Skip to main content

Whatโ€™s changed in v18.0.5

Released: 2025-12-10
Weโ€™re releasing v18.0.5, skipping comprimised versions v18.0.2, v18.0.3, and v18.0.4, due to the prior security incident.
This release fixes a potential security vulnerability in the build command related to zip file decompression. cli
  • ๐Ÿ› Remove problematic decompress-tar dependency (#1202)
core None! schema None! misc
  • ๐Ÿ”จ Switch to pnpm as package manager and task runner (#1204)

Incident: Unauthorized Access to Zapier NPM Packages

Released: 2025-11-24 Unauthorized Access to Zapier npm Packages Note: No action is needed from Zapier users, only from Zapier developers using one of the NPM package versions listed on this page. See that link for detailed mitigation recommendations. All Zapier products are operating as expected and there is no indication of data loss or leak. Please see this link for the most up-to-date information.

Whatโ€™s changed in v18.0.1

Released: 2025-11-05 This release addresses an npx resolution issue introduced in v18.0.0 and fixes TypeScript typing for nested input fields when working with line items. cli
  • ๐Ÿ› Fix npx resolution issue with dual binary entries (#1191)
core
  • ๐Ÿ› Fix children input types when line items are present (#1188)
schema None! misc None!

Whatโ€™s changed in v18.0.0

Released: 2025-10-30 Version 18.0.0 is a BREAKING CHANGE release that contains several important upgrades and changes. Here is a brief breakdown of the main changes (โ— denotes a breaking change): โ— Node.js 22 Support Zapier Platform v18 runs on Node.js 22 runtime. This is a breaking change as it may affect compatibility with older Node.js versions and dependencies. โ— Schema Changes The skipCleanArrayInputData experimental flag has been replaced with cleanInputData. This provides more consistent data cleaning behavior across the platform. This change is breaking only if youโ€™re using skipCleanArrayInputData. See cleanInputData flag documentation for more details on how to configure this behavior. โ— New Throttling Middleware A new throwForThrottling middleware has been added to prevent afterResponse middleware from suppressing 429 (throttling) responses. This ensures proper handling of rate limiting scenarios. This change is breaking if you want to handle 429 responses in your afterResponse. See v18.x and above: the built-in throwForThrottling middleware for how to handle 429s yourself. New Executable Name zapier-platform The CLI now includes a new executable name zapier-platform while deprecating the old zapier command. Both will work for now, but zapier-platform is the recommended command going forward.
Apart from these major changes, here are the detailed release notes for this release (note that โ— denotes a breaking change): cli
  • ๐ŸŽ‰ Add executable name zapier-platform and deprecate zapier (#1181)
  • ๐Ÿ”จ Update outdated dependencies with security vulnerabilities (#1111)
  • ๐Ÿ”จ Apply prettier formatting to generated auth files since gen.fs.write bypasses transform streams
  • ๐Ÿ”จ Add ESM wrapper improvements for better module support
core
  • โ— Add Node.js 22 support (#1078)
  • ๐ŸŽ‰ Add throwForThrottling middleware with backward-compatible default behavior (#1151)
  • ๐Ÿ› Add better error message for 413 responses (#1110)
schema
  • โ— Replace skipCleanArrayInputData with cleanInputData (#1183)
  • ๐Ÿ”จ Add global cleanInputData flag for consistent data cleaning behavior
misc
  • โ— Major dependency updates across all packages (#1079)
  • ๐Ÿ”จ Update CI configuration for Node.js 22 support
  • ๐Ÿ”จ Pin exact xmldom version for security

Whatโ€™s changed in v17.9.1

Released: 2025-10-28 This release addresses a bug in the zapier push command and includes dependency updates. cli
  • ๐Ÿ› Fix issue where zapier push fail if the app wasnโ€™t built already (may have affected ESM builds) (#1187)
core None! schema None! misc
  • ๐Ÿ”จ Bump vite from 6.3.6 to 6.4.1 (#1185)

Self-serve static IP for private integrations

Released: 2025-10-21 Self-serve static IP for private integrations
  • ๐ŸŽ‰ Static IP can now be enabled by team members for private integrations:
    • Platform UI toggle: Navigate to the Settings tab on the Advanced page to enable static IP addresses for your private integration without contacting support.
    • Published integrations: Continue to contact Zapier Support to enable static IP for published integrations.

Labeled Versions now available in CLI and Platform UI

Released: 2025-10-21 Labeled Versions
  • ๐ŸŽ‰ Labeled Versions are now publicly available!
    • Versions like 2.0.0-beta can be used for testing and avoiding version collisions during parallel development
    • More flexible โ€œsnapshotโ€ versions like 0.0.0-my-feature can be used to push integration updates without committing to a semantic version number

Whatโ€™s changed in v17.9.0

Released: 2025-10-20 This release fixes an issue with validation for labeled versions, and improves failures on zapier env:set. cli
  • ๐Ÿ› Validate snapshot labels for 12 chars instead of 18 (#1182)
  • ๐Ÿ’… Display failure reasons for env:set (#1180)
core None! schema None!

Whatโ€™s changed in v17.8.0

Released: 2025-10-07 Aside from some clean up work, this release adds support for natural snapshots to zapier push. This is currently only supported internally but look out for a public release soon! cli
  • ๐Ÿ’… zapier push supports natural snapshots (#1172)
  • ๐Ÿ› Address punycode deprecation warning by removing node-fetch (#1171)
  • ๐Ÿ“œ Fix incorrect docs in zapier migrate (#1169)
core
  • ๐Ÿ› Allow null and undefined values for page_token in SearchResult (#1168)
  • ๐Ÿ› Allow undefined value for paging_token (#1166)
misc
  • ๐Ÿ“œ Direct developers to Platform News (#1174)

Migration UI now supports individual and organization-level migrations

Released: 2025-10-02 Migration via the Platform UI
  • ๐ŸŽ‰ Email-based migration now supports two scopes:
    • Individual: Migrates only private Zaps under the userโ€™s individual account (equivalent to the --user flag of the zapier migrate CLI command)
    • Organization: Migrates all Zaps including shared resources across organization accounts (equivalent to the --account flag of the zapier migrate CLI command)

Whatโ€™s changed in v17.7.2

Released: 2025-09-17 cli
  • ๐Ÿ› Allows deleting old non-semver versions and blocks pushes to non-semver versions (#1160)
  • ๐Ÿ› Integration check displays failure icon if errors are present (#1159)
core
  • ๐Ÿ› Adds paging_token to bundle.meta types (#1157)
misc

Whatโ€™s changed in v17.7.1

Released: 2025-09-10 cli
  • ๐Ÿ› Fix zapier scaffold failing when app object contains spread elements (#1115)
  • ๐Ÿ› Fix zapier invoke auth may append to last line without a newline (#1138)
  • ๐Ÿ› Fix zapier scaffold to use .js extension for TS imports (#1123)
  • ๐Ÿ› Fix zapier scaffold to handle shorthand property syntax (#1125)
  • ๐Ÿ’… zapier validate now runs _zapier-build before validation by default (#1130)
  • ๐Ÿ’… Add dev script to package.json of typescript templates generated by zapier init (#1128)
  • ๐Ÿ’… Improve zapier init to list only templates that support selected module and language (#1146)
core
  • ๐Ÿ› Censor sensitive info in ResponseError (#1147)
schema
  • ๐Ÿ› Fix InputFieldGroupsSchema to have its properties displayed (#1143)
  • ๐Ÿงช Allow to skip cleaning arrays in inputData via skipCleanArrayInputData (#1153)
  • ๐Ÿ”จ Support version with label (ongoing work) (#1093)

No more manual handling of 4xx errors in refreshAccessToken

Effective: 2025-09-08 We made a change to how we handle error responses when refreshing OAuth2 access tokens. Old behavior When an app gives an error response (status code 4xx or 5xx) while refreshing the OAuth2 access token, Zapier keeps retrying the Zap step indefinitely or until it hits a certain limit, depending on the userโ€™s settings. New behavior When an app encounter a 4xx error response (except for the ones listed below) while refreshing the access token, Zapier will mark the connect as stale, and send an email telling the user to reconnect. Exceptions: The following 4xx errors often indicate a temporary issue so they still have the same behavior as before:
  • 408 (Request Timeout)
  • 409 (Conflict)
  • 423 (Locked)
  • 425 (Too Early)
  • 429 (Too Many Requests)
This is how Zapier handles a stale connection:
  • If the stale connection is used by a trigger step, the trigger polling system will skip polling when the scheduled time comes.
  • If the stale connection is used by an action step, the Zap run will be put on hold until the user reconnects and replays the run.
What does it mean to you? You donโ€™t need to handle 4xx error responses in refreshAccessToken anymore. For example, you might have been catching 4xx errors in refreshAccessToken by enabling skipThrowForStatus and throwing ExpiredAuthError:
const refreshAccessToken = async (z, bundle) => {
  const response = await z.request({
    url: "https://example.com/token/refresh",
    method: "POST",
    body: {
      refresh_token: bundle.authData.refresh_token,
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET,
      grant_type: "refresh_token",
    },
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
    },
    skipThrowForStatus: true,
  });

  if (response.status >= 400 && response.status < 500) {
    throw new z.errors.ExpiredAuthError(
      "Authentication issue. Please reconnect.",
    );
  }

  return response.data;
};
This is no longer necessary. Now you can simplify your code as follows and let the platform handle it:
const refreshAccessToken = async (z, bundle) => {
  const response = await z.request({
    url: "https://example.com/token/refresh",
    method: "POST",
    body: {
      refresh_token: bundle.authData.refresh_token,
      client_id: process.env.CLIENT_ID,
      client_secret: process.env.CLIENT_SECRET,
      grant_type: "refresh_token",
    },
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
    },
  });
  return response.data;
};
No need to upgrade zapier-platform-core; this change is implemented in the Zapier backend.

Whatโ€™s changed in v17.7.0

Released: 2025-08-22 cli
  • ๐Ÿ› Fix zapier pull error โ€œlistFiles is not a functionโ€ (#1113)
  • ๐Ÿ› Fix zapier invoke auth writing object values to .env as [object Object] (#1107)
  • ๐Ÿ’… Add logic to zapier build to handle the case where the app directory has symlinks to files on a different drive (#1106)
  • ๐ŸŽ‰ zapier invoke supports testing Search Pagination with a paging_token flag (#1082)
core
  • ๐ŸŽ‰ Foundational support for Search Pagination (#1082)
schema
  • ๐ŸŽ‰ Schema support for Search Pagination (#1082)
misc
  • ๐Ÿ’… Enable Windows in Github Actions CI (#1106)
  • ๐Ÿ’… Add Claude, Copilot, and Cursor instructions/rules (#1107)
  • ๐Ÿ”จ Bump tmp from 0.2.3 to 0.2.4 (#1100)
  • ๐Ÿ”จ Bump sha.js from 2.4.11 to 2.4.12 (#1116)

Whatโ€™s changed in v17.6.0

Released: 2025-08-11 cli
  • ๐Ÿ’… Add user and account filters to canary (#1066)
core
  • ๐Ÿ’… Export console from zapier-platform-core (#1077, #1102)
  • ๐Ÿ› Allow safe authData keys to be logged uncensored (#1097)
schema None!

Whatโ€™s changed in v17.5.0

Released: 2025-07-30 cli
  • ๐Ÿ› Fix missing bundle.inputDataRaw in invoke command (#1072)
  • ๐Ÿ› Fix error 'No loader is configured for ".node" files' on zapier build (#1094)
  • ๐Ÿ”จ Refactor zapier init to move auth befores/afters into middleware.js instead of authentication.js (#1073)
core
  • ๐Ÿ’… Export errors from zapier-platform-core (#1075)
  • ๐Ÿ”จ Update form-data from 4.0.1 to 4.0.4 (#1096)
schema
  • ๐Ÿ’… Expanded AuthFieldSchema with additional field types:
    • Added support for the integer type (#1095).
    • Added support for the text type (#1098).

Whatโ€™s changed in v17.4.0

Released: 2025-07-23 cli
  • ๐Ÿ› Fix regression bugs with zapier build, where it can fail with โ€œโ€˜The โ€œpathโ€ argument must be of type stringโ€™โ€ when dirent.parentPath property is missing (#1087)
  • ๐Ÿ› Fixes a regression where zapier build --skip-npm-install fails when an app has a linked dependencies in its node_modules (#1089)
  • ๐Ÿ› Remove empty array at the end of zapier versions -f json (#1086)
  • ๐Ÿ’… Add additional Typescript auth options to zapier init (#1067)
core
  • ๐Ÿ’… Support compression when stashing large input bundles (#1085)
schema None!

Whatโ€™s changed in v17.3.1

Released: 2025-07-17 cli
  • ๐Ÿ› Fix regression bugs with zapier build --skip-npm-install, where:
    • it can miss local packages files when building in a Lerna monorepo (#1068)
    • it can fail with โ€œConfiguration property โ€ฆ is not definedโ€ when config package is used (#1071)
  • ๐Ÿ’… Improve some error messages in zapier build (#1070)
core
  • ๐Ÿ’… Improve the error message when the app module fails to import (#1070)
schema None!

Whatโ€™s changed in v17.3.0

Released: 2025-07-01 This release introduces two major improvements: zapier build and input field grouping. The zapier build command has been revamped to:
  • Better support npm/yarn/pnpm workspaces
  • Run faster when the --skip-npm-install flag is enabled
  • Test the build.zip file to verify all load-time dependencies are included (not applicable on Windows)
Input Field Grouping:
  • Grouping support, intended for visual purpose in products, has been added to the input fields.
cli
  • ๐Ÿ’… zapier build supports npm/yarn/pnpm workspaces and runs faster (#1052)
  • ๐Ÿ› Fix a bug where zapier build can select the wrong entry point of a dependency (#1052 - c004298)
  • :scroll: Update docs for new days before deprecation and sending emails (#1056)
core
  • ๐Ÿ› Fix a bug where Fetch logger crashes when response doesnโ€™t have content-type (#1062)
  • ๐Ÿ› Fix a bug where text/xml response content should be logged (#1058)
  • ๐Ÿ’… Typing update: allow overriding id requirement in polling triggers (#1059)
  • ๐Ÿ’… Typing update: allow test bundles to be recursively partial (#1057)
  • ๐Ÿ”จ Bump fernet from 0.4.0 to 0.3.3 (latest) (#1055)
schema
  • ๐ŸŽ‰ Input fields now support visual grouping through the โ€œgroupโ€ property of the /PlainInputFieldSchema and the new /InputFieldGroupsSchema (#1061)

Whatโ€™s changed in v17.2.0

Released: 2025-06-11 cli None! core
  • ๐ŸŽ‰ Add before middleware to fetch stashed bundles for improved large payload handling (#1050)
schema None!
Looking for older news? 2025, and old changelogs prior to v17