Home → Release Notes → Release Notes → HelpSpot 5.8.8

1.3. HelpSpot 5.8.8

Updated: 20 Oct 2026, 01:32 PM EDT

Release Date: 10/20/2026

This release includes small security-related behavior changes. Most users will be unaffected. Review the upgrade notes if you use custom integrations or configurations.

HelpSpot 5.8.8 improves the knowledge base, background jobs, search, uploads, and security.

Upgrade notes

• Live Lookup: HTTP lookups, including triggers and automation rules, no longer send sRequestPassword, tLog, or sAISummary. Update scripts that use these fields before upgrading. All other field restrictions are unchanged.
• Private API attribution: Requests and staff updates use the calling staff account, not a supplied staff ID. xPerson=0 still records a customer reply. Check your integration’s account.
• API webhook subscriptions: Creating or removing subscriptions now requires an administrator account.
• Public request creation: The public API ignores submitted sUserId values, even with Customer ID matching enabled. Portal forms use the verified signed-in identity, when available, instead of submitted IDs. Update affected forms and integrations.
• Staff SAML: Production SAML installations require SAML sign-in. Local staff passwords and password-authenticated RSS feeds no longer work.
• Portal accounts: With SAML, LDAP, or BlackBox, manage accounts and passwords through your provider. HelpSpot’s registration and password pages require internal portal authentication.
• Public API customer-request retrieval: Internal accounts require verified email. Internal passwords no longer work with SAML or LDAP portals. BlackBox is unchanged.
• Trigger webhooks: HTTPS calls now use HelpSpot’s shared TLS verification settings. Check server certificates before upgrading; invalid or untrusted certificates may fail unless a configured exception applies.
• Custom JavaScript: Scripts in dynamic HTML, JavaScript AJAX responses, and legacy string-based menu commands no longer run automatically. Update affected customizations to use explicit initialization and callbacks.
• Attachment storage: New files on disk have no extensions; download filenames are unchanged. Check backup, scanning, and processing scripts that filter by extension.
• Customer ID search: IDs are included as requests are indexed; existing indexes are not rebuilt automatically. Self-hosters can run php hs scout:populate-index --force to clear and queue a rebuild. Results may be incomplete until it finishes. Full-text search is not an exact ID lookup.
• Background workers: Restart long-running queue workers during the upgrade to load the reliability fix. Previously failed jobs are not retried automatically.

New

• MCP clients can upload knowledge base images directly to HelpSpot’s native storage.

Improvements and fixes

• Added Customer IDs to request full-text search and improved hyphenated searches on SQL Server.
• Fixed avatar uploads on SQL Server and strict MySQL. Invalid or oversized uploads show an error and preserve the existing avatar.
• Restored table cell borders in the staff knowledge base view.
• MCP page edits no longer reorder other pages in the chapter.
• Temporary database deadlocks during job reservation no longer permanently fail or delete queued emails and other jobs.
• Staff and portal LDAP settings now prevent enabling SSL and StartTLS together.

Security

Includes security fixes and hardening. We recommend upgrading to the latest version.