---
changelog:
  category: Release
  version: 0.6.0
date: '2026-10-11T11:22:05Z'
seo:
  description: >-
    feat(web-api): resolve names in the browser through a relay that keeps the
    bot token on your server by @nkootstra in…
title: v0.6.0
type: changelog
---
<!-- Release notes generated using configuration in .github/release.yml at 71b8ab49e53a813538b8a41d69de91946b334c67 -->

## What's Changed
### Features
* feat(web-api): resolve names in the browser through a relay that keeps the bot token on your server by @nkootstra in https://github.com/nkootstra/block-kit/pull/211
* feat(relay): accept a bearer token, and refuse cross-site form posts by @nkootstra in https://github.com/nkootstra/block-kit/pull/217
### Fixes
* fix(web-api): render channel and user group mentions with a single # or @ by @nkootstra in https://github.com/nkootstra/block-kit/pull/210
* fix(links): drop javascript: and other unsafe URLs from payload links and buttons by @nkootstra in https://github.com/nkootstra/block-kit/pull/214


**Full Changelog**: https://github.com/nkootstra/block-kit/compare/v0.5.2...v0.6.0