Skip to content

CompDesk v0.9.0-beta.5 — Public Beta

Choose a tag to compare

View all tags
@TahaHydra TahaHydra released this 31 Oct 08:26
v0.9.0-beta.5
fe83799
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CompDesk v0.9.0-beta.5 — Public Beta

This release makes email notifications work with Microsoft 365 / Graph and turns tags into a usable triage tool: tags now appear on tickets, agents can change them after a ticket is created, and administrators can limit each tag to the departments and categories where it makes sense.

Fixes

  • Email notifications with Microsoft 365 / Graph. The notification switches stayed off and could not be turned on when Microsoft 365 / Graph delivered the mail, because they required an SMTP From address that Graph never uses — and that field is hidden when Graph is selected. Notifications now depend on what the selected provider actually needs: SMTP needs a valid From address and authentication (username and password, or a client certificate); Microsoft 365 / Graph needs its tenant ID, application client ID, sender mailbox and client secret. The Email Notifications tab explains what is missing, turning a notification off is always possible, and saved preferences are unchanged. The server enforces the same rule.
  • Tags were saved but never shown. Tags chosen on the new-ticket form were stored but displayed nowhere, and could not be changed afterwards.

Security updates

  • Nodemailer 10.0.13 → 10.3.1 for three address-parsing advisories (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h). The authentication library uses the same updated copy.
  • Zod 3 → 4.6.7 for GHSA-mrhx-c7xc-m3w5 (high: memory exhaustion while validating very large arrays), which has no fix in Zod 3. Validation behaviour is unchanged: identifiers keep accepting the fixed IDs of built-in templates, and department updates still change only the submitted settings.

The production dependency audit has zero findings.

Tags

  • On tickets. Tags appear as colored chips under each title in the ticket list and in the ticket's Details. Hovering a tag shows where it is available.
  • After triage. Agents and administrators add and remove tags in the ticket's Actions panel with a searchable list; changes are saved together when the list closes. Requesters can still pick tags on the new-ticket form when its template shows the Tags field.
  • Where a tag applies. Under Admin → Tags, a tag is available in all departments (every existing tag, unchanged) or in selected departments, each covering all of its categories or only chosen ones. One tag can be shared by several departments, so the same name never means two different tags.
  • Moving tickets. A ticket keeps its tags when it moves to another department or category. A tag that does not apply there is shown dashed with an explanation; it can be removed but not newly added there, and it applies again if the ticket moves back.
  • Filtering. The ticket list's Tags filter is now a searchable, scrollable multi-select that, like Category, narrows to the tags that fit the selected department and category.
  • Department Admins can create and change tags limited to departments they administer; tags for all departments or shared with other departments remain read-only for them. Super Admins manage every tag. Tag names are unique regardless of capitalisation, and deleting a tag shows how many tickets use it.
  • Safe by default. Narrowing a tag's availability never removes it from tickets. If a category a tag is limited to is deleted, the tag becomes available nowhere until it is edited — never everywhere.

Upgrade and rollback

This release has one additive migration, 20261031120000_tag_scopes, which runs automatically on start. It adds the tag availability column (existing tags stay available in all departments) and a table for department and category limits; no ticket or tag data is changed. Back up PostgreSQL, private attachments, uploaded branding, and the private configuration volume together. Download this release's version-pinned docker-compose.yml, review it against your deployment configuration, then run from the deployment directory:

docker compose pull
docker compose up -d
docker compose logs --tail=100 compdesk

If you deploy with your own Compose file, change only the image tag to ghcr.io/tahahydra/compdesk:0.9.0-beta.5 and confirm the persistent paths /config, /app/public/uploads and /app/storage/attachments are mounted.

Rolling back to beta.4.2 works against the upgraded database: beta.4.2 finds no pending migrations and ignores the new column and table, so every tag is offered in every department again until you upgrade. For a complete recovery, keep the matching database/configuration/files backup; an older image alone is not a recovery point. See upgrade guidance and backup/restore.

Verification

  • Lint, type checking, the full Jest suite (691 tests, including new suites for email delivery readiness and tag availability) and the production build pass. The first-run setup browser test and the Entra account-link integration test pass.
  • The migration applies on top of the previous release, the previous-release upgrade rehearsal passes, and beta.4.2's migrations run cleanly against the upgraded database. Tag availability queries were checked against PostgreSQL 16 for whole-department, category-only, shared and no-category cases, including a deleted category.
  • In a local installation with demo data: Microsoft 365 / Graph notifications were enabled without an SMTP From address; tickets were created through the IT Support template with an allowed tag (accepted) and an out-of-scope tag (refused); and the Super Admin, department Admin, Agent and requester views were checked for what each can see and change.

This is a public beta; the beta.4 limitations still apply.

Publication checks

Verified release source: fe8379901549aae5c2503789f2df824bd4a2bef4.

  • Main CI and main Security passed, as did all checks on the pull request.
  • Tagged-image scan and publication passed. The released image digest is sha256:c6b34ed60f85a2b2dcbe32b24f452b8ca46a5b5932721bc8d2148b852d9b507a.
  • The published image runs as UID 1001, reports version 0.9.0-beta.5, and contains Next.js 15.5.28, Zod 4.6.7, Nodemailer 10.3.1 and the tag migration. The production dependency audit has zero findings, and a Trivy scan of the published image reports no fixable high or critical findings.
  • The image was pulled anonymously, without GitHub credentials. The attached docker-compose.yml matches the version-pinned Compose file generated from the tagged source.
Previous releases and rollback downloads
Assets 3
Loading