Skip to main content
Release date: May 25, 2026 Type: Release Candidate Focus: Evo Hub integration + Typebot interactive buttons + MFA hardening
v1.0.0-rc4 ships roughly 8 days after v1.0.0-rc3 and centers on two end-to-end features and one round of security hardening: Evo Hub as an optional proxy for Meta channels, Typebot interactive buttons across processor / CRM / frontend / widget, and MFA hardening in the auth-service (post-EVO-991 backup-code remediation, session cache invalidation, licensing fail-open).

​
Highlights

​
🔌 Evo Hub as optional proxy for Meta channels

You can now connect WhatsApp / Instagram / Facebook channels through Evo Hub as a proxy, instead of going through the direct Meta integration. The feature is opt-in — when Evo Hub is not configured, the direct Meta flow keeps working as before. End-to-end wiring:
  • Frontend — new admin page (URL, API key, webhook secret with built-in crypto.getRandomValues generator) plus a HubConnectButton to connect channels via the Hub proxy.
  • CRM — dedicated webhook receiver, InboxBuilder for proxy inboxes, hub_pending? / hub_active? lifecycle on the Channel model, hardened validation, and cleanup that propagates webhook deletion to the remote Hub.

​
💬 Typebot interactive buttons

Typebot choice blocks now render as interactive button messages instead of plain text, both in the main chat and in the embeddable widget. Touches three submodules in lockstep: evo-ai-processor-community (#12), evo-ai-crm-community, and evo-ai-frontend-community.

​
🔐 MFA hardening (auth-service)

  • Plaintext backup codes from pre-fix deployments invalidated (EVO-991) — a one-shot migration zeroes otp_backup_codes and clears mfa_confirmed_at for any user whose array still contains legacy non-BCrypt entries. Affected users are flagged with mfa_setup_incomplete: true and bypass the MFA challenge on next login until re-setup completes.
  • Session cache invalidated after MFA re-setup (EVO-1104) — complete_mfa_setup now invalidates the cache immediately, instead of waiting up to 5 minutes for the TTL.
  • Licensing fail-open — when the licensing server is unreachable, the auth-service operates in a short fail-open window rather than blocking logins.

​
Other Notable Changes

​
CRM

  • EVO-1088 — Macro execution status persistence + webhook failure surfacing — macro executions now persist status (success/failure/error message) and expose failures via webhook payload so external automations can react.
  • EVO-1372 — Interactive-message hardening — payload validation, truncation to Meta/WhatsApp limits, edge-case handling.
  • Legacy single-account assumption fixes — internal paths still dereferenced the removed Account model; remaining call sites fixed.
  • Strengthened label/conversation listeners — label_list mutation paths now emit consistently via setter.

​
Frontend

  • EVO-1088 — Real macro execution result in the UI (#89) — UI shows the actual success/failure/error message from the backend.
  • EVO-1274 — Adaptive useRelativeTime cadence (30s / 60s / 10min) — reduces re-renders in conversations with many messages.
  • EVO-1254 — Natural-language lastSaved indicator — replaces raw HH:MM:SS with “2 minutes ago” / “just now”.
  • Chat fixes — total conversation count from API, loadMore race condition on slow networks, sidebar scroll / layout collapse.
  • EVO-1405 — Contact sidebar fetches full contact data on open.
  • EVO-1406 / EVO-1407 — SessionsViewer envelope unwrap + defensive stats guards.

​
Auth Service

  • EVO-1104 — Onboarding survey push — implementation of response push plus a resume endpoint for users that abandoned the flow.
  • Runtime storage provider (EVO-1050) — Admin UI changes to S3 / GCS / local storage apply to the running process without restart. Warn log emitted on default fallback.
  • ActiveRecord migration version downgrade 7.2 → 7.1 — matches the Rails version actually in use; avoids boot errors during db:migrate.

​
Processor

  • Typebot interactive button rendering (#12) — paired with the matching CRM and frontend changes.

​
Core Service

  • No functional changes — tag issued to keep the CRM Community family aligned on a single release-candidate version.

​
Upgrade Notes

  • ✅ Automatic — most changes apply on container restart. No new environment variables introduced for end users.
  • ⚠️ Auth migration with row-level lock — the EVO-991 backup-code invalidation migration runs an UPDATE with a row-level lock on the users table. For databases with more than 100k users, schedule a short maintenance window.
  • ⚠️ MFA re-setup prompt — users who had MFA enabled before v1.0.0-rc4 will be prompted to set up TOTP again on next login. This is a precautionary measure post-EVO-991, not a response to a confirmed leak.
  • ⚠️ CRM legacy schema cleanup migration — drops deprecated tables. No impact on production data (the tables were not in use). Run db:migrate on upgrade.
  • 📝 No new env vars required for the Evo Hub feature unless you choose to enable it (configure via the Admin UI).

​
Compatibility

  • Compatible with v1.0.0-rc3 deployments — direct upgrade path.
  • No breaking changes in the public API.
  • Docker images published under the evoapicloud org on Docker Hub. The Docker tag drops the leading v (git v1.0.0-rc4 → Docker 1.0.0-rc4).

​
Technical Reference