Skip to content

Collaboard v2.0.0 — your board, wired to everything

Choose a tag to compare

View all tags
@MrBildo MrBildo released this 28 Jun 19:13
· 55 commits to main since this release
v2.0.0
69afe79
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Collaboard 2.0 turns the board into a live event source for the rest of your stack. The headline: webhooks — real-time, signed, and board-wide. Plus a UI framework upgrade and a few breaking API cleanups.

🔔 Webhooks — your board can finally talk back

Anything that happens on a board can now fire an outbound webhook — 22 event types spanning cards, comments, labels, attachments, lanes, and boards. Card moved? Comment posted? Lane reordered? Your automations hear about it the moment it happens. Pipe board activity into an automation platform, a chat notifier, a CI trigger, a metrics dashboard, or your own service — if it speaks HTTP, it can listen to your board.

  • Set it up without leaving the app. A new admin panel lets you create and manage subscriptions, hand-pick exactly which events each one receives from a live catalog of everything the server emits, and watch delivery health in real time — no config files, no guesswork.
  • Built to be trusted in production. Every delivery is SSRF-guarded out of the box: private, loopback, and cloud-metadata addresses are blocked by default. Sign payloads with HMAC-SHA256 so your receiver knows it's really Collaboard calling. Failed deliveries retry automatically, and every attempt lands in a delivery log with success/failure metrics — nothing fails silently.
  • Need to reach something on your own network? Flip Webhooks:AllowPrivateNetworkTargets to deliver to private/LAN endpoints — while loopback and cloud-metadata stay locked down regardless. (Trusted networks only.)

This is the foundation for real Collaboard automation. Go build the workflows you've been wanting.

🎨 A sharper UI

Upgraded to Tailwind CSS v4 — focus rings are back across inputs and buttons, and dark mode renders correctly everywhere (including the checkboxes that used to disappear).

⚠️ Breaking changes

Please review before upgrading:

  • MCP comment tools: the deprecated content parameter is gone from add_comment and update_comment. Use contentMarkdown, and update any caller still passing content.
  • Webhook delivery enforces SSRF protection with no exemptions. Private/internal targets are blocked by default; set Webhooks:AllowPrivateNetworkTargets if you genuinely need to reach a private endpoint (loopback and cloud-metadata stay blocked).

🧹 Under the hood

Entity Framework model configuration refactored into per-entity configurations, analyzer warnings cleared, and the README's MCP authentication section corrected.

Assets 13
Loading