- Custom user profile photos with new avatars.write scope and Webflow added as an OAuth2 provider.
- Push provider now supports direct messages to user topics and webhook retries include stable delivery IDs that only resend failed calls.
- Security hardening: outbound request address validation, project‑bound JWTs, breached password policy, and retirement of the Appwrite Assistant.