Skip to content

CompDesk v0.9.0-beta.3 — Public Beta

Choose a tag to compare

View all tags
@TahaHydra TahaHydra released this 03 Oct 15:17
· 16 commits to main since this release
v0.9.0-beta.3
9906f36
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CompDesk v0.9.0-beta.3 — Public Beta

This release brings the accepted ticket, integration, administration and deployment improvements together. It retains the existing Tailwind 3 styling and supported Docker Compose deployment with bundled PostgreSQL.

New and improved

  • Ticket descriptions and submitted form answers appear before conversation and actions, with clear requester attribution and aligned form controls. Replies distinguish your messages from other participants.
  • Administrators see compact normal/critical update indicators, release details and manual checks. Super Admins get assisted upgrade instructions and update configuration. Checks use a cached public manifest without transmitting tenant/user data; no Docker socket or automatic rollback is introduced.
  • About includes a subtle administrator-only CompDesk services section. Self-hosting remains free and open source.
  • Super Admins can install, remove and reinstall the full managed demo dataset. Demo visibility controls are grouped under Demo data; Branding retains an informational note.
  • Personal “Remind me” schedules are persisted per user, with optional email and access checks at delivery time.
  • Microsoft 365 Graph sending supports a dedicated Entra application and fixed sender mailbox alongside existing SMTP. Settings actions consistently place Save on the right.
  • Super Admin password resets are clearly labeled, require confirmation, work for every role and revoke existing CompDesk sessions.

Fixes and security

  • Internal attachments and restricted historical form fields respect ticket/department access in details, lists, notifications and direct downloads.
  • Notification recipients are revalidated; inactive users and former staff do not receive staff-only ticket data.
  • Normal Microsoft sign-in starts a fresh CompDesk session. Authenticated Profile linking remains separate, with cross-user identity ownership and revoked-session protections.
  • Managed Docker Entra credentials persist in the private configuration volume; status distinguishes saved settings from the running configuration. IPv4-only connectivity works while retaining IPv6 fallback and TLS verification.
  • An additive migration repairs the missing temporary-attachment column. Startup and readiness verify actual database columns against the generated client before serving the application.
  • Next.js image optimization has a bounded writable cache while the container root remains read-only. Attachments survive container restart.
  • SLA deadlines, ticket counters, concurrent writes, pagination, help caching, membership editing, partial uploads and error/retry states were corrected.
  • Nodemailer 10.0.13 includes fixes for the two SMTP advisories behind the four historical dependency alerts.
  • The Tailwind animation plugin is now build-only. Its peer dependency no longer ships the vulnerable brace-parser chain in production installations or the runtime image. The production audit gate remains enabled.

The full development-tool audit still reports the unpatched brace-parser advisory through trusted-source build/lint/test tooling. This release does not claim zero vulnerabilities across all development dependencies. See dependency assessment for exposure, patch availability and verification.

Upgrade

Back up PostgreSQL, private attachments, uploaded branding, and the private configuration volume together. Download this release's version-pinned docker-compose.yml, review it against your deployment configuration, then run from the deployment directory:

docker compose pull
docker compose up -d
docker compose logs --tail=100 compdesk

The orchestrator applies the additive migrations and checks schema compatibility. Keep existing data volumes. An older image alone is not a recovery point; restoring an earlier application may require the matching database/configuration/files backup. See upgrade guidance and backup/restore.

Verification and beta limits

The acceptance record covers multi-role attachment authorization, password resets and session revocation, fresh installation/demo lifecycle, migration upgrades, restart persistence, image-cache writes, and real linked Microsoft sign-in with a clean-session repeat. Publication additionally requires green pull-request/main checks and the exact tagged image's scan. See release gates and acceptance evidence.

Graph mailbox delivery has not been verified against a live Exchange mailbox. Graph/SMTP acceptance is not delivery confirmation. Broader multi-user/concurrency/browser coverage remains documented as pending. External-PostgreSQL Compose, multi-replica storage/configuration, and optional antivirus require further operator validation. This is a public beta, not a production-readiness guarantee.

Publication checks

Verified release source: 9906f36c04f88845341e13918d59a63ca16eb232.

  • Main CI: 565 Jest tests, lint, typecheck, production build, fresh setup, migration upgrade and backup/restore passed; production dependency audit has zero findings.
  • Main security and tagged-image scan/publication passed. All four historical Nodemailer alerts are fixed. The development-tool advisory remains disclosed above.
  • Anonymous image and Compose downloads verified; 11 fresh public-image install/restart checks passed. The released image digest is sha256:3e58277b453c91d11341a3fb160f8657ac778c8713da86ffa9fa2b06e6f6d362.
Previous releases
Assets 3
Loading