March 28, 2026
Taskade developer changelog — March 28, 2026: @taskade/embed Migrated into Monorepo with Security Hardening, HSTS Header Configured Explicitly for API…
Last updated
Was this helpful?
Taskade developer changelog — March 28, 2026: @taskade/embed Migrated into Monorepo with Security Hardening, HSTS Header Configured Explicitly for API…
Developer highlights. This section tracks API, MCP, SDK, automation, and Taskade Genesis platform changes for developers. For the full product changelog see taskade.com/changelog; for release newsletters see taskade.com/blog/updates.
The @taskade/embed package — the floating-popup AI agent chat widget for embedding Taskade agents on external websites — is now versioned and released alongside the rest of the Taskade platform. Version 1.1.1 is published. Key security improvements shipped alongside the migration:
sandbox attribute added to the embed iframe — the agent chat iframe now carries sandbox="allow-scripts allow-same-origin allow-forms allow-popups", restricting what the embedded frame can do on the host page. Host page developers who embed agents via the widget should review these sandbox permissions if they rely on cross-frame interaction.
title attribute set on the embed iframe — improves accessibility for screen readers on host pages.
Shadow DOM style isolation and React 18 compatibility improvements were also included.
The embed package is published to the GitHub npm registry with automated build and release workflows.
Reference: API Guide
Strict-Transport-Security is now set explicitly in backend responses (CASA 14.4.5), ensuring HTTPS enforcement for all API and webhook endpoints. No client-side changes are required, but integrators relying on HTTP-only endpoints should ensure all requests use HTTPS.
Reference: Webhooks | Automation Integrations
When a .tsk app kit or a GitHub-hosted bundle is imported into a workspace, flows that do not require external OAuth credentials (Taskade internal triggers, webhook triggers, and manual triggers) are automatically enabled after import; flows requiring OAuth credential connections are skipped and must be enabled manually. Previously, all flows imported via bundle required manual enablement. This is relevant for developers distributing Taskade apps via the bundle format who want compatible flows to be active immediately on install.
Reference: Bundles & App Kits | Automation Actions
The agent chat message metadata schema now surfaces a finish field containing the AI SDK FinishReason value returned by the underlying LLM. The field is optional and present only when the model returns a finish reason. Values follow the AI SDK FinishReason enum (e.g. stop, length, tool-calls, content-filter). Developers building on top of the agent chat protocol or inspecting message metadata can use this to detect truncated responses or tool-call termination.
Reference: API Guide (shipped March 31)
Last updated
Was this helpful?
Was this helpful?