v2026.7.0

Full changelog: https://yaak.app/changelog/2026.7.0

### 🎁 New

- 🔗 Import from a URL ([#551](https://github.com/mountain-loop/yaak/pull/551))
- 🕘 Filter history with pinning ([#338](https://github.com/mountain-loop/yaak/pull/338), [feedback](https://yaak.app/feedback/posts/history-filter-response))
- 📄 GraphQL schemas from a file ([#462](https://github.com/mountain-loop/yaak/pull/462))
- 📥 New OpenAPI importer ([#486](https://github.com/mountain-loop/yaak/pull/486), [feedback](https://yaak.app/feedback/posts/problems-with-big-schemas))
- Create an environment for each OpenAPI server URL ([#590](https://github.com/mountain-loop/yaak/pull/590), [feedback](https://yaak.app/feedback/posts/create-environments-from-openapi-server-urls))
- Force HTTP/1.1 or HTTP/2 per request, folder, or workspace ([#609](https://github.com/mountain-loop/yaak/pull/609), [feedback](https://yaak.app/feedback/posts/settings-at-request-folder-workspace-level-for-setting-http-level))

### 💄 Improved

- 🔌 Plugin API for reading response bodies ([#560](https://github.com/mountain-loop/yaak/pull/560))
- Show the CLI update notice in non-interactive shells so agents see it
- Support OpenAPI 3.2 QUERY and additional operations on import ([#591](https://github.com/mountain-loop/yaak/pull/591))
- Fill OAuth client ID and secret from environment variables on OpenAPI import ([#587](https://github.com/mountain-loop/yaak/pull/587), [feedback](https://yaak.app/feedback/posts/openapi-import-add-client_id-and-client_secret-variable))
- Import spec-level OpenAPI security as workspace authentication ([#601](https://github.com/mountain-loop/yaak/pull/601))
- Generate XML bodies and serialize deepObject, label, and matrix parameters on OpenAPI import ([#602](https://github.com/mountain-loop/yaak/pull/602))
- Fill the OAuth redirect URI from an environment variable on OpenAPI import ([#610](https://github.com/mountain-loop/yaak/pull/610), [feedback](https://yaak.app/feedback/posts/openapi-import-add-client_id-and-client_secret-variable))

### 🛠️ Fixed

- Honor workspace connection settings in CLI sends ([#537](https://github.com/mountain-loop/yaak/pull/537))
- Include the request body in AWS SigV4 signatures ([#430](https://github.com/mountain-loop/yaak/pull/430), [feedback](https://yaak.app/feedback/posts/aws-v4-signature-with-ceph-broken))
- Fix OAuth password grant tokens being reused when the username changes ([#426](https://github.com/mountain-loop/yaak/pull/426))
- Restore HTTP/2 and client certificate support when TLS validation is disabled ([#543](https://github.com/mountain-loop/yaak/pull/543))
- Follow the OS appearance when set to System without opening a new window ([#540](https://github.com/mountain-loop/yaak/pull/540), [feedback](https://yaak.app/feedback/posts/automatic-theme-not-following-system-light-dark-mode))
- Fix a sync watcher crash when the sync directory path traverses a symlink ([#541](https://github.com/mountain-loop/yaak/pull/541))
- Don't save the response when the file dialog is cancelled ([feedback](https://yaak.app/feedback/posts/bug-error-occurs-when-cancelling-file-save-dialog-in-yaak-response))
- Fix client certificates on Linux when TLS validation is disabled ([#554](https://github.com/mountain-loop/yaak/pull/554))
- Upgrade dependencies to resolve 29 security advisories ([#562](https://github.com/mountain-loop/yaak/pull/562))
- Don't send scope on the OAuth authorization code token request ([#579](https://github.com/mountain-loop/yaak/pull/579), [feedback](https://yaak.app/feedback/posts/oauth-2-scope-should-only-be-sent-on-authorize))
- Fix new workspaces defaulting to not sending or storing cookies ([#573](https://github.com/mountain-loop/yaak/pull/573))
- Fix Timeline entries appearing in reverse order ([#573](https://github.com/mountain-loop/yaak/pull/573))
- Read combined short flags as separate options when importing cURL ([#577](https://github.com/mountain-loop/yaak/pull/577))
- Render all columns in irregular CSV responses ([#584](https://github.com/mountain-loop/yaak/pull/584))
- Fix the app not activating after a relaunch on macOS ([#583](https://github.com/mountain-loop/yaak/pull/583))
- Quote apostrophes and file paths when copying as cURL or gRPCurl ([#593](https://github.com/mountain-loop/yaak/pull/593))
- Keep --data-urlencode values whole and tolerate a stray % on cURL import ([#597](https://github.com/mountain-loop/yaak/pull/597))
- Preserve OpenAPI security requirement semantics on import ([#586](https://github.com/mountain-loop/yaak/pull/586))
- Fix OpenAPI import of array $refs, cookie parameters, mid-segment path templates, and typed examples ([#599](https://github.com/mountain-loop/yaak/pull/599))
- Preserve the base URL variable when an OpenAPI document omits servers ([#585](https://github.com/mountain-loop/yaak/pull/585), [feedback](https://yaak.app/feedback/posts/openapi-import-does-not-add-base_url-to-urls))
- Prevent the environment dropdown from opening alongside the environment editor
- Fix the System appearance always resolving to light on macOS 27 ([#603](https://github.com/mountain-loop/yaak/pull/603))
- Send the signing key as the OAuth 1.0 PLAINTEXT signature ([#605](https://github.com/mountain-loop/yaak/pull/605))
- Keep an = inside --url-query and form values on cURL import ([#606](https://github.com/mountain-loop/yaak/pull/606))
- Escape control characters in the json.escape template function ([#607](https://github.com/mountain-loop/yaak/pull/607))
- Render template values before plugin config forms use them, fixing the 1Password vault dropdown ([#608](https://github.com/mountain-loop/yaak/pull/608))
- Check for updates on Linux deb, rpm, and Flatpak installs and say how to update ([#604](https://github.com/mountain-loop/yaak/pull/604), [feedback](https://yaak.app/feedback/posts/no-updates-available))
- Sign OAuth 1.0 requests with the token secret when no access token is set ([#611](https://github.com/mountain-loop/yaak/pull/611))

<!-- generated-by-yaak-releases -->