Release: 26.8.5

Date: 2.Sept.2026

This release fixes a critical vulnerability where the formula could be manipulated to allow stored XSS, only blocked by Jira’s CSP. Additionally, formulas with nested if statements were previously calculated as 0 in some cases and are now calculated correctly.

This release also addresses known security vulnerabilities in third-party dependencies by upgrading them to secure versions.

STAC-1803 BugBounty: Stored formula executes arbitrary JavaScript in any viewer's browser

STAC-1802 - third-party dependency security vulnerabilities