Windshift 0.8.4

Released 3 August 2026. Published as tag v0.8.4 on GitHub and as ghcr.io/windshiftapp/windshift:v0.8.4. Binaries and the macOS app are on the download page.

Windshift 0.8.4 improves self-hosted deployment, startup behavior, import safety, and public-form handling. Review the deployment changes before upgrading a production instance.

Deployment and configuration

  • The Docker guide now uses a required /tmp:exec,size=64M tmpfs mount. The mount applies to SQLite and PostgreSQL deployments.
  • Production Docker examples use pinned image tags. The latest tag remains for local trials.
  • Docker builds can report version, commit, release name, and build date through /api/version.
  • The new /healthz and /readyz endpoints support liveness and database-readiness checks. /api/setup/status reports first-run setup state.
  • ALLOW_LOCAL_CONNECTIONS now defaults to true. This allows server-side integrations to reach local and private-network endpoints. Set ALLOW_LOCAL_CONNECTIONS=false or use --allow-local-connections=false to restore private-address blocking.
  • WINDSHIFT_MEMORY_LIMIT_MB sets the process-memory budget. The default is 2048 MiB and the minimum is 512 MiB. Docker Compose uses a 2g container limit by default.

Authentication

  • Invalid WebAuthn relying-party IDs no longer prevent the server from starting. Windshift disables passkey routes and reports the configuration problem in the startup log.
  • localhost is a valid WebAuthn relying-party ID for local development. Single-label hostnames such as windshift are not valid RP IDs.

Jira imports and release creation

  • Jira mapping and workflow or screen capture failures now propagate to the import result instead of being hidden.
  • Concurrent Jira imports for the same active scope are rejected. Completed imports can still be deliberately reimported.
  • Milestone release idempotency keys now reject payload changes with HTTP 409 Conflict.

Public forms

  • Public-form drafts expire.
  • Authenticated drafts are isolated by user.
  • Anonymous drafts use sessionStorage instead of origin-wide localStorage.
  • Draft storage failures do not prevent form use.

Upgrade checklist

  1. Back up the Windshift database and persistent /data volume.
  2. Set a pinned image tag instead of latest for production.
  3. Add /tmp:exec,size=64M to the Windshift container.
  4. Set WEBAUTHN_RP_ID to the browser-visible hostname in containerized deployments.
  5. Set WINDSHIFT_MEMORY_LIMIT_MB and WINDSHIFT_CONTAINER_MEMORY_LIMIT to matching budgets.
  6. Check /healthz, /readyz, /api/version, and /api/setup/status after startup.
  7. Review the configuration options before enabling or disabling private-network egress.