v1.1.0

What's new

Self-service signup & email verification

Users can register themselves from the login page. An email verification step is required before the account is activated. Admins control availability via Admin → Settings → Authentication: enable signup, restrict to specific email domains, or open registration to anyone.

API Keys

Admins can now create and revoke long-lived API keys from Admin → API Keys. Keys are prefixed GHD_, stored as SHA-256 hashes, and shown exactly once at creation.

Auto-assignment

New tickets are automatically assigned following a three-tier chain:

1. CTI-scoped group — group whose scope covers the ticket's category/type
2. Global group fallback (auto_assign_group_id setting)
3. Round-robin user list (auto_assign_user_ids setting)
4. Unassigned if nothing is configured

Ticket list & dashboard improvements

• Dashboard status cards now link directly to a filtered ticket list
• Admin dashboard shows a By Client section for quick per-user ticket views
• Ticket list supports bulk status changes across selected tickets
• Reporter filter: admins can filter the ticket list by submitter
• Staff/admin default view resets to their own work queue (assigned + groups) instead of all tickets
• Status dropdown added to the ticket detail sidebar for quick in-place changes

Manual ticket close

Admins can close a Resolved ticket immediately via the Close Ticket button or POST /api/tickets/:id/close, bypassing the reopen window.

Bug fixes

• Logo now updates in the sidebar after re-upload (versioned URL on upload)
• MCP server /mcp/sse route now resolves correctly
• Allowed email domains textarea no longer loses the cursor on every keystroke
• Empty ticket list no longer returns null instead of []

Chore

• Removed redundant GitHub Pages deploy workflow (Cloudflare deploys automatically from the gh-pages branch)
• Axios bumped to 1.16.0

v1.0.1 — security patch release

Security patch release

This release fixes four security issues found during post-launch hardening. Upgrade is recommended for all users on v1.0.0.

Fixes

• [HIGH] goxmldsig v1.4.0 → v1.6.0 — CVE-2026-33487, SAML signature-validation bypass via loop variable capture. Affects SAML SSO users.
• [HIGH] vite ^8.0.1 → ^8.0.8 — two HIGH-severity CVEs in the dev server (affects development builds only, not production deployments)
• [MEDIUM] axios ^1.14.0 → ^1.15.1 — patches transitive follow-redirects CVE
• Email header injection in the notification dispatcher (CodeQL `go/email-injection`). Recipient/sender addresses are now validated through `mail.ParseAddress`, the Subject header is stripped of CR/LF, and the body is encoded with `mime/quotedprintable` so embedded CR/LF becomes `=0D/=0A`. An attacker-controlled guest email or reply subject can no longer inject additional headers (e.g. Bcc) into outgoing notifications.

Also in this release

• Email notifications now correctly support PascalCase payload keys (TrackingNumber, Subject, etc.) matching the event contract.

Upgrade

git pull
cd docker
docker compose pull   # if using published images
docker compose up -d --build

Full Changelog: v1.0.0...v1.0.1

v1.0.0 — Initial release

About this release

Go Help Desk v1.0.0 is the first tagged release — a self-hosted ticket management system that runs from a single Go binary with an embedded React SPA, backed by PostgreSQL and deployed via Docker Compose.

Your data stays on your infrastructure. No cloud, no SaaS lock-in, no phone-home.

What's included

• CTI ticket classification (Category → Type → Item) with drag-to-reorder and inline rename
• Customizable statuses with full timeline history
• Local accounts, TOTP MFA (opt-in or role-enforced), SAML 2.0 SSO
• Role-based access (admin / staff / user), groups, group scoping tied to CTI
• Custom fields, tags, linked tickets, live search
• Email and webhook notifications, optional SLA tracking
• REST API (API key + OAuth2) and MCP server for AI assistants
• Sandboxed WASM plugin system
• Guest ticket submission, file attachments with optional ClamAV scanning
• Admin UI with confirmation dialogs on every destructive action

Quick start

git clone https://github.com/PubliciaLLC/go-help-desk
cd go-help-desk/docker
cp .env.example .env   # set SESSION_SECRET, JWT_SECRET, BASE_URL
docker compose up -d

Open http://localhost:8080 and the app redirects to /setup for first-admin creation.

Commits

• Initial commit
• Initial commit: open-help-desk project scaffold
• Add first-run setup wizard and test infrastructure
• Update .gitignore and remove committed binary
• Add GitHub Actions workflow to deploy website to Pages
• Add CNAME file for custom domain openhelpsdesk.org
• Fix GitHub repo URLs to point to PubliciaLLC/open-help-desk
• Add .env.example and fix missing required vars in docker-compose
• Move .env.example to docker/ and wire compose to use it
• Fix login: register SessionData with gob before creating cookie store
• Add structured logging with log/slog
• Add debug logging to SessionAuth to diagnose session decode failures
• Wire LOG_LEVEL through docker-compose and add session diagnostics to request log
• Set explicit SameSite=Lax and HttpOnly on session cookie; log Set-Cookie value at debug
• Add JSON tags to all domain structs and fix login response unwrapping
• Overhaul admin UI: settings controls, categories, statuses pages
• Fix tsc -b error: wrap LockIcon in span for title attribute
• Move SAML configuration into the database with web UI management
• Add Roles page; improve Settings auth section UX
• Add groups, branding config, and tabbed settings; bump to v0.2.0-dev
• Add logo file upload with auto-scaling, SVG sanitization, and website SEO
• Add user management and ticket tags
• Docs and version bump to v0.3.0-dev
• Add guest ticket submission, role-based CTI, and file attachments with ClamAV scanning
• Add attachment limits, work log entry attachments, and notify-customer toggle
• Add ticket search by tracking number, subject, and description
• Add drag-to-reorder, inline rename, and admin tag creation
• Add status deactivation with ticket-count guard
• Add ticket status change timeline
• Include sqlc-generated models.go updates
• corrected API link on website homepage
• corrected casing on the API sidebar
• Fixed yet more casing issues on sidebars
• Add custom fields and CTI-linked group management (v2)
• Add SLA admin blade and settings UI improvements
• Rename product from Open Help Desk to Go Help Desk
• Move website to gh-pages branch
• Update Pages workflow: remove website/ path trigger, deploy from gh-pages
• Opt into Node.js 24 for GitHub Actions
• Replace Vite favicon with Go Help Desk speech bubble icon
• Fix login 500 and broken unit tests after module rename
• Fix ticket creation panic when SLA_ENABLED=false
• Rework ticket list: always show, search filters, include-closed toggle
• Expose GET /api/v1/statuses to all authenticated roles
• Fix admin user list showing soft-deleted users
• Separate disabled/deleted users, add CTI editing, fix dashboard counts, restrict admin sidebar
• Scope ticket list and dashboard counts by role
• Fix clamav healthcheck using clamdcheck.sh
• Split MFA into Enable (opt-in) vs Require (forced enrollment)
• Register SessionData gob type in server package init
• Add custom admin-defined roles to v3 roadmap
• Add hero dashboard image and screenshots grid to README
• Add confirmation dialog to admin delete actions
• Bump version to 1.0.0 for initial release

Full Changelog: https://github.com/PubliciaLLC/go-help-desk/commits/v1.0.0