8251) (64efcfd6f) - Score Code Block advisory scans with GuardDog's risk engine (#8250) (4a0710975) - fix: log unhandled file-download failures at warning not error (#8249) (146d67fb8) - Scale the prod API out earlier and keep the reason every task stopped (SKY-14682) (#8248) (f32549fde) - Count only real compute in run minutes (SKY-14608, SKY-14609) (#8247) (c68a662fb) - Log how each bare task's engine was chosen, once per run (#8246) (6dff8ac63) - SWCE 6/7: attribute exposure events to flag variants (#8244) (7f5eaea6e) - Resolve Workday education and certification fields from the profile keys production sends (#8241) (888348d56) - security: bump jupyterlab to 4.5.10 and fast-uri to 3.1.4 (#7745) (60b78c993) - Record which operation a copilot turn is awaiting and name it at deadline (SKY-14521) (#8240) (486c8975e) - SKY-14419 Surface collapsed authentication options to Copilot (#8239) (4d21ec7e7) - Fix exhausted-credit billing guidance (#8237) (b03bafb5c) - SKY-14258 Make stalled code-block navigation observable (#8236) (98dbe907f) - Prove native Task V3 single-task parity on isolated Contract-1 fixtures (#8234) (0afa31ef1) - Append correlation ids to log messages so Datadog free-text id search works again (SKY-14280) (#8233) (a54dc3905) - Add growth-analytics skill with canonical metric definitions and Redshift query patterns (#8232) (f0cd91094) - SKY-13326 Show reconnectable Google account notices in Copilot (#8231) (c6ad8161e) - Capture post-run page evidence from the run's own browser session (SKY-14254) (#8229) (b50f02566) - Add the selector engines Skyvern's producers emit to skycdp (SKY-14071) (#8217) (6a6b6383e) **Full Changelog**: https://github.com/Skyvern-AI/skyvern/compare/v1.0.50...v1.0.51 ## What's Changed * Add the selector engines Skyvern's producers emit to skycdp (SKY-14071) by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8217 * Capture post-run page evidence from the run's own browser session (SKY-14254) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8229 * SKY-13326 Show reconnectable Google account notices in Copilot by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8231 * Add growth-analytics skill with canonical metric definitions and Redshift query patterns by @marcmuon in https://github.com/Skyvern-AI/skyvern/pull/8232 * Append correlation ids to log messages so Datadog free-text id search works again (SKY-14280) by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8233 * Prove native Task V3 single-task parity on isolated Contract-1 fixtures by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8234 * SKY-14258 Make stalled code-block navigation observable by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8236 * Fix exhausted-credit billing guidance by @marcmuon in https://github.com/Skyvern-AI/skyvern/pull/8237 * SKY-14419 Surface collapsed authentication options to Copilot by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8239 * Record which operation a copilot turn is awaiting and name it at deadline (SKY-14521) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8240 * security: bump jupyterlab to 4.5.10 and fast-uri to 3.1.4 by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/7745 * Resolve Workday education and certification fields from the profile keys production sends by @trevor-cheung in https://github.com/Skyvern-AI/skyvern/pull/8241 * SWCE 6/7: attribute exposure events to flag variants by @marcmuon in https://github.com/Skyvern-AI/skyvern/pull/8244 * Log how each bare task's engine was chosen, once per run by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8246 * Count only real compute in run minutes (SKY-14608, SKY-14609) by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8247 * Scale the prod API out earlier and keep the reason every task stopped (SKY-14682) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8248 * fix: log unhandled file-download failures at warning not error by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8249 * Score Code Block advisory scans with GuardDog's risk engine by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8250 * Turn off skyvern.cdp_proxy.* metric export to SigNoz by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8251 * Tag browser-session minutes with who actually ran the browser by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8252 * Recover split LLM responses that strand extra JSON fragments (SKY-12928) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8253 * security: fix 15 npm vulnerabilities in internal-tools/dashboard by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8254 * Surface non-ARIA validation text and rejected fields in task_v3 observe by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8255 * Make Task V3 perception see the named controls inside open shadow roots by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8256 * Genericize vendor design-system element prefixes in open-source-synced tests by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8257 * Task V3: list hidden native form controls behind styled proxies and act on them without the actionability timeout by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8258 * Task V3 observe: surface a rejection banner rendered inside a component by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8259 * Bound concurrent SDK actions per organization (SKY-14670) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8260 * Task V3: address form controls inside repeated components by anchoring on their host by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8261 * Task V3 observe: scan open component roots for the cross-origin iframes it reports by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8262 * Type into a field a decorative wrapper covers, or say so at once by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8264 * Attach uploaded files to agent runs so the run's end deletes them by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8265 * Return the browser's own failure facts instead of constants when a code block fails (SKY-14625) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8266 * security: fix 15 npm vulnerabilities in skyvern-frontend by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8270 * security: update fast-uri and postcss in the TS client lockfiles by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8271 * Correct why the fitted-launch recording size is pinned (SKY-14736) by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8269 * Validate run minutes against Redshift with a repeatable harness (SKY-14606) by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8273 * Recover zero-sized screenshot viewports by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8274 * Attribute the copilot's guessed catalog picks to the acting model, with no product change (SKY-14540) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8275 * Task V3 observe: a "(required)" word marker on a per-field wrapper no longer starves the form's refusal banner (SKY-14818) by @pedrohsdb in https://github.com/Skyvern-AI/skyvern/pull/8276 * Workstation-persistent extension pairing approval with operator CLI bootstrap (SKY-14820) by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/8277 * Treat an unreachable SOCKS proxy as proxy-sensitive, not a retriable navigation error (SKY-14862) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8278 * SKY-14836 Pair fresh page screenshots with their evidence by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8279 * SKY-14839 Return complete build-test packets to Copilot by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8280 * SKY-14840 Share browser call outcomes across Copilot tools by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8281 * Make skyvern.com agent-readable: OAuth discovery, markdown negotiation, rate-limit headers, MCP manifest by @cindehaa in https://github.com/Skyvern-AI/skyvern/pull/8283 * Record the finally block's minutes instead of the run's body twice (SKY-14606) by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8284 * Redact proxy values at all logging sinks by @AronPerez in https://github.com/Skyvern-AI/skyvern/pull/8285 * Name the bounded replacement when a CodeBlock expect_* member is denied (SKY-14861) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8286 * Local-dev browser sessions: in-process mode, CDP address, PBS reset by @cindehaa in https://github.com/Skyvern-AI/skyvern/pull/8288 * Refresh .test_durations from CI by @suchintan in https://github.com/Skyvern-AI/skyvern/pull/8290 * Cap sweep-finalized run minutes at the run type's compute budget by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8292 * Carry obstruction controls through build-test results (SKY-14614) by @andrewneilson in https://github.com/Skyvern-AI/skyvern/pull/8293 * Bump version to 1.0.51 by @wintonzheng in https://github.com/Skyvern-AI/skyvern/pull/8291 **Full Changelog**: https://github.com/Skyvern-AI/skyvern/compare/v1.0.50...v1.0.51