This release adds OpenAPI 3.1 collection export, zoom level controls in the Desktop App, and configurable proxy URLs from environment variables and the admin dashboard, alongside security patches and bug fixes.

What's Changed

• fix(security): prevent mass assignment in onboarding by @nahidhasan94 in https://github.com/hoppscotch/hoppscotch/pull/6171
• fix: class validator decorator usages by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6293
• chore: security patch for the dependency chain v2026.5.0 by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6338
• fix: stop secret variable values from leaking to backend by @nivedin in https://github.com/hoppscotch/hoppscotch/pull/6279
• fix(common): wait for proxy settings before issuing requests by @anwarulislam in https://github.com/hoppscotch/hoppscotch/pull/6333
• feat: make proxy URL configurable from env and admin dashboard by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6336
• feat(desktop): zoom level control in settings by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6358
• feat(common): add OpenAPI 3.1 collection export by @mcdgavin in https://github.com/hoppscotch/hoppscotch/pull/5880
• fix(desktop): align appload types and resolve shell import alias by @CuriousCorrelation in https://github.com/hoppscotch/hoppscotch/pull/6369
• fix: class validation issue for updateRESTUserRequest by @mirarifhasan in https://github.com/hoppscotch/hoppscotch/pull/6373
• feat: add Mongolian translation by @cf3901646 in https://github.com/hoppscotch/hoppscotch/pull/6344
• fix(common): preserve collection tree on OpenAPI re-import by @jamesgeorge007 in https://github.com/hoppscotch/hoppscotch/pull/6376

New Contributors

• @mcdgavin made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/5880
• @cf3901646 made their first contribution in https://github.com/hoppscotch/hoppscotch/pull/6344

Full Changelog: https://github.com/hoppscotch/hoppscotch/compare/2026.4.1...2026.5.0