Windshift v0.8.7

Windshift 0.8.7

Windshift 0.8.7 hardens Markdown and HTML rendering, strengthens custom-field
data integrity and presentation, tightens agent-skill and access boundaries,
and makes boards, navigation, forms, dashboard widgets, and integration APIs
more dependable. It also moves official builds and source development to Go
1.27.

Upgrade and compatibility

• Installations older than 0.8.5 must upgrade to 0.8.5 or 0.8.5-2 before
  moving to 0.8.7. Back up the database, upgrade to one of those releases,
  and allow Windshift to start successfully and record the 0.8.5 schema
  checkpoint before installing 0.8.7.
• Installations already running 0.8.5, 0.8.5-2, or 0.8.6 can upgrade directly.
  This release requires the recorded 0.8.5 checkpoint; direct upgrades from
  0.8.4 or earlier are not supported.
• Building Windshift from source now requires Go 1.27.0. The module,
  official container builders, and release preflight images have all moved to
  Go 1.27.0.
• External Markdown images are now restricted by default. Existing image
  URLs remain stored, but browsers load only local attachments, embedded
  images, Unsplash, Atlassian API, and configured Jira hosts. Administrators
  who trust their content authors and need images from other HTTP or HTTPS
  hosts can enable External Markdown Images under Admin → Security.
  The policy change applies when users next load or refresh a page.

Custom fields and forms

• A broad custom-field reliability pass improves validation, cleanup, display,
  portal usability, sorting, and query behavior across work items, assets, and
  customer-facing surfaces. (WI-1038)
• Portal and public forms now treat blank optional select and multiselect
  values as unset, require title consistently when it appears on a form, and
  avoid offering field types that the portal cannot populate. (WI-1039,
  WI-1047, WI-1064)
• Custom-field definitions and values are validated more consistently:
  in-place type changes are rejected, number and date values are checked,
  virtual number behavior is aligned across configuration and submission, and
  select fields cannot be saved without options. (WI-1040, WI-1041, WI-1042,
  WI-1044)
• Board cards, collection lists, customer details, and portal asset reports now
  render typed custom-field values more reliably. Multiselect cards keep every
  selection, multi-user fields show names, corrupt numbers no longer display
  as NaN, empty arrays use the not-set state, and reference fallbacks use
  stable IDs. (WI-1043, WI-1048, WI-1049, WI-1050, WI-1060, WI-1061, WI-1062)
• Custom-field sorting, filtering, and indexing now handle more edge cases:
  ID-backed scalar fields avoid lexicographic ordering, multi-user fields are
  not offered as sortable, the visual query builder can round-trip IS NULL
  and IS NOT NULL, and SQLite text and date indexes match the expressions
  used by queries. (WI-1051, WI-1057, WI-1059)
• Asynchronous cleanup and index jobs now cover item, asset, and portal data,
  recognize numeric-string option IDs, protect concurrent edits, avoid
  duplicate index builds, and retry transient failures while surfacing
  permanent ones. Linking-field mirror deletion follows the same in-use,
  index-cleanup, and scrub safeguards. (WI-1052, WI-1053, WI-1054, WI-1055,
  WI-1056, WI-1058)
• Custom-field automations can set boolean and checkbox values and reject
  deleted or unknown field IDs instead of persisting orphaned data. (WI-1045,
  WI-1046)
• Portal customer-list parsing failures are now logged instead of silently
  hiding affected rows without diagnostic context. (WI-1063)

Content security and agent safeguards

• Work-item descriptions and comments now preserve their source Markdown for
  editing and integrations while browser-facing HTML is produced by one shared
  sanitizer across desktop, mobile, public-board, and portal views. Safe
  Markdown formatting remains available; raw HTML is displayed as text, and
  scripts, event handlers, embedded documents, and unsafe URL schemes are
  removed or made inert.
• Markdown links and images now follow the same URL policy in the editor,
  server renderer, imports, REST responses, and public surfaces. HTTP and HTTPS
  links remain supported, along with mail, telephone, page, anchor, relative,
  and safe raster-image destinations where appropriate. Script-capable,
  protocol-relative, control-character, and backslash-confused destinations
  are rejected.
• Administrators can explicitly allow images from arbitrary HTTP and HTTPS
  hosts with the new External Markdown Images security setting. The default
  content-security policy keeps the narrower local, embedded, Unsplash,
  Atlassian, and configured Jira exceptions.
• Required-SSO authentication now verifies access through the configured SSO
  provider, and action user resolution excludes people outside the current
  workspace. (WI-1067, WI-1070)
• Action destinations are normalized and validated at the execution boundary,
  closing URL parsing and hostname cases that could escape the configured
  allowlist. (WI-1068)
• Agent-skill activation now enforces an aggregate content budget, limits skill
  access through review-stable run snapshots, keeps referenced pages ACL-safe,
  and prevents skill metadata from changing prompt structure. (WI-718,
  WI-719, WI-720, WI-722)
• The agent grant form now reflows in narrow settings panels so its controls
  remain readable and usable. (WI-1069)

Boards and everyday work

• REST API consumers can now select up to 100 anchor items with CQL or explicit
  IDs and batch-load up to 50 direct visible links per item. Per-item
  continuation and set-based loading keep dependency graph requests bounded
  without an N+1 query pattern. Link expansion is one hop in this release.
  (WI-1078)
• Label assignments and item-link changes now refresh every affected item, so
  incremental /items/changes consumers stay synchronized and recent-activity
  ordering reflects relationship updates. Label-definition edits also refresh
  assigned items without treating catalog maintenance as user activity.
  (WI-1077)
• Collection boards can now include personal tasks, move them between the
  personal Open and Done states through endpoint columns, and open the correct
  personal-task detail experience. (WI-1073)
• Browser back and forward navigation preserves the selected item detail, and
  Daily Plan remains usable when no model provider is configured. (WI-1066,
  WI-1072)
• Form-channel creation uses one consolidated configuration and routing path
  while preserving the expected channel result. (WI-1071)
• My Tasks, Overdue Items, and Upcoming Deadlines now exclude completed work
  using the authoritative completion state, including custom completed
  categories such as Closed or Resolved. (WI-808, WI-813)

Maintenance

• Windshift now uses Go 1.27's standard-library UUID package and caps the
  number of values accepted in HTTP request headers across the application,
  Logbook, and CLI authentication callback servers. CI and lint tooling have
  also been updated for Go 1.27 support.
• The direct filepath-securejoin dependency is updated from 0.6.1 to 0.7.0;
  upstream reports no API change. (WI-1075)
• Go code has been updated for Go 1.26 lint behavior while preserving existing
  product contracts. (WI-1074)
• The README quick-start link now points to the self-hosting guide instead of a
  missing documentation route. (WI-803)