icon field now restricted to SHA-1 hash only; https:// URLs no longer accepted
BreakingBreaking change
This is a breaking change — integrations that rely on the affected behaviour will need updates before the change rolls out.
What changed
The icon field previously accepted either a SHA-1 hash or an https:// URL; it now only accepts a 40-character hex SHA-1 hash (enforced by pattern: ^[0-9a-fA-F]{40}$). Clients currently supplying an https:// URL for the branding icon will fail validation with this updated spec, making this a breaking change for those integrations.