Sastra 0.7.0 — Project planning and printer estimates

Sastra 0.7.0 adds tools for planning projects and requesting preliminary printing costs.

• Build a proposal budget before creating a project, with more precise per-word rates.
• See project funding sources together on the project overview.
• Draft preliminary printer quote requests, review recipients and CCs, and explicitly confirm before sending. Review returned estimates before using them in a budget.
• Find and reuse book specifications across project and print workflows.
• Create a reviewed project copy through the assistant.
• Choose a Sastra-only project or connect it to an existing linked Lectio team.
• Include assigned project managers in mention rosters and improve responsive workspace scrolling.

The in-app Help and assistant documentation cover the updated workflows.

Upgrading: back up your database and files, then pin SASTRA_TAG=0.7.0, pull the image, and restart with Docker Compose. The migration service applies migrations 0161–0162 before the app starts. Existing project settings and workspace overrides are preserved.

The release workflow publishes signed images for Linux AMD64 and ARM64, build attestations, and the Compose installation bundle.

Full Changelog: v0.6.4...v0.7.0

v0.6.4

Full Changelog: v0.6.3...v0.6.4

Sastra 0.6.3

Fixes desktop PWA right-clicks on highlighted chat text and mitigates an authentication advisory discovered during release verification.

Right-clicking a selected word or phrase now opens the message actions. You can still copy highlighted text with Ctrl+C or Command+C. Links and input/media controls keep their native menus.

Authentication: email sign-in tokens are now stored as hashes, using the upstream workaround for GHSA-965c-763c-88jm. A regression test using Sastra’s actual auth options proves that an OAuth state cannot create a session, while a real emailed link works once. Request a new sign-in email after updating; previously issued links no longer work. Existing sessions are preserved. Global verification identifier hashing must remain disabled for this workaround. The dependency audit continues to flag the unchanged package version; this release applies the documented configuration mitigation.

The other high Better Auth advisories concern the optional Device Authorization and OAuth Proxy plugins. Sastra’s auth configuration enables neither plugin. This release does not change dependency versions or suppress audit results.

Use ghcr.io/sastra-cloud/sastra:0.6.3 for a pinned deployment, or ghcr.io/sastra-cloud/sastra:latest for the current release. Images support AMD64 and ARM64 and use Sigstore keyless signing. The attached Compose bundle is pinned to 0.6.3. No new migration or environment setting is required.

This release supersedes v0.6.2, whose image publication was cancelled when the new advisory appeared in the audit.

Sastra 0.6.1

Chat actions are faster on desktop and stay comfortable on touch screens.

• Right-click a message bubble to open its actions. Links and selected text retain the browser's normal context menu.
• Hover a desktop message for React, Reply, and More actions. Reply goes straight to the composer, and React opens your frequent emoji choices.
• When space allows, reactions appear above the selected message and commands below it. Near an edge or on a short screen, a compact scrollable panel keeps every action reachable.
• Mobile keeps touch-and-hold and the three-dot control. Keyboard support includes Shift+F10, arrow keys, Enter, and Escape, with focus restoration and reduced-motion support.

The existing optimistic reactions, rollback on failure, and confirmation before deletion remain in place. The in-app help includes the new controls.

Use ghcr.io/sastra-cloud/sastra:0.6.1 for a pinned deployment, or ghcr.io/sastra-cloud/sastra:latest to follow the current release. Images support AMD64 and ARM64 and are signed using Sigstore's keyless signing.

The attached Compose bundle is pinned to 0.6.1. No new database migration or environment setting is required for this update. Existing installations should follow the normal upgrade procedure and apply any previously pending migrations.

Dependency audit note: npm flags GHSA-q84f-53jg-9ppm in Better Auth. The advisory states that applications without the opt-in deviceAuthorization() plugin are not affected. Sastra's auth configuration does not enable that plugin. The authentication dependency version is unchanged in this release.

Sastra 0.6.0

Sastra 0.6.0 adds replies to individual chat messages and includes the latest work and attachment improvements.

Chat replies

• Choose Reply from a message's actions menu in project chats, team channels, and direct messages.
• Review the original above the composer and keep a quoted preview with your sent reply, including file and voice-message originals.
• Select a quote to jump to its original when it is in the loaded history.
• Failed sends preserve your draft and reply context. Deleted originals no longer expose their quoted text.

Also included

• Undated requests from teammates appear in My Work and Home, with controls for planning them.
• Task attachments are easier to find, and files can be uploaded directly to tasks.
• Clearer guidance for selecting a private Lectio team and connecting accounts that use different email addresses.

Self-hosting

Use ghcr.io/sastra-cloud/sastra:0.6.0 for a pinned release, or ghcr.io/sastra-cloud/sastra:latest. Images support Linux AMD64 and ARM64 and include signatures and build attestations. The attached Compose bundles default to 0.6.0.

This release needs no new configuration or database migration for chat replies. Existing installations apply any pending migrations automatically when starting, unless MIGRATE_ON_START=false is configured.

v0.5.1

Full Changelog: v0.5.0...v0.5.1

v0.5.0

Full Changelog: v0.4.1...v0.5.0

Sastra 0.4.1

Sastra 0.4.1 adds more flexible project funding and improves quotation sharing.

• Invoice selected budget lines on an existing project, with a separate reviewed amount and partner. The assistant can prepare the same review; issuing an invoice and sending email remain separate actions.
• Save partner quotations across app updates, keep unfinished edits through other saves, and update partner-line visibility immediately with rollback on failure.
• Apply a funding target and undo the last application without overwriting later rate edits.
• Continue from a saved quotation to a reviewed partner email. Download files without leaving blank app windows, and open invoices as inline previews.
• Include the printer-payment confirmation and donation allocation/reconciliation fixes shipped since 0.3.0.
• Align both Compose installers and their environment template with the release image.
• Upgrade development tooling to TypeScript 7.0.2 and pinned tsrs checks locally, in CI, and around production bundling. Official TypeScript remains available for comparison.

Upgrade: back up the database and deploy the new image normally. The additive migration adds a nullable invoice snapshot column; startup applies it automatically unless migrations run in your platform's release step. PostgreSQL 18 or newer remains required. No new runtime environment variables are required.

The image supports linux/amd64 and linux/arm64. CI checks a clean container in both self-hosted mode and the hosted release-machine/app startup configuration. The release includes the Compose and Neon Compose bundles.

Sastra 0.3.0

Sastra 0.3.0 brings the recent workspace, chat, task, and donation improvements into one open-source release.

Highlights

• Chat that remembers where you left off. Opening Chat resumes your last accessible conversation. Back and All chats still let you choose another conversation.
• Better chat on phones and desktops. Compact mobile headers, reachable composers on short screens, message editing, touch-and-hold actions, searchable emoji, personal frequent reactions, and optional haptic feedback.
• Images and attachments in the conversation. Paste screenshots, drag files into a draft, and open larger inline images in a zoomable gallery. Uploads remain reviewable before Send.
• More useful My Work. Search task titles, descriptions, and projects, including older completed work and other tasks you can access. Shared Next up queues and personal navigation badges make current work easier to find.
• More flexible donation intake. Import CSVs from different giving platforms, reuse learned formats, review duplicates and batches, and see clearer links between posted donations and funding invoices.
• Responsive workspace layouts. Improved layouts for wide, narrow, and short screens across projects, planning, settings, and help.
• Refreshed foundations. Updated dependencies and AI model defaults, clearer outgoing email context and branding, Safari installation fixes, and contributor guidance that favors meaningful regression coverage.

Installation and upgrade

The official image is ghcr.io/sastra-cloud/sastra:0.3.0, with Linux AMD64 and ARM64 builds, provenance, an SBOM, and keyless image signatures. The attached Compose bundles now pin 0.3.0 by default.

For an existing Compose installation:

1. Back up the database and file storage.
2. Set SASTRA_TAG=0.3.0 in your deployment environment file.
3. Run docker compose pull, then docker compose up -d. Use your existing Compose file selection for an external-database installation.
4. Let the migration service finish, then check the application's health and reported version.

This release includes migrations for donation allocation links and saved CSV formats, plus refreshed AI model defaults. PostgreSQL 18 remains the minimum. The official container now uses Node.js 26.

See the self-hosting documentation and changes since v0.2.3.

Known dependency advisory

The production dependency audit reports one moderate sprintf-js denial-of-service advisory, pulled in through Mammoth’s command-line argument parser. Upstream currently lists no patched version. The advisory concerns attacker-controlled formatting strings; the production dependency audit reports no high or critical advisories.

Development-tooling advisories remain open in GitHub Dependabot; its automatic update attempts cannot currently resolve all transitive constraints. Application CI, the PostgreSQL migration smoke test, and CodeQL passed for this release.

v0.2.3

Full Changelog: v0.2.2...v0.2.3