v0.7.40

## Features

- feat(library): add Best AI Agents for Sales and CRM Automation post (#5796)
- feat(managed-agents): add Claude Managed Agents workflow block (#5778)
- feat(zip): add support for zip files (#5788)
- feat(blocks): surface deprecated block and model warnings on canvas (#5785)
- feat(pi): add code review mode (#5577)
- feat(copilot): add share_file tool handler and surface file share state to the agent (#5656)
- feat(mcp): reuse warm connections for tool execution and discovery (#5760)
- feat(library): add BYOK multi-model AI agent builder post (#5758)
- feat(library): add Best Relay.app Alternatives in 2026 post (#5755)

## Improvements

- improvement(blocks): two-tier sunset schema (legacy amber / deprecated red) (#5793)
- improvement(ux): submit on Enter in chip modals and advance table rows (#5781)
- improvement(blocks): name the integration in every suggested-action template title (#5775)
- improvement(mcp): bound pool create-invalidation to in-flight creates; document DCR match (#5777)
- improvement(mcp): trace OAuth state writes to diagnose invalid_state clobber (#5772)

## Bug Fixes

- fix(mcp): use HTTP/1.1 for the streamable-HTTP transport (drop allowH2) (#5797)
- fix(ux): balance question-card spacing and drop stray SMTP icon dot (#5794)
- fix(mcp): bound and tear down one-shot OAuth fetches so auth can't hang (#5789)
- fix(library): show full unambiguous dates on featured and related cards (#5783)
- fix(ui): tuck notification stack below modal and dropdown menus (#5779)
- fix(mcp): bound OAuth discovery/DCR/token fetches with a timeout (#5776)
- fix(sidebar): reset drag state on dragend so edge drop zones can't strand over first/last rows (#5774)
- fix(gmail-poller): resolve OAuth credential provider aliases (#5770)
- fix(mcp): deliver OAuth callback result over BroadcastChannel so COOP can't strand the connect (#5767)
- fix(mcp): keep a legacy server row from blanking the whole server list (#5762)
- fix(chat): run block execution state loader (#5759)
- fix(mcp): auth-type handling, OAuth-pending UX, safe diagnostics + HTTP/2 (#5757)
- fix(security): bound YAML alias expansion in file-parser (billion-laughs DoS) (#5756)

## Other Changes

- chore(mcp): remove temporary HTTP diagnostics (#5795)
- diag(mcp): comprehensive HTTP logging for OAuth + streamable-HTTP transport (#5782)
- chore(tiktok): simplify to draft-only Content Posting (#5703)

## Contributors

- @BillLeoutsakosvl346
- @Sg312
- @TheodoreSpeaks
- @icecrasher321
- @j15z
- @waleedlatif1

[View changes on GitHub](https://github.com/simstudioai/sim/compare/v0.7.39...v0.7.40)