v3.1.0

Collattice v3.1.0

What's New

Webhooks now report card deletion and every size change

Two gaps in the webhook event catalog are closed. Both came out of the first outside bug report on the public repo — thank you to Jeff Fansler (@Fanzoo), who noticed a deleted card vanishing from his live visualization with no event to explain it, and traced it to the exact handler.

• card.deleted — fires whenever a card is hard-deleted, from both the single-card delete and the administrator prune with action: "delete". It mirrors card.archived: the full card summary as it was at the moment of deletion (labels, counts, latest comment), so a consumer can reconcile without a follow-up lookup. When the deleted card was archived, the internal archive-lane id is withheld, as it is for card.archived. Previously, archiving a card was observable and deleting it was silent — the two ways a card leaves a board now behave the same to a subscriber.
• size.created / size.renamed / size.reordered / size.deleted — the card-size resource now has a full event family, matching lanes and labels. Sizes were the one board resource whose changes never reached a webhook. size.reordered carries the board's complete new order in a single event, the same contract as lane.reordered; a rename and an ordinal change made in one call emit one event per axis.

Both families appear in the subscription picker automatically, and subscriptions using the * wildcard start receiving them on upgrade — if a consumer is not expecting new event types, filter on the event field.

Within-lane moves are reported consistently

A position-only card update (PATCH /cards/{id} with position and no laneId) now emits card.moved with equal source and target lane ids, matching what the reorder endpoint and the move_card tool already did. The card.moved description now reads "a card moves to a different lane or position." Consumers that only care about lane changes can keep comparing from.laneId to to.laneId.

Housekeeping

• Published docs no longer state a literal event count that goes stale on every catalog addition.
• Two local-tool artifacts (.opencode/, opencode.jsonc) removed from the repository and ignored.
• Contributor conventions for outside issues and bot-authored commits documented.

Upgrade notes

No breaking changes. No migration. Wildcard webhook subscriptions will begin receiving the new event types — see above.

v3.0.2

What's New in v3.0.2

A patch release with one fix.

Fixed

• Desktop sluggishness that got worse the larger the browser window was. Opening a card, scrolling, typing, and the Board Settings dialog all felt laggy on desktop, and resizing the window or switching to a mobile-width viewport made it disappear. The cause was the full-viewport blur applied behind every dialog and side panel — its cost scales with the number of pixels on screen, so a maximized window on a high-resolution, high-scaling display paid the most. The blur is gone; dialogs now use a plain, slightly darker dim behind them. Nothing else about the UI changes.

Upgrade notes

No configuration, database, or API changes. Drop-in replacement for v3.0.1.

v3.0.1

What's New in v3.0.1

A patch release with one fix.

Fixed

• Typing in card detail no longer lags on content-heavy cards. Every keystroke into a card's title, description, or comment box was re-rendering every markdown block on the card — the description preview and each comment — even though none of that content had changed. On a card with a long description and a busy comment thread that cost roughly 18 ms of main-thread work per keystroke, enough for typing to visibly fall behind. The markdown renderer is now memoized, so unchanged blocks are skipped: measured on the production build, per-keystroke cost drops from ~18 ms to under 2 ms on a card with code blocks, a mermaid diagram, a table, and a 14-comment thread. Opening a heavy card improves marginally (the first render must still parse every block once).

No API, MCP, or webhook contract changes. No dependency changes.

Upgrading

Drop-in replacement for v3.0.0. No configuration or data changes.

v3.0.0

Collattice v3.0.0

Collaboard is now Collattice.

The project has been renamed following a trademark concern regarding the previous name. This is a naming/branding change; the project itself continues as before.

"Collattice", the Collattice logo, and "Collabot.dev" are trademarks of Bill Wheelock.

Breaking changes

This is a major release. The rename is the breaking change — functionality is otherwise unchanged.

• Webhook headers renamed. Deliveries now carry X-Collattice-Event, X-Collattice-Delivery-Id, and X-Collattice-Signature (User-Agent: Collattice-Webhooks). The old X-Collaboard-* headers are gone — there is no transition period where both are sent. Update any receiver that matches on header names when you upgrade.
• Release artifacts renamed. Downloads are now collattice-<platform> (e.g. collattice-win-x64.zip, collattice-linux-x64.tar.gz). Older releases keep their original names.
• Binaries and namespaces renamed. The server binary is now Collabot.Collattice.Api (.exe on Windows); .NET namespaces moved to Collabot.Collattice.*.
• Repository renamed. The source now lives at github.com/MrBildo/collattice. The old address redirects permanently — existing clones keep working.
• Browser preferences reset once. The web app's locally-stored preferences (theme, board view state) moved to new storage keys, so they reset one time on your first visit after upgrading.
• Fresh installations use Collattice-named locations. A brand-new install creates a Collattice folder and collattice.db database (see the install guide for per-platform paths).

Upgrading an existing installation

Nothing moves. The installer detects an existing Collaboard-era folder and database and leaves them exactly where they are — zero data movement, and your configuration is preserved through the settings merge. The full move to Collattice-named folders and a renamed database comes in a later release, with a tested, reversible migration procedure (already rehearsed end-to-end on a staging environment for this release).

The only action most operators need: re-point webhook receivers at the new header names.

What still says "Collaboard", and why

The rename is deliberately not a blind find-and-replace. What remains, and the plan for each:

Where	Why it stays for now	When it goes
Installer recognition of old install folders and collaboard.db (and the tests proving it)	So the installer can find an existing installation and protect its data	Removed with the future migration release
Install docs naming the old locations	So an upgrading user understands what was found and why their data stayed put	Same
Your existing data folder and database on disk	Renaming a live installation's data risks that data; this release refuses to	Migrated by the future migration release, using the rehearsed procedure
Old release downloads, tags, and commit history	Published history is permanent; rewriting it would break existing links and checksums	Never — history stands; everything from 3.0.0 forward uses the new name
The hosted demo hostnames	Changed on the hosting layer's own schedule so the running service is never interrupted	On the hosting schedule, shortly after this release
A handful of internal development-tool identifiers	Shared across several related projects; renamed together, on a coordinated schedule	With the coordinated internal-tooling update

Reliability and build hardening

The rename isn't the whole release — 3.0.0 also brings all the improvements since 2.1.0:

• Card-number allocation under heavily concurrent card creation is now retried more aggressively — measured to lose zero creations through 32-way concurrent bursts.
• Dependency updates clearing known advisories: axios 1.19.0, and react-router upgraded from the end-of-life v6 line to v7 (resolving three moderate advisories, with no application code changes); the bundled SQLite native library and OpenAPI libraries are now explicitly pinned.
• The bundled .NET runtime is pinned, with a CI gate that fails the build if it falls behind the current servicing release.
• Release archives are now verified against stray sourcemap references, and third-party attribution notices are regenerated and checked in CI.
• Webhook delivery tests and concurrency test fixtures were hardened, eliminating a class of intermittent CI failures.
• Published source comments were swept clean of internal work-tracking references — Collattice publishes its source, and the code now reads cleanly on its own for outside readers.

v3.0.0-rc.1

Pre-release candidate for the Collaboard -> Collattice rename. This build exists to validate the publish pipeline under the new name and to rehearse the full deployment and migration path on a staging environment before the v3.0.0 final release. Not for production use.

• Product renamed to Collattice (the repository rename follows at the final release)
• Release artifacts now named collattice-
• Webhook headers renamed X-Collaboard-* to X-Collattice-* (breaking)
• .NET namespaces and binaries renamed to Collabot.Collattice.*
• Fresh installs use Collattice paths; existing installs are detected in place with no data movement

The full What's New and complete breaking-changes list ship with v3.0.0.

v2.1.0

No breaking changes. Everything in this release is additive or fixed-in-place; one API surface is deprecated with a successor advertised in its own responses (details under Deprecations).

Concurrent editing, made visible

Collaboard boards are edited by people and agents at the same time — this release makes that safe to see and reason about:

• Card description edit history. Every description edit is recorded with who and when. The card detail view gains a History tab showing each revision as a unified diff or full prior text. The trail starts at a card's first edit after upgrading; the oldest revision preserves the pre-existing text.
• Collision awareness. When your card edit overwrites a description someone else changed while you were typing, the API now tells you — naming who was overwritten. Saves are never blocked; last-write-wins is unchanged. Pass the description revision you read (expectedDescriptionRevision) for an exact answer, or rely on the automatic best-effort signal.
• Comment provenance. Comments now record when they were originally posted, separately from when they were last edited. The web UI shows an "(edited)" marker with the original posting time on hover. Edited comments still resurface to the top of the thread — the marker is what makes that jump legible.

Reads that cost what they need — new v2 card read

For agent and automation consumers, card reads can now ask for exactly what they need:

• GET /api/v2/cards/{id} — the recommended card read. Skip the description body (includeDescription=false) and page the comment thread (commentsOffset/commentsLimit, 0 = count only). In one production integration, a routine card read dropped from 37.6 KB to 747 bytes.
• MCP get_card — pass commentsLimit to receive comments as a paged envelope (max 500, 0 = count only). The tool's description carries the guidance.
• Every card read now includes descriptionHistoryCount, and every comment carries createdAtUtc.

Deprecations (not removals)

• GET /api/v1/cards/{id} is deprecated in favor of the v2 read above. It still works exactly as it always has — the comments array, shape and order, is unchanged from v2.0.2, so existing clients and automation need no changes today. Its responses carry a Deprecation header and a Link rel="successor-version" pointing at the v2 route. Removal will happen no earlier than a future major release; a Sunset date will be announced well in advance.
• MCP get_card without commentsLimit (the full-thread array response) is deprecated the same way — add the parameter to migrate.
• All other v1 endpoints are unaffected and not deprecated.

For integrators

• Drop-in agent skill. The repository now ships docs/collaboard/SKILL.md — a ready-to-install guide that teaches an AI agent the MCP surface, identifier rules, and read-efficiency practices. Point your agent harness at it and go.
• Readable errors. 405 responses now carry a body naming the allowed methods instead of an empty reply.

UI fixes and polish

• Dark mode legibility pass: the archived-card banner and badge are readable again, and rendered markdown (comment bodies, card descriptions) now meets accessibility contrast in dark mode — comment text went from well below the accessibility floor to comfortably above it.
• The update-available indicator now clears correctly after upgrading, and the version menu always shows the fresher version.

Security and under the hood

• Markdown links that look internal but actually resolve off-site are now detected by resolving them the way a browser would — anything leaving the app's origin renders as an external link with the protections external links carry. Closes a class of look-alike link shapes, not just known examples.
• The diagram-rendering library is updated to its current release, clearing its published advisory backlog; diagram rendering is visually unchanged and its content sanitization remains in strict mode.
• Every release archive now ships a third-party attribution file, kept in lockstep with the actual bundled inventory by a CI contract.
• Release archives build the browser bundle once, with sourcemaps set aside consistently.

v2.0.2

What's New in v2.0.2

A small patch release: a mobile hotfix and a docs refresh.

Fixed

• Mobile — the card-detail dialog is usable again. On phones it was opening shoved off the side of the screen and clipped; it now fills the screen correctly in both portrait and landscape. (Desktop was unaffected and is unchanged.)

Docs

• Refreshed the "Where we're headed" roadmap teaser in the README — webhooks are shipped, so the forward view now points at what's next.

v2.0.1

Patch release — bug fixes and a documentation accuracy pass on top of v2.0.0.

Fixes

• Admin panel: the active-tab indicator now follows the selected tab. Previously it stayed pinned to the first tab regardless of which tab you were on.
• Webhooks: corrected the card.updated event description shown in the subscription event picker. It no longer implies label changes fire card.updated — label changes fire card.labeled / card.unlabeled.

Documentation

• Comprehensive accuracy pass on the published docs for the 2.0 release: the full webhook event catalog with payload shapes, corrected guidance on the webhook private-target / SSRF setting, refreshed admin screenshots, and a tidied contributor credits section.

Collaboard v2.0.0 — your board, wired to everything

Collaboard 2.0 turns the board into a live event source for the rest of your stack. The headline: webhooks — real-time, signed, and board-wide. Plus a UI framework upgrade and a few breaking API cleanups.

🔔 Webhooks — your board can finally talk back

Anything that happens on a board can now fire an outbound webhook — 22 event types spanning cards, comments, labels, attachments, lanes, and boards. Card moved? Comment posted? Lane reordered? Your automations hear about it the moment it happens. Pipe board activity into an automation platform, a chat notifier, a CI trigger, a metrics dashboard, or your own service — if it speaks HTTP, it can listen to your board.

• Set it up without leaving the app. A new admin panel lets you create and manage subscriptions, hand-pick exactly which events each one receives from a live catalog of everything the server emits, and watch delivery health in real time — no config files, no guesswork.
• Built to be trusted in production. Every delivery is SSRF-guarded out of the box: private, loopback, and cloud-metadata addresses are blocked by default. Sign payloads with HMAC-SHA256 so your receiver knows it's really Collaboard calling. Failed deliveries retry automatically, and every attempt lands in a delivery log with success/failure metrics — nothing fails silently.
• Need to reach something on your own network? Flip Webhooks:AllowPrivateNetworkTargets to deliver to private/LAN endpoints — while loopback and cloud-metadata stay locked down regardless. (Trusted networks only.)

This is the foundation for real Collaboard automation. Go build the workflows you've been wanting.

🎨 A sharper UI

Upgraded to Tailwind CSS v4 — focus rings are back across inputs and buttons, and dark mode renders correctly everywhere (including the checkboxes that used to disappear).

⚠️ Breaking changes

Please review before upgrading:

• MCP comment tools: the deprecated content parameter is gone from add_comment and update_comment. Use contentMarkdown, and update any caller still passing content.
• Webhook delivery enforces SSRF protection with no exemptions. Private/internal targets are blocked by default; set Webhooks:AllowPrivateNetworkTargets if you genuinely need to reach a private endpoint (loopback and cloud-metadata stay blocked).

🧹 Under the hood

Entity Framework model configuration refactored into per-entity configurations, analyzer warnings cleared, and the README's MCP authentication section corrected.

Collaboard v2.0.0-rc.1 (release candidate)

Release candidate for v2.0.0 — published for staging verification. This is a pre-release, not a production release.

Highlights

Webhooks v2

Outbound webhooks now cover the full board event catalog — cards, comments, labels, attachments, lanes, and boards (22 event types in all). New in this release:

• A subscription registry with an admin UI for creating and managing webhook subscriptions, driven by a server-side event catalog so the picker always matches what the backend emits.
• SSRF-hardened delivery, payload signing, automatic retries, and a persisted delivery log with on-read metrics.

User interface

• Migrated the UI to Tailwind v4, restoring missing focus rings and fixing dark-mode rendering (including checkboxes that were invisible in dark mode).

Internal

• Refactored EF Core model configuration into per-entity configurations, cleared analyzer warnings, and corrected the README's MCP authentication section.

Breaking changes

• MCP comment tools: the deprecated content parameter has been removed from both add_comment and update_comment. Use contentMarkdown instead.
• Webhook delivery: outbound delivery now enforces a uniform SSRF guard with no exemptions. Targets on private or internal networks are blocked by default; set Webhooks:AllowPrivateNetworkTargets to allow them.