Changelog

v1.4.21 26 October 2026

Fixed

• The bug list remembers its filter when you open a bug. If you switched a project's bug list to Fixed or All, opened a bug and went back, the list reset to Open. It now comes back exactly as you left it: the same tab, search, priority, due date and page. The filters are also part of the page address, so a reload keeps them and a copied link opens the same view.

v1.4.20 26 October 2026

New

• Bug IDs are now shown in the app. Every bug's number (for example #142) appears before its title in a project's bug list, in the Assigned to You list on the dashboard, and in the Details panel on the bug's page, where a copy button puts it on your clipboard ready to paste into chat, a commit message or an AI assistant.

v1.4.19 23 October 2026

Improved

• A cleaner Settings page. Settings are grouped into labelled sections (Account, Preferences, Integrations and, for the admin, Administration), with every card the same width. On phones the sections stack into a single column.

Fixed

• Changing your email now asks for your current password. Previously only a password change did, so anyone holding a signed-in session could switch your account's email to their own and then reset your password.

v1.4.18 23 October 2026

New

• Work with bugs from Claude, Cursor and other AI assistants. BugTrack now speaks the Model Context Protocol (MCP). Create a token under Settings → AI Assistants (MCP) and your assistant can report, search, read and update bugs and comment, with exactly your permissions. Read more in Manage bugs from Claude, Cursor and other AI assistants.
• Assistants can attach and view screenshots. PNG, JPG, GIF and WebP images up to 10 MB can be attached to bugs and comments, and an assistant can see the images on a bug.

Improved

• Crash reports no longer include what you write in BugTrack. Request bodies are never sent, and the SMTP password field is always removed.
• Clearer errors for admins when creating a bug in a project, or assigning it to a person, that no longer exists.
• Settings page fits on narrow phones without scrolling sideways.

Fixed

• A bug can no longer be reassigned to someone outside its project.
• Rejected image uploads no longer leave files behind on the server.

v1.4.17 23 October 2026

Improved

• Email library updated to close six security advisories. BugTrack now uses nodemailer 10. Email notifications work as before.
• The SMTP "Send test email" button now tells you when email cannot work instead of reporting a test email that was never sent.
• Node.js 20 or newer is now the supported version. Installs still on Node 18 keep running, but please switch to Node 20 or 22 when you can, then run npm install.

v1.4.16 23 October 2026

Fixed

• Wrong-password error on the login page now stays visible. It used to flash and disappear because a failed sign-in was treated like an expired session. Failed sign-ins, password-reset requests and demo sign-ins now leave the page alone.

v1.4.15 8 September 2026

Fixed

• Bug Trend sparkline crosshair now aligns with data point dots. When hovering over the chart, the vertical crosshair line and the orange/green dots were out of sync — the crosshair appeared to the left of the actual data point. Fixed by setting preserveAspectRatio="none" so the chart fills its container exactly.

v1.4.14 8 September 2026

Fixed

• Update page no longer suggests a rollback when the app just needs a manual restart. A 403 after update now shows "restart your app from the hosting panel" instead of directing admins to roll back a successful update.

v1.4.13 8 September 2026

New

• Richer dashboard. Four new sections: Assigned to You (your 10 highest-priority open bugs), Recent Activity (last 10 actions across projects), Bug Trend (14-day sparkline: bugs opened vs resolved with hover tooltip), and Open by Priority (stacked bar: critical / high / medium / low).

Improved

• Dashboard loads faster. All dashboard data now fetched in a single API call instead of multiple round trips.

Fixed

• Dashboard no longer crashes when the server returns partial data.

v1.4.10 1 September 2026

Fixed

• Slack notifications now show a preview in push alerts. All three notification types were missing the plain-text fallback Slack uses for push previews, causing every notification to show "[no preview available]".

Improved

• All database queries now use explicit column lists (internal hardening).

v1.4.9 1 September 2026

Improved

• Installs now appear in Update Requests automatically. The app now detects its own public URL from the first update check and stores it — no manual APP_URL configuration required.

v1.4.8 1 September 2026

Fixed

• Updates that fail dependency installation no longer wipe data. Rollback now only restores the database if the update actually wrote to it.

Improved

• Manual backup reminder shown before applying updates.

v1.4.4 31 August 2026

New

• Paginated bug listing. Project pages now show 25 bugs per page with Prev / Next controls. CSV export still covers all matching bugs.
• Redesigned Slack notifications. Colour-coded (purple/green/blue), with linked bug title, description preview, a View Bug button, and BugTrack footer. Bot icon shows the BugTrack logo when APP_URL is set.

v1.4.1 – v1.4.3 30 August 2026

New

• Optional crash reporting. Off by default. Admin enables in Settings. Reports include error, location in code, version, and request path — no bug content, passwords, or email addresses.
• Error pages now show a message and reload button instead of going blank.

Fixed

• Updates that add a new dependency can no longer leave the app unable to start. Updates now verify all dependencies arrived and roll back if any are missing. (This fixed the 503 issue some 1.4.0 installs saw.)
• BugTrack icon now appears in the browser tab.

v1.3.1 29 August 2026

Improved

• Screenshots can be pasted directly into bug descriptions (not just comments).
• Attaching images adds to whatever is already attached, instead of replacing it.
• Each attached image can be removed individually before filing the bug.

v1.3.0 29 August 2026

Security

• JWT signing secret is never a shared default. Installs with no secret (or a known published default) now generate a private one on first start.
• Uploads can no longer be served as executable markup. Files checked on both MIME type and extension; stored under a verified extension; served with nosniff, a restrictive CSP, and forced download for non-raster types.
• Sign-in is now rate limited — 20 attempts per IP, 8 per email, per 15-minute window.
• Server error responses no longer echo internal exception messages.
• CORS is same-origin by default instead of *.