v1.10.0

NOV 5, 2026View on GitHub

Pro highlights

Agent workflows

In a project's AI Team → Autopilot, you draw a chain of agents on a canvas. An issue event, a cron, a person, or a webhook request starts the chain. A step can send the work back to an earlier agent for another pass. MCP clients create and run workflows too.

Community highlights

Project templates and a public gallery

Save a project as a template and create new projects from it. Templates belong to the workspace, and you choose the teams that can use them. A template exports to a file for another workspace or instance, and you can publish it to the gallery.

Agent run queues and limits

A project, a team, and a workspace each have a queue with the runs of internal and external agents. God mode → General → Runs at once limits the internal agent runs on the instance, and a workspace owner can set a lower limit. The instance limit is 5 runs by default and replaces AGENT_RUN_BATCH_SIZE.

System roles

The instance owner manages roles in God mode → System roles, and every team can assign them. The default Member role is now a system role, so one edit applies to every team that uses it.

Private views and your own tab row

Any member can save a private view that only they see. Each person orders their own tabs and hides the views they do not use. Other people's tabs stay as they are.

A share link of an issue or a saved view can expire in 1, 3, or 7 days, or at the end of a day you pick. After that, the link stops working.

Document tools for agents

Internal agents and MCP clients can link documents to issues and initiatives, read and answer comments, and manage files, versions, and access.

Mastra Code preset

Runner 0.8.0 has a preset for Mastra Code. Set "agent": "mastracode" in itsaplan-runner.json, and Mastra Code works as an external agent that keeps its chat thread.

Security

This release fixes 1 high and 1 medium advisory. Update every instance.

GHSA-rm43-x3w3-7vf3 (high): the upload check accepted a content type such as image/png, text/html, and a browser opened such a file as a web page on the instance's address. A script in the file could take over the account of a person who opened the link, the instance owner's included.
GHSA-6j58-7qvh-rpf8 (medium): the webhook list returned the signing secret to everyone who could read webhooks, also to agents and API keys. The list now returns it only to a caller who can create or edit webhooks. Regenerate secret in the webhook list issues a new one.
Dependencies: better-auth 1.7.16 fixes GHSA-9hm7-xhfp-cx58, and Bun 1.4.4 fixes CVE-2026-111497.

Also in this release

In Pro, the agent_workflows permission lets a role run workflows without access to agent keys.
In Pro, the audit log records system roles, project templates, gallery publishing, and regenerated webhook secrets. Events made over MCP keep the client's address and device.
The agent_schedules permission lets a role manage agent schedules without access to agent keys.
The default role no longer opens the settings pages for states, issue types, labels, custom fields, and issue templates. Members still see these values on the board and in issues.
Copy link on a comment gives a direct link to it. Notifications about a comment open it too.
The board, Timeline, Calendar, and Table stay fast with thousands of issues.
Chat can be turned off for an agent. Mentions, delegations, and schedules still run it.
The agent_run.finished webhook event reports the end of an agent run.
Agents can search and read the web with the Keenable tools, which need no account or API key.
A team's email provider has its own From address.
list_issues takes blocked=true. The list_issues_all_projects and list_cycles_all_projects MCP tools work across projects.
Project analytics leave out archived issues. Progress and the burnup leave out issues archived unfinished.
Turning off Docs in a project also closes its documents to the API, MCP, and agents.
Two tabs that recover the same document keep the text of both.
An issue or project name with two spaces in a row no longer freezes the page.
The start page no longer stays on Loading forever, and the shared issue page fits a phone screen.
MCP clients with strict schema checks, such as Kimi Code, can call tools with nullable arguments.