> For the complete documentation index, see [llms.txt](https://docs.taskade.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.taskade.com/changelog/changelog-2026/march-2026/march-28-2026.md).

# March 28, 2026

{% hint style="info" %}
**Developer highlights.** This section tracks API, MCP, SDK, automation, and Taskade Genesis platform changes for developers. For the full product changelog see [taskade.com/changelog](https://www.taskade.com/changelog); for release newsletters see [taskade.com/blog/updates](https://www.taskade.com/blog/updates).
{% endhint %}

## What's New:

### @taskade/embed Migrated into Monorepo with Security Hardening

The `@taskade/embed` package — the floating-popup AI agent chat widget for embedding Taskade agents on external websites — is now versioned and released alongside the rest of the Taskade platform. Version 1.1.1 is published. Key security improvements shipped alongside the migration:

* **`sandbox` attribute added to the embed iframe** — the agent chat iframe now carries `sandbox="allow-scripts allow-same-origin allow-forms allow-popups"`, restricting what the embedded frame can do on the host page. Host page developers who embed agents via the widget should review these sandbox permissions if they rely on cross-frame interaction.
* **`title` attribute set on the embed iframe** — improves accessibility for screen readers on host pages.
* Shadow DOM style isolation and React 18 compatibility improvements were also included.

The embed package is published to the GitHub npm registry with automated build and release workflows.

Reference: [API Guide](/developers/comprehensive-api-guide.md)

***

### HSTS Header Configured Explicitly for API and Webhook Endpoints

`Strict-Transport-Security` is now set explicitly in backend responses (CASA 14.4.5), ensuring HTTPS enforcement for all API and webhook endpoints. No client-side changes are required, but integrators relying on HTTP-only endpoints should ensure all requests use HTTPS.

Reference: [Webhooks](/developers/webhooks.md) | [Automation Integrations](/automations/automation/integrations.md)

***

### Automation Flows Auto-Enable on .tsk and GitHub Import

When a `.tsk` app kit or a GitHub-hosted bundle is imported into a workspace, flows that do not require external OAuth credentials (Taskade internal triggers, webhook triggers, and manual triggers) are automatically enabled after import; flows requiring OAuth credential connections are skipped and must be enabled manually. Previously, all flows imported via bundle required manual enablement. This is relevant for developers distributing Taskade apps via the bundle format who want compatible flows to be active immediately on install.

Reference: [Bundles & App Kits](/developers/bundles.md) | [Automation Actions](/automations/automation/actions.md)

***

### Agent Message Metadata Now Includes Finish Reason

The agent chat message metadata schema now surfaces a `finish` field containing the AI SDK `FinishReason` value returned by the underlying LLM. The field is optional and present only when the model returns a finish reason. Values follow the AI SDK `FinishReason` enum (e.g. `stop`, `length`, `tool-calls`, `content-filter`). Developers building on top of the agent chat protocol or inspecting message metadata can use this to detect truncated responses or tool-call termination.

Reference: [API Guide](/developers/comprehensive-api-guide.md) (shipped March 31)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.taskade.com/changelog/changelog-2026/march-2026/march-28-2026.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.