v2.1.0

No breaking changes. Everything in this release is additive or fixed-in-place; one API surface is deprecated with a successor advertised in its own responses (details under Deprecations).

Concurrent editing, made visible

Collaboard boards are edited by people and agents at the same time — this release makes that safe to see and reason about:

• Card description edit history. Every description edit is recorded with who and when. The card detail view gains a History tab showing each revision as a unified diff or full prior text. The trail starts at a card's first edit after upgrading; the oldest revision preserves the pre-existing text.
• Collision awareness. When your card edit overwrites a description someone else changed while you were typing, the API now tells you — naming who was overwritten. Saves are never blocked; last-write-wins is unchanged. Pass the description revision you read (expectedDescriptionRevision) for an exact answer, or rely on the automatic best-effort signal.
• Comment provenance. Comments now record when they were originally posted, separately from when they were last edited. The web UI shows an "(edited)" marker with the original posting time on hover. Edited comments still resurface to the top of the thread — the marker is what makes that jump legible.

Reads that cost what they need — new v2 card read

For agent and automation consumers, card reads can now ask for exactly what they need:

• GET /api/v2/cards/{id} — the recommended card read. Skip the description body (includeDescription=false) and page the comment thread (commentsOffset/commentsLimit, 0 = count only). In one production integration, a routine card read dropped from 37.6 KB to 747 bytes.
• MCP get_card — pass commentsLimit to receive comments as a paged envelope (max 500, 0 = count only). The tool's description carries the guidance.
• Every card read now includes descriptionHistoryCount, and every comment carries createdAtUtc.

Deprecations (not removals)

• GET /api/v1/cards/{id} is deprecated in favor of the v2 read above. It still works exactly as it always has — the comments array, shape and order, is unchanged from v2.0.2, so existing clients and automation need no changes today. Its responses carry a Deprecation header and a Link rel="successor-version" pointing at the v2 route. Removal will happen no earlier than a future major release; a Sunset date will be announced well in advance.
• MCP get_card without commentsLimit (the full-thread array response) is deprecated the same way — add the parameter to migrate.
• All other v1 endpoints are unaffected and not deprecated.

For integrators

• Drop-in agent skill. The repository now ships docs/collaboard/SKILL.md — a ready-to-install guide that teaches an AI agent the MCP surface, identifier rules, and read-efficiency practices. Point your agent harness at it and go.
• Readable errors. 405 responses now carry a body naming the allowed methods instead of an empty reply.

UI fixes and polish

• Dark mode legibility pass: the archived-card banner and badge are readable again, and rendered markdown (comment bodies, card descriptions) now meets accessibility contrast in dark mode — comment text went from well below the accessibility floor to comfortably above it.
• The update-available indicator now clears correctly after upgrading, and the version menu always shows the fresher version.

Security and under the hood

• Markdown links that look internal but actually resolve off-site are now detected by resolving them the way a browser would — anything leaving the app's origin renders as an external link with the protections external links carry. Closes a class of look-alike link shapes, not just known examples.
• The diagram-rendering library is updated to its current release, clearing its published advisory backlog; diagram rendering is visually unchanged and its content sanitization remains in strict mode.
• Every release archive now ships a third-party attribution file, kept in lockstep with the actual bundled inventory by a CI contract.
• Release archives build the browser bundle once, with sourcemaps set aside consistently.