## kestra-io/kestra — v2.0.2…v2.0.3

_35 commits._

### Features
- **feat(core): access-control extension point for MCP tools** (77dddbc)
- **feat(worker): basic authentication for the worker-to-controller gRPC channel** (c6a04d9)

### Fixes
- **fix(core): reclaim namespace file objects when a file is deleted** (c38fb09)
- **fix(triggers): preserve the runtime disable when a trigger definition is updated** (922cb9f)
- **fix(assets): make namespace and type freely editable (#19575) (#19716)** (90d6104)
- **fix(executions): generate the cURL command with 24-hour TIME inputs (#19710)** (6bb33ba)
- **fix(ai): refresh the editor and retire the Apply button once a copilot draft is applied (#19713)** (14b47bf)
- **fix(core): recursively match simple dotfiles** (1958e66)
- **fix(topology): execution graph fills the viewport and zooms out far enough to fit a large flow (#19694)** (8df64a9)
- **fix(system): a pre-2.0 worker job entry no longer stalls service liveness coordination (#19676)** (8fb051a)
- **fix(worker): emit the trigger result at the timeout instead of waiting for the evaluation** (0fa4f7c)
- **fix(flows): show the revision deletion toast message only once (#19663)** (db90e60)
- **fix(plugins): load external plugins before controller and indexer start (#19612) (#19631)** (780cad5)
- **fix(core): retry plugin catalog load instead of caching a failure for 1h (#19061) (#19592)** (ccabca4)
- **fix(core): prevent NPE in UnsetVariables when a nested key's parent is missing (#19480)** (7ac0f73)
- **fix(core): logo invisible on the /api rapidoc page (#19577)** (15e1f68)
- **fix(assets): accept expressions and free-form types on output assets in the flow editor (#19311)** (c661c3c)
- **fix(core): sanitize the messages of a bulk failure toast instead of rendering them raw (#19557)** (9e7cc59)
- **fix(core): let the english-copy rule accept the tenant wizard terms the model keeps in english (#19553)** (2353ce9)
- **fix(ai): icon-only AI Copilot button in the top bar utility cluster (#19538)** (adc5a04)
- **fix(core): in-app links report one utm source and campaign convention (#19533)** (d2461d5)
- **fix(topology): image export covers the whole graph, not just the visible viewport (#19464)** (2c88d0f)
- **fix(execution): a deleted flow should not be executable via an old revision** (257307e)

### Tests
- **test(core): cover nested dotfile downloads** (3373afe)

### Docs
- **docs(tests): say the OSS translation jobs check the EE sources out for the unused-key rule (#19516)** (f07356e)

### Chore
- **chore(version): update to version '2.0.3'** (269e8d0)
- **chore(deps): bump kotlp to 0.1.6 for process.network.io** (c633d3d)
- **build(core): stage the design-system locale files only where the design system exists (#19584)** (b1b6736)
- **build(core): translate the oldest supported release branch with the bot and keep the shared gate identical across branches (#19581)** (0fc7a1a)
- **build(core): tell a pull request from a fork how to get its translations generated (#19561)** (6aecc18)
- **build(core): ask the authors of the english changes to review the bot translation pull request (#19552)** (d188925)
- **build(platform): bump io.kestra:kotlp to 0.1.5 (#19545)** (c5d8ae5)
- **build(core): run the unused translation key rule in the OSS jobs with the EE sources checked out (#19515)** (132377e)
- **chore(core): delete the translation keys nothing renders (#19512)** (9e4f167)
- **build(deps): declare sass-embedded so vite never falls back to js sass (#19504)** (77ffab5)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/kestra-io/kestra?utm_source=github-action)._