Backspace 1.0.4
Backspace 1.0.4
Server release. The content security policy introduced in 1.0.3 now enforces instead of reporting, and the container image stops shipping two package managers it never used.
There are no functional changes to the desktop app in this release. If you are on 1.0.3, the installers here are equivalent and you can skip them.
What changed
The content security policy now enforces
1.0.3 shipped the policy in report-only mode, which meant browsers evaluated it, reported what would have been blocked, and loaded the resource anyway. It now blocks.
The gap between those two states is narrower than it sounds. The page has always carried a second, enforcing policy covering the directives that stop script injection, so those have been active in every release since 1.0.0. What starts enforcing now is the rest: which origins may be framed, where forms may submit, and whether the app may be embedded in a frame.
Before the switch, the report-only policy was observed on two live deployments across ordinary use: loading the app, sending messages, uploading and displaying files, joining voice, and screen sharing. Each observation round injected deliberate violations first to prove the detector worked, because a clean result from a broken detector looks identical to a clean policy. No violations came from the application itself.
Violations are still reported to the instance, so if this does break a flow that was never exercised, it leaves a trace in your logs.
The container image no longer ships pnpm or npm
Neither was ever used at runtime. The image installs nothing from a registry and starts the server directly. Both were present anyway, one because the build activated it and one because the base image bundles it.
Between them they accounted for 17 of the image's 20 fixable high and critical scan findings, all of it in code that never ran. The count is now 3, and those three are a single cluster in the web framework that needs a major upgrade with its own compatibility work.
Release automation
Publishing a release used to have four build jobs race to create the same draft, which on 1.0.3 produced two drafts with the files split between them. The draft is now created once, before the builds start.
Operator notes
The compose file defaults to the latest image tag, so docker compose pull moves you across releases, including ones that carry database migrations. Pin BACKSPACE_IMAGE_TAG in your .env to stay on a specific version. Backups are taken automatically before migrations run, and ./restore.sh restores them.
Nothing auto-updates. restart: unless-stopped restarts the image you already have, it never fetches a new one. From your install directory:
git pull
docker compose pull && docker compose up -dIf the policy blocks something on your deployment, check your instance log for lines reading CSP violation reported. The directive and the blocked address are both recorded. Please open an issue if you find one, since that means a real flow was missed.
Downloads
| Platform | File |
|---|---|
| Windows (x64 + arm64) | Backspace-1.0.4.exe |
| macOS Apple Silicon | Backspace-1.0.4-arm64.dmg |
| macOS Intel | Backspace-1.0.4-x64.dmg |
| Linux x64 | Backspace-1.0.4-x86_64.AppImage / Backspace-1.0.4-amd64.deb |
| Linux arm64 | Backspace-1.0.4-arm64.AppImage / Backspace-1.0.4-arm64.deb |
macOS first launch
The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.
macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.
macOS 14 and earlier: right-click the app, choose Open, then Open again.
Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.
Since there are no desktop changes in this release, macOS users have a reason to skip it: updating resets the Input Monitoring and Screen Recording permissions, because the signature carries no stable identity.
Known, not fixed here
Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic.
Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.
The published container image is still scanned on every publish without blocking. The backlog is down to 3 findings, all in one dependency cluster that needs a major framework upgrade. That upgrade is scoped and has a deadline of 2026-12-01, after which the dependency scan turns red on purpose.