Windshift 0.9.1

Released 21 October 2026. Published as tag v0.9.1 on GitHub and as ghcr.io/windshiftapp/windshift:v0.9.1. Binaries and the macOS app are on the download page.

Windshift 0.9.1 is a hotfix for 0.9.0. It fixes a UI freeze introduced in 0.9.0, where opening a work item from a collection could lock the entire page. The hotfix also includes the community work and fixes that landed after 0.9.0 shipped: emoji reactions on comments, watchers and a "Created by Me" dashboard section, plus fixes for Microsoft 365 email intake, helpdesk first response, and setup passwords.

React to comments with emoji

A comment can now be acknowledged without writing a reply. Six reactions are available: thumbs up, check, eyes, heart, laugh, and hooray. They show up as chips under each comment, with your own reaction highlighted, a picker to change it, and a tooltip that names who reacted. The add and remove endpoints are idempotent and gated the same way as commenting, grouped reactions are included in comment list, get, update, and batch responses, and a reaction publishes an item change so open views update live. Internal notes and approval rows never carry reactions (@dpb97).

Watch a work item

Item detail now shows how many people watch it and lets you add or remove watchers right there. The API has list, add, and remove watcher endpoints, and the section works on desktop and mobile (@danielraab).

A "Created by Me" dashboard section

The personal dashboard can show a section for items you created, next to personal tasks and assigned-to-me. It is part of the default work layout and can also be added from the widget catalog (@danielraab).

Bug fixes

  • Opening a work item from a collection no longer freezes the UI. Items opened from a collection board, list, or tree, or from the support queue, could leave the page stuck on its loading state with an effect_update_depth_exceeded error in the browser console. The shared editor-option cache was rewritten on every render, so Svelte's update loop never settled. Priming the cache is now idempotent and runs outside the reactive dependency, so the view settles after the first pass. The freeze affected items in workspace and global collections, including items created after 0.9.0; personal task cards were unaffected (GH #365).
  • Passwords longer than 72 bytes are rejected with a clear message. Completing setup with a passphrase over bcrypt's 72-byte limit returned an internal 500, and the setup page showed a generic failure. The length is now checked before hashing, so setup returns a message that explains the problem (@Faks).
  • Microsoft 365 inbound email connects again. The OAuth flow asked for mailbox-only scopes and then tried to read the mailbox identity from Microsoft Graph, which rejected the token, so every connection failed with "Couldn't read the connected mailbox identity" (GH #363). The monitored mailbox is now entered as configuration before the flow starts, the callbacks no longer look up an identity, and only the scopes the flow uses are requested. Stored credentials are cleared when the mailbox or OAuth client changes, and a connection verified for one address cannot be enabled for another.
  • First response counts the first public agent reply. The helpdesk pack stopped its first-response clock on assignment, so a ticket that was answered but never assigned never met the metric. It now stops on the first public agent comment, and internal notes no longer satisfy it.
  • Go 1.27.3. The bundled toolchain moves to 1.27.3 for the crypto/x509 fix in GO-2026-6809.

Performance

  • Route changes no longer flash the full-page loading spinner. The loading state waits 175 ms, and route chunks are prefetched on hover, focus, and idle.
  • Comment feeds read reactions only when they render them, and grouped reactions are served from a short-TTL cache that is invalidated by reaction writes and comment deletes.

Upgrade and compatibility

  • Drop-in replacement for 0.9.0. No database migration, configuration change, or re-login is required.
  • Email OAuth channels. The monitored mailbox address is now a field in the channel configuration. Existing connections keep working. If you reconnect, enter the mailbox address before starting the OAuth flow.

Thank you

Thank you to Daniel (@danielraab) for watchers and the "Created by Me" dashboard section, to Dominik (@dpb97) for emoji reactions on comments, and to Oskars (@Faks) for the setup-password fix. Thanks also to everyone who reported the collection freeze, the Microsoft 365 intake failure, and the other issues fixed in this hotfix.