Windshift 0.8.7

Released 26 August 2026. Published as tag v0.8.7 on GitHub and as ghcr.io/windshiftapp/windshift:v0.8.7. Binaries and the macOS app are on the download page.

Windshift 0.8.7 hardens Markdown and HTML rendering, strengthens custom-field data integrity and presentation, tightens agent-skill and access boundaries, and makes boards, navigation, forms, dashboard widgets, and integration APIs more dependable. It also moves official builds and source development to Go 1.27.

Upgrade and compatibility

  • Installations older than 0.8.5 must upgrade to 0.8.5 or 0.8.5-2 before they move to 0.8.7. Back up the database, upgrade to one of those releases, and allow Windshift to start successfully and record the 0.8.5 schema checkpoint before installing 0.8.7.
  • Installations already running 0.8.5, 0.8.5-2, or 0.8.6 can upgrade directly. This release requires the recorded 0.8.5 checkpoint. Direct upgrades from 0.8.4 or earlier are not supported.
  • Building Windshift from source now requires Go 1.27.0. The module, official container builders, and release preflight images all use Go 1.27.0.
  • External Markdown images are now restricted by default. Existing image URLs remain stored, but browsers load only local attachments, embedded images, Unsplash, Atlassian API, and configured Jira hosts. Administrators who trust their content authors and need images from other HTTP or HTTPS hosts can enable External Markdown Images under Admin > Security. The policy change applies when users next load or refresh a page.

Custom fields and forms

  • A broad custom-field reliability pass improves validation, cleanup, display, portal usability, sorting, and query behavior across work items, assets, and customer-facing surfaces.
  • Portal and public forms treat blank optional select and multiselect values as unset, require the title consistently when it appears on a form, and avoid offering field types that the portal cannot populate.
  • Custom-field definitions and values are validated more consistently: in-place type changes are rejected, number and date values are checked, virtual number behavior is aligned across configuration and submission, and select fields cannot be saved without options.
  • Board cards, collection lists, customer details, and portal asset reports render typed custom-field values more reliably. Multiselect cards keep every selection, multi-user fields show names, corrupt numbers no longer display as NaN, empty arrays use the not-set state, and reference fallbacks use stable IDs.
  • Custom-field sorting, filtering, and indexing handle more edge cases: ID-backed scalar fields avoid lexicographic ordering, multi-user fields are not offered as sortable, the visual query builder can round-trip IS NULL and IS NOT NULL, and SQLite text and date indexes match the expressions used by queries.
  • Asynchronous cleanup and index jobs cover item, asset, and portal data, recognize numeric-string option IDs, protect concurrent edits, avoid duplicate index builds, and retry transient failures while surfacing permanent ones. Linking-field mirror deletion follows the same in-use, index-cleanup, and scrub safeguards.
  • Custom-field automations can set boolean and checkbox values and reject deleted or unknown field IDs instead of persisting orphaned data.
  • Portal customer-list parsing failures are now logged instead of silently hiding affected rows without diagnostic context.

Content security and agent safeguards

  • Work-item descriptions and comments preserve their source Markdown for editing and integrations. Browser-facing HTML is produced by one shared sanitizer across desktop, mobile, public-board, and portal views. Safe Markdown formatting remains available; raw HTML is displayed as text, and scripts, event handlers, embedded documents, and unsafe URL schemes are removed or made inert.
  • Markdown links and images follow the same URL policy in the editor, server renderer, imports, REST responses, and public surfaces. HTTP and HTTPS links remain supported, along with mail, telephone, page, anchor, relative, and safe raster-image destinations where appropriate. Script-capable, protocol-relative, control-character, and backslash-confused destinations are rejected.
  • Administrators can explicitly allow images from arbitrary HTTP and HTTPS hosts with the External Markdown Images security setting. The default content-security policy keeps the narrower local, embedded, Unsplash, Atlassian, and configured Jira exceptions.
  • Required-SSO authentication now verifies access through the configured SSO provider, and action user resolution excludes people outside the current workspace.
  • Action destinations are normalized and validated at the execution boundary, closing URL parsing and hostname cases that could escape the configured allowlist.
  • Agent-skill activation enforces an aggregate content budget, limits skill access through review-stable run snapshots, keeps referenced pages ACL-safe, and prevents skill metadata from changing prompt structure.
  • The agent grant form reflows in narrow settings panels so its controls remain readable and usable.

Boards and everyday work

  • REST API consumers can select up to 100 anchor items with CQL or explicit IDs and batch-load up to 50 direct visible links per item. Per-item continuation and set-based loading keep dependency graph requests bounded without an N+1 query pattern. Link expansion is one hop in this release.
  • Label assignments and item-link changes refresh every affected item, so incremental /items/changes consumers stay synchronized and recent-activity ordering reflects relationship updates. Label-definition edits also refresh assigned items without treating catalog maintenance as user activity.
  • Collection boards can include personal tasks, move them between the personal Open and Done states through endpoint columns, and open the correct personal-task detail experience.
  • Browser back and forward navigation preserves the selected item detail, and Daily Plan remains usable when no model provider is configured.
  • Form-channel creation uses one consolidated configuration and routing path while preserving the expected channel result.
  • My Tasks, Overdue Items, and Upcoming Deadlines exclude completed work using the authoritative completion state, including custom completed categories such as Closed or Resolved.

Maintenance

  • Windshift uses Go 1.27's standard-library UUID package and caps the number of values accepted in HTTP request headers across the application, Logbook, and CLI authentication callback servers. CI and lint tooling are updated for Go 1.27 support.
  • The direct filepath-securejoin dependency is updated from 0.6.1 to 0.7.0. Upstream reports no API change.