Home → Release Notes → Release Notes → HelpSpot 5.8.9

1.2. HelpSpot 5.8.9

Updated: 27 Oct 2026, 04:04 PM EDT

Release Date: 10/27/2026

Upgrade Notes

• PHP security updates: Updating HelpSpot does not update PHP. Self-hosted administrators should ensure their web server runs a PHP package with the fixes described in the October 21, 2026 PHP security advisory. The new System Health check helps identify affected web runtimes; it cannot verify vendor backports or other application servers.
• Native mbstring extension: Installation and upgrade checks now require PHP's native mbstring extension. A PHP compatibility implementation no longer satisfies this check. Ensure the extension is enabled before upgrading a self-hosted installation.

New Features

• PHP security health check: Admin > Tools > System Health now checks the PHP runtime serving HelpSpot against the October 21 security advisory and provides guidance when an update may be needed. Command-line health checks direct administrators to the browser to check web PHP, which may differ from command-line PHP.

Improvements

• Request history loading: Inline images in request history now load as they approach the visible area, reducing initial image loading on long conversations. Static and print views continue to load images without waiting for scrolling.
• Knowledge base code samples: Long code samples now wrap in the staff knowledge base page view instead of overflowing the content area.
• Webhook audit trail: Webhooks created or deleted through the private API now record the authenticated staff member in the audit log.

Bug Fixes

• Mailbox credential recovery: Invalid or unreadable stored credentials no longer prevent administrators from opening and editing mailbox settings. Administrators can replace credentials or reconnect the mailbox, while mail connections still require valid credentials.
• Restored automation schedules: Restoring a scheduled automation rule now recalculates its next run time instead of immediately running an overdue schedule from before it was disabled.
• Automation notifications: Fixed secondary email recipient handling so notification actions do not reuse recipients from earlier actions and table-of-results emails include the intended secondary addresses. Also corrected request-update handling for rules that combine table-of-results emails with other actions.
• Customer-created API requests: Restored support for xPersonOpenedBy=0 when creating requests through the private API, allowing integrations to record a request as customer-created.
• Inbound attachment restrictions: Incoming email now honors the configured forbidden attachment extensions.
• Automatic portal logins: Invalid email addresses no longer create automatic customer portal login records.
• Staff category membership: Category information now refreshes after staff membership changes rather than continuing to use cached membership data.
• Embedded images: Fixed handling of uploaded editor images whose URLs include the full HelpSpot address.
• Background job reliability: Extended Redis job reservations to prevent long-running jobs from becoming available to another worker before the original worker's timeout.
• Filter performance logging: Slow filter timings no longer exceed the database column's supported range.
• Error logging: Long error type names no longer cause database errors when saving error log entries.