Release Notes - v2026.6.0

Desktop Cookie Persistence, OAuth2 ID Token Support, Mock Server Reliability, Thai Language Support, Security Hardening and more! 🚀

Highlights

• Desktop Cookie Persistence and Reapplication: The desktop app now preserves and reapplies cookies across sessions, so authenticated and multi-step testing flows pick up where you left off instead of starting cold.

• ID Token Support for OAuth2: OAuth2 token requests can now use the id_token returned by OpenID Connect providers, in addition to the standard access token — handy when an API expects the OIDC identity token for authentication.

• Mock Server URL and Visibility Fixes: Domain-based mock server URLs now correctly append /backend when subpath access is enabled, and newly created mock servers default to private, saving their public/private visibility correctly.

• Collection and Request Handling: Inherited collection headers now resolve environment variables correctly, and JSON request bodies are preserved when importing from cURL.

• Thai Language Support: Hoppscotch is now available in Thai, thanks to our community translators.

• Security Hardening: Backend APIs now enforce ownership on user history and private user fields, SMTP URL validation is hardened in the self-hosted backend, and the v2026.6.0 dependency chain received its security patch.

• Self-Hosted Admin Dashboard: The admin dashboard now surfaces which configuration fields are blocking a save, making misconfigured instances quicker to debug.

This update includes new features and important security fixes. Your data will be backed up automatically. If needed, see Downgrading and Restoring Backups.

👉 Read the full release blog