v1.15.1

1.15.1 (2026-07-22)

Bug Fixes

• point live-demo link at demo.thedeskhq.app (#713) (9776964)

---

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/deskhq/the-desk:1.15.1

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.15.0

1.15.0 (2026-07-22)

Features

• move the project to the deskhq organisation and docs domain (#699) (06cbbf4)

---

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/deskhq/the-desk:1.15.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.15.0-rc.0

1.15.0-rc.0 (2026-07-22)

Features

• move the project to the deskhq organisation and docs domain (#699) (06cbbf4)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.15.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/deskhq/the-desk:1.15.0-rc.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.14.0

1.14.0 (2026-07-21)

Features

• add an OpenAPI 3.1 spec for the public REST API v1 (#677) (d960e04)
• mention user groups to notify everyone in them at once (#679) (67550b6)
• quick-react shortcuts and a frequently-used emoji strip (#686) (37291da)
• replace the native date inputs with shadcn date pickers (#673) (302066d)
• voice messages in the composer, with an inline waveform player (#681) (8e52dea)

Bug Fixes

• anchor bare calendar days to the viewer's local midnight (#674) (b8ec20d)
• hide reminders for messages the viewer can no longer access (#689) (cfcc2ed)
• point worktree env away from services the bootstrap leaves down (#691) (cddaf4f)
• stamp the running version on the candidate release line (#668) (5332e5e)
• target the built version in the upgrade CI jobs (#682) (f4fa4d0)

Dependencies

• clear the open Dependabot alerts (guzzle, shell-quote) (#688) (204a51a)

---

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.14.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.14.0-rc.2

1.14.0-rc.2 (2026-07-21)

Features

• quick-react shortcuts and a frequently-used emoji strip (#686) (37291da)

Bug Fixes

• hide reminders for messages the viewer can no longer access (#689) (cfcc2ed)
• point worktree env away from services the bootstrap leaves down (#691) (cddaf4f)

Dependencies

• clear the open Dependabot alerts (guzzle, shell-quote) (#688) (204a51a)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.14.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.14.0-rc.2

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.14.0-rc.1

1.14.0-rc.1 (2026-07-21)

Bug Fixes

• target the built version in the upgrade CI jobs (#682) (f4fa4d0)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.14.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.14.0-rc.1

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.14.0-rc.0

1.14.0-rc.0 (2026-07-21)

Features

• add an OpenAPI 3.1 spec for the public REST API v1 (#677) (d960e04)
• mention user groups to notify everyone in them at once (#679) (67550b6)
• replace the native date inputs with shadcn date pickers (#673) (302066d)
• voice messages in the composer, with an inline waveform player (#681) (8e52dea)

Bug Fixes

• anchor bare calendar days to the viewer's local midnight (#674) (b8ec20d)
• stamp the running version on the candidate release line (#668) (5332e5e)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.14.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.14.0-rc.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.13.0

1.13.0 (2026-07-20)

Features

• add CSP_EXTRA_FONT_SRC to allow-list an external font host (#654) (00f25ba)
• declare base-uri, form-action and object-src in the csp (#652) (86017d8)
• deny framing by default with frame-ancestors and X-Frame-Options (#656) (a4ec64f)
• proxy remote images so img-src can drop the https: wildcard (#655) (a65b3d6)
• send hsts on secure responses and default the secure session cookie (#659) (7ee77dd)
• set a content-security-policy header on web responses (#650) (51bc293)

Bug Fixes

• fork worktrees from the remote base branch (#642) (edf1639), closes #639
• give the browser-written cookies samesite and secure flags (#657) (082b967)
• refuse a candidate release below develop's baseline (#638) (87dbcb6)
• stop background writes from cancelling the visit in flight (#646) (560e39f)

Performance

• run the local Pest gate in parallel like CI does (#649) (4d4889c)

---

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.13.0

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.13.0-rc.2

1.13.0-rc.2 (2026-07-20)

Features

• send hsts on secure responses and default the secure session cookie (#659) (7ee77dd)

Bug Fixes

• give the browser-written cookies samesite and secure flags (#657) (082b967)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.13.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.13.0-rc.2

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.

v1.13.0-rc.1

1.13.0-rc.1 (2026-07-20)

Features

• add CSP_EXTRA_FONT_SRC to allow-list an external font host (#654) (00f25ba)
• declare base-uri, form-action and object-src in the csp (#652) (86017d8)
• deny framing by default with frame-ancestors and X-Frame-Options (#656) (a4ec64f)
• proxy remote images so img-src can drop the https: wildcard (#655) (a65b3d6)

---

🚧 Release candidate

This is a release candidate, published for testing ahead of 1.13.0. It is not supported for production — run it against a copy of your data, not your live workspace, and expect it to be superseded without notice. Self-hosters should stay on the latest stable release.

📦 Docker image

This release is published to the GitHub Container Registry:

ghcr.io/emmpaul/the-desk:1.13.0-rc.1

Pull it directly or browse the package page. See the upgrade guide for self-hosting steps.