Notification triage, agent APIs, and a security fix for exposed Slack apps

Taming the inbox

The biggest workflow change this week landed in Linear, which reworked how notifications surface. An active workspace can pile up a day's worth of pings, and until now every one of them looked equally important — a review blocking a release could sit right next to a routine status change. Linear's new Priority tab splits what needs attention from what can wait, with Linear choosing the defaults and options to narrow it by notification source or a custom filter. Existing inbox behavior is untouched if you'd rather keep it. The same week brought smaller quality-of-life additions — draft projects with Linear Agent, document editing on mobile, rich previews in diffs, and third-party app approvals on paid plans — plus routine mobile fixes on the side.

Building on Notion's agents

Notion's JS SDK made its biggest capability jump in a while with the agent and session APIs. Developers can now retrieve, query, delete, and batch agents, read their insights, and adjust status or credit limits, while a parallel client.sessions surface covers retrieving, updating, and canceling sessions, querying session events, and streaming responses. The streaming helper is the interesting part: it returns an async iterable that retries eligible HTTP failures before the stream opens, without replaying events once streaming has begun, and ships typed session events and metadata so consumers aren't parsing loose JSON. Tooling updates in the SDK repo, including husky and lint-staged hooks, rounded out the week.

Hardening the Slack stack

Security work was the theme on the Slack side. Bolt for JavaScript now enforces a configurable request body size limit in HTTPReceiver and ExpressReceiver — both previously buffered an entire request body into memory before verifying its signature, so a flood of large invalid requests could exhaust memory and take down a publicly exposed app. Bodies over the new bodyLimit option are rejected with a 413 before that happens. The Python SDK fixed a different kind of hang, stopping Socket Mode connections from retrying forever after close. On the client side, Slack fixed a display bug where forwarded emails masqueraded as unrelated apps, and the desktop build was a quiet maintenance week with no user-facing changes.

Design-system plumbing

Figma shipped two changes that matter to anyone maintaining a design system. Opacity is now editable at scale inside the variables modal and applies on top of any color without detaching it — a small change that removes a lot of tedious per-node editing. Generative plugins and shaders, which debuted at Config, now support animations and interactions, publishing, and access to their underlying code, turning prompt-built effects into something you can ship and extend. A bug-fix build filled out the week, as did Notion's desktop maintenance release.