v0.7.41

## Features

- feat(chat): soft-delete sidebar chats with restore from Recently Deleted (#5830)
- feat(library): Best AI Agents for Data Extraction and RAG in 2026 (#5834)
- feat(access-control): per-group chat-deploy auth modes + polish (#5818)
- feat(providers): add Gemini 3.6 Flash and 3.5 Flash-Lite (#5812)
- feat(models): sunset tiers for models mirroring blocks (legacy amber / deprecated red) (#5805)

## Improvements

- improvement(deployments): shorten lock windows and add tx safety timeouts on the deploy path (#5841)
- improvement(mothership): stable thinking indicator and jump-free streaming scroll (#5828)
- improvement(subblocks): trust block registry over stored subblock type (#5832)
- improvement(mcp): make the OAuth experience visible and verbally consistent (#5829)
- improvement(admin): cleanup included usage settings for enterprise (#5825)
- improvement(search-modal): remove matched-character bolding and move SearchHighlight into knowledge (#5822)
- improvement(emcn): consistent hugging tab bars via ChipModalTabs (#5815)
- improvement(mcp): let users re-open OAuth authorization anytime (#5809)
- improvement(slack): merge slack_v2 auth into one credential picker for accounts and custom bots (#5800)

## Bug Fixes

- fix(mcp): keep last-known-good tools instead of flashing red on a transient failure (#5839)
- fix(auth): gate email-otp auto-signup behind DISABLE_EMAIL_SIGNUP (#5840)
- fix(mcp): follow tools/list pagination instead of silently truncating (#5833)
- fix(workflow): align condition/router handles with their rows (#5831)
- fix(slack): allow empty status to clear the assistant status indicator (#5827)
- fix(mcp): open the OAuth popup synchronously and bound the start request (#5824)
- fix(mcp): replace single-IP pinning with validate-at-connect SSRF guard (#5823)
- fix(ci): run Build App on the larger runner in GitHub mode (#5826)
- fix(ci): make GitHub-hosted fallback actually build and test (#5814)
- fix(mcp): retire pooled connections after consecutive request timeouts (#5821)
- fix(mcp): keep the pooled connection warm on a request timeout (#5817)
- fix(pii): mask offloaded large payloads chunk-by-chunk instead of aborting at 16MB (#5810)
- fix(custom-blocks): render and execute custom blocks as agent tools (#5811)
- fix(workflow-persistence): make persistMigratedBlocks' updated_at guard millisecond-tolerant (#5790)
- fix(mcp): don't blank the MCP tools page when tool discovery fails (#5816)
- fix(mcp): bound OAuth callback steps and log each phase to pinpoint hangs (#5807)
- fix(csp): allow X (Twitter) conversion pixel domains on hosted (#5804)
- fix(emails): keep custom whitelabel logos at height 34, not the padded wordmark's 41 (#5803)
- fix(emails): sharpen wordmark, add clear space, and standardize footer icon sizes (#5802)
- fix(security): prefer IPv4 when pinning DB and 1Password connections (#5799)
- fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs (#5798)

## Other Changes

- diag(mcp): per-request phase logging on the streamable-HTTP transport (#5819)
- chore(ci): add CI_PROVIDER toggle between Blacksmith and GitHub-hosted runners (#5808)

## Contributors

- @TheodoreSpeaks
- @icecrasher321
- @waleedlatif1

[View changes on GitHub](https://github.com/simstudioai/sim/compare/v0.7.40...v0.7.41)