v1.1.2

1.1.2 (2026-09-22)

Bug Fixes

• a machine that refuses its checkout is not live for the board, and says why (BP-777) (4457877)
• a shadowed plain cookie cannot cancel or take over a prefixed session (BP-773); narrow the faked-heading filter (BP-780) (4ea359e)
• compose derives the session cookie's security from the instance's origins (BP-773) (505f734)
• logout revokes every session the jar carries, and a revoked prefixed cookie no longer hides a live plain one (BP-773) (37be711)
• menubar: find the worker's socket where a deep state dir moves it (BP-778) (f8cd57d)
• menubar: keep a hand-set commit identity when the same account is re-picked (BP-779) (ebc6f4b)
• menubar: refuse a control socket answered by another user's process (BP-778) (975c3b1)
• menubar: refuse a relocated socket whose directory is not private; one socket path for every spelling of the state dir (BP-778) (78b2af7)
• npm start listens on the PORT set in .env (BP-775) (33e8e18)
• release, worker and self-hosting fixes (BP-773, BP-777, BP-779, BP-780, BP-776, BP-778, BP-775, BP-768, BP-772, BP-774) (a7a5004)
• the Workers list says a refused checkout as a sentence (BP-777) (1067d28)
• under auto, a sign-in over https gets the secure cookie; 1 refuses an https PUBLIC_ORIGIN (BP-773) (bb4a09c)
• warn once when X-Forwarded-For arrives while TRUSTED_PROXY_HOPS is 0 (BP-774) (3ec15cf)
• worker: commit as the pinned GitHub account and name it in preflight (BP-779) (cf894b0)
• worker: keep the control socket under the 104-byte limit for a deep state dir (BP-778) (ce0c5e2)
• worker: list only checks that saw the delivered code, keep the agent out of the worker's section, promise checks only when composed (BP-780) (331fa25)
• worker: list the checks a run passed on its pull request (BP-780) (4aabd3e)
• worker: preflight warns rather than fails a machine with no git identity, names a missing token, and refuses CR and NUL in a set identity (BP-779) (3a70aba)
• worker: re-read repos.json even when the server refuses the state GET (BP-776) (fae1bdf)
• worker: read the step at its own position, and strip every heading shape a summary could fake (BP-780) (aea1a41)
• worker: report the release the worker was built from (BP-768) (c74f796)

v1.1.1

1.1.1 (2026-09-22)

Bug Fixes

• ci: pass secrets to the called release workflow, so a release-please release can sign (4a326bf)
• ci: pass secrets to the called release workflow, so a release-please release can sign (BP-767) (829e162)

v1.1.0

1.1.0 (2026-09-22)

Features

• publish a multi-arch Docker image to GHCR on every release (BP-766) (3c2d1c6)

Bug Fixes

• a suggestion list keeps its selection when its data refreshes (1cbb555)
• build links from the runtime origin, not a build-time NEXT_PUBLIC_APP_URL (BP-766) (97f078a)
• compose passes .env through, Enrol dialog drops CP_API_TOKEN (BP-769) (db93c0d)
• compose still honours NEXT_PUBLIC_APP_URL as PUBLIC_ORIGIN; document upgrading and clone builds (BP-766 review) (68414c5)
• keep the selected suggestion by id, and keep a dismissed list shut (1004cfd)
• log a worker enrolment refused for want of PUBLIC_ORIGIN (BP-766 review) (ada9f1a)
• pass every .env variable through docker compose (BP-769) (3d2cf51)
• the Enrol dialog no longer asks for CP_API_TOKEN (BP-769) (5b8e143)
• the Enrol dialog says to chmod 600 the token file (BP-769) (4377219)
• worker: an unreadable enrolment token file only matters before registration (BP-769) (1a943f2)
• worker: surface why an enrolment token file cannot be read (BP-769) (4257614)

v1.0.1

What's Changed

• test: pin the three guards that make a board shortcut do nothing (BP-477) by @rafalpodles in #400
• feat(mcp): link_tasks and unlink_tasks, so an epic can hold sub-tasks by @rafalpodles in #401
• test: drive the daily digest end to end, and pin the scheduler that fires it (BP-605) by @rafalpodles in #402
• fix(pm): the chat panel owns the keyboard inside it (BP-654) by @rafalpodles in #403
• test: cover the proxied login throttle end to end (BP-409) by @rafalpodles in #404
• fix: the proxied-throttle skip reason reaches the actual reporter (BP-409) by @rafalpodles in #405
• test: cover the list view's pointer drag, header sort, reset-to-default, reload persistence and inline edits (BP-470) by @rafalpodles in #407
• fix: a refused digest is retried rather than lost, and the scheduler says what it armed (BP-659, BP-660) by @rafalpodles in #409
• feat(board): a card names the parent it belongs to by @rafalpodles in #408
• test: cover the integrations panel's untested half (BP-472) by @rafalpodles in #410
• test: cover task detail reactions, dependency types, handover notice and rail rows (BP-474) by @rafalpodles in #411
• test: cover mention-by-full-name and the five-suggestion cap (BP-479) by @rafalpodles in #412
• test: drive the shell at the breakpoints nothing had asked (BP-655) by @rafalpodles in #413
• fix: give the PM chat launcher its own accessible name (BP-661) by @rafalpodles in #406
• test: sprint edges, the toast stack and two search leftovers (BP-475) by @rafalpodles in #414
• fix: say a gate refusal once per reason, not once every refresh by @rafalpodles in #415
• test: the tab title and the sprint countdown (BP-480) by @rafalpodles in #416
• fix: the fleet's controls, one definition of "is the person typing", and one kill switch (BP-642, BP-656, BP-693) by @rafalpodles in #417
• fix: linking tasks leaves a trace at both ends (BP-658) by @rafalpodles in #418
• test: cover github.ts's loopback carve-out (BP-687) by @rafalpodles in #419
• test: the coverage audit's remainder — dead reads deleted, eight routes and seven lib modules covered (BP-713, BP-714, BP-715, BP-716) by @rafalpodles in #421
• test: cover DecisionPanel's six degraded states end to end (BP-704) by @rafalpodles in #422
• ci: only run the e2e groups a push can affect (BP-717) by @rafalpodles in #420
• fix: per-project ceilings under concurrency, a hung DB, and a worker retry that started cold (BP-719, BP-366, BP-289) by @rafalpodles in #423
• fix: categories and templates tell a full list from a vanished project (BP-721) by @rafalpodles in #424
• feat: let an admin list machine accounts with ?include=machines (BP-718) by @rafalpodles in #425
• feat: tenant model and the entitlement gate (BP-649) by @rafalpodles in #426
• test: defend machineMayNotForce over real HTTP on every door (BP-694) by @rafalpodles in #428
• fix: an unremovable linked worktree drops its grant instead of refusing forever (BP-505) by @rafalpodles in #429
• fix: task links tell the truth about who holds what (BP-657, BP-690, BP-691) by @rafalpodles in #430
• fix: four small bugs — digest key duplication, worker log spam, symlinked checkout removal, Policy pane naming (BP-692, BP-688, BP-428, BP-377) by @rafalpodles in #431
• fix: a simultaneous first read can no longer create a second settings or tenant document (BP-722) by @rafalpodles in #432
• test: drive GitLab end to end against a stub, and fix two bugs it found (BP-695) by @rafalpodles in #433
• test: receive webhooks and chat messages end to end, through an e2e-only destination rule (BP-408, BP-696) by @rafalpodles in #434
• fix: spend the board feed's cap only on people who qualify, and match every digest row as a whole line (BP-705, BP-697) by @rafalpodles in #436
• fix: worker git-path, env allowlist and checkout-removal hardening (BP-310, BP-507, BP-641) by @rafalpodles in #435
• test: drive every owner-gated route as a genuine owner, and rotate and revoke credentials through the UI (BP-699, BP-706) by @rafalpodles in #437
• fix: drive the PM's MCP OAuth connection end to end, and fix three bugs it found (BP-707) by @rafalpodles in #438
• fix: four defects an evaluation of the product found — history, refused boards, unsaved agents, criteria label by @rafalpodles in #427
• test: every failed-read panel and the sprint estimates driven on screen (BP-700, BP-701) by @rafalpodles in #442
• fix: close a token-issuance race, bind the PM OAuth callback to its owner, retry once on a stale token, and stop silently replacing typed OAuth clients (BP-747, BP-749, BP-750, BP-751) by @rafalpodles in #443
• feat: onboarding empty states that point to the next step (BP-753) by @rafalpodles in #440
• feat: let a project owner manage its worker settings, behind an instance lock (BP-736) by @rafalpodles in #439
• fix: the Markdown toolbar marks whole lines and an empty checklist Enter no longer submits; editor controls driven end to end (BP-708, BP-709) by @rafalpodles in #444
• feat: a task says every reason it will not run, and who fixes it (BP-727, BP-728, BP-731) by @rafalpodles in #441
• fix: an account on no board is told only that, not who the admins are (BP-753) by @rafalpodles in #445
• fix: handover notice says the board's owner, not the owners' names (BP-763) by @rafalpodles in #446
• feat: signed, notarised release of the menubar app and the worker on tag (BP-760) by @rafalpodles in #447

Full Changelog: v1.0.0...v1.0.1

v1.0.0 — first licensed release

First tagged release of Board Planner, and the first under a licence: the core is AGPL-3.0-only, src/ee/ is the Enterprise Edition under its own terms (empty in this release).

Self-hosted install: docker compose up -d --build, see the README and https://board-planner.com/docs/administration/installing-and-running/.