This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Affected surfaces
ReleasePort's take
Moderate signalThe release scopes the delete‑private‑message operation to its conversation, fixing an IDOR vulnerability.
Why it matters: Severity 90 security fix prevents unauthorized deletion of private messages; operators must apply this update immediately.
Summary
AI summaryUpdates Upgrade notes, What's new, and deps across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Scope delete-private-message to its conversation (fix IDOR) Scope delete-private-message to its conversation (fix IDOR) Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds phone number field to pre‑chat form and JWT auth Adds phone number field to pre‑chat form and JWT auth Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds live chat widget preview during configuration Adds live chat widget preview during configuration Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds separate draft storage per reply type (private note and reply) Adds separate draft storage per reply type (private note and reply) Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds API endpoint to delete private notes Adds API endpoint to delete private notes Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Medium |
Adds context menu option to delete private notes in conversation view Adds context menu option to delete private notes in conversation view Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates Go dependency x/net from 0.47.0 to 0.55.0 Updates Go dependency x/net from 0.47.0 to 0.55.0 Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates Go dependency x/image from 0.38.0 to 0.41.0 Updates Go dependency x/image from 0.38.0 to 0.41.0 Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes live chat form submission failure on invalid URL/number fields Fixes live chat form submission failure on invalid URL/number fields Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Marks assignment notifications as read when acted upon Marks assignment notifications as read when acted upon Source: llm_adapter@2026-07-15 Confidence: low |
— |
Full changelog
What's new
- Delete private notes.
- Phone number in pre-chat form - Collect a phone number in the pre-chat form, or pass one using the JWT token.
- Live chat widget preview - Preview the widget while configuring it, making it easy to customize.
- Improved drafts - Drafts are now stored per reply type: private note and reply.
What's fixed
- Assignment notifications are marked as read in the UI when you act on them.
- Many other quality-of-life fixes and improvements.
Upgrade notes
- Always take a database backup before upgrading.
- Follow the steps here.
Changelog
- e6a1c908 Merge pull request #417 from abhinavxd/prechat-remove-button-type
- 1bb21db6 fix prechat field removal on enter key in livechat inbox form
- 4949ad1c Merge pull request #415 from abhinavxd/split-name-util
- b949d70b use mailbox local part as contact name fallback when display name is empty
- cfc032f3 add SplitName util and use it to parse email contact names
- 9cb104b5 Update ROADMAP.md
- ddaf8485 Merge pull request #413 from abhinavxd/jwt-phone-number-comment
- 7754a777 clarify phone_number comment in JWT payload example
- 0b05ca82 Merge pull request #412 from abhinavxd/widget-draft-phone-shadow-fixes
- 6cb8bcee prefill country code for optional phone fields too in pre-chat form
- b46b84ed Merge pull request #411 from abhinavxd/mis-fixes
- 9c6a6c25 fix widget draft attachments, prechat phone default, and shadow tweaks
- 2e203607 fix duplicate contact creation on transient error during ext_id enrichment
- e38facf7 Merge pull request #410 from abhinavxd/convo-list-sla-draft-fixes
- 9ce7fede make SLA badges react to prop changes and hide draft label on open conversation
- 0fa00cf1 Merge pull request #408 from abhinavxd/jwt-phone-country-code
- 526d6abd Merge pull request #409 from abhinavxd/assign-nudge-permission-check
- 57481de4 Merge pull request #407 from abhinavxd/draft-attachment-preview
- fc71d30b accept phone country code in livechat JWT auth
- 99492cc4 hide assign-to-me nudge when agent lacks assignee permission
- 2de3038d show attachment type in draft preview when there is no draft text
- e3d5d46f Merge pull request #406 from abhinavxd/livechat-phone-field-and-ui-fixes
- 8a8d372a use one phone field in livechat JWT and fix phone validation
- e56e3d3b use distinct icons for online, away and offline status dots
- 8f658f27 add livechat pre-chat phone field and fix default launcher logo
- e9a7269c Merge pull request #404 from abhinavxd/harden-contact-create-and-drop-away-on-login
- 9b5326c6 normalize email before validating create conversation request
- 4dabc84a harden contact create, drop set-away-on-login, make status dots colorblind-safe
- 4020829d Merge pull request #403 from abhinavxd/add-novalidate-remaining-forms
- 3bf95aea add novalidate to remaining vee-validate forms
- 08ed665e Merge pull request #402 from abhinavxd/fix-livechat-form-native-validation
- d6f44a3c fix livechat form submit silently failing on invalid url/number fields
- 2bfe2429 Merge pull request #261 from josephsellers/delete-private-notes
- 60ebefeb fix edge cases in private note soft-delete
- 43b43a82 Merge branch 'main' into delete-private-notes
- d696b53c soft-delete private notes with a tombstone instead of removing them
- 5a826b9c Merge pull request #399 from abhinavxd/reply-box-per-type-drafts
- adeb4eee swap private-note delete to a hover 3-dot menu with confirm dialog
- 9e0c1f33 Merge branch 'main' into delete-private-notes
- bde6f019 Merge pull request #401 from abhinavxd/fix-dark-highlight-css-leak
- dc882e03 Merge pull request #260 from josephsellers/contact-name-upsert
- 8268221e fix dark-mode mention highlight leaking a yellow background onto every .dark element
- 1d7bc67e stop sent drafts from coming back after a failed or reordered sync
- 186502a4 open the reply/note tab matching the conversation's last-used draft
- 0ae92324 Merge pull request #400 from ahfoysal/fix-assignment-notification-read
- 27e8efb2 fix: update assignment notification state in UI
- f4f8db81 Mark assignment notifications read on action
- 8a68ae34 fix flaky reply e2e and stop draft load from wiping in-progress input
- 79b76494 fix attachments and macros leaking across reply and private note drafts
- ee7b829f Merge branch 'main' into reply-box-per-type-drafts
- 3feecf42 Merge pull request #394 from abhinavxd/minor-improvements
- 0949761d fix contrast threshold and cache invalidation order on login
- 0660ae4e Merge pull request #396 from abhinavxd/dependabot/go_modules/golang.org/x/image-0.41.0
- 51663583 move isValidDraftType to bottom of file
- 18027bc0 fix draft races by making the store the single source of truth
- 6eabd8aa build(deps): bump golang.org/x/image from 0.38.0 to 0.41.0
- 82d3ef75 Merge pull request #395 from abhinavxd/dependabot/go_modules/golang.org/x/net-0.55.0
- 57e15d32 build(deps): bump golang.org/x/net from 0.47.0 to 0.55.0
- ec3938c3 save reply and private note drafts separately per type
- 62a1fc83 add livechat widget preview and misc improvements
- 42a3b3a4 Merge pull request #391 from abhinavxd/roles-learn-more-link
- 725acf67 Merge pull request #392 from abhinavxd/dependabot/npm_and_yarn/frontend/vite-6.4.3
- a7bcd5e7 build(deps-dev): bump vite from 6.4.2 to 6.4.3 in /frontend
- 4280a216 Update roadmap with new item and formatting changes
- 3052e2a7 Update ROADMAP.md
- 8720e37b add learn more link to roles admin page
- 76d00c89 make the contact name upsert actually run for existing contacts
- 406a2941 Scope delete-private-message to its conversation (fix IDOR)
- da20825e Add context menu to delete private notes in conversation view
- b699cacd Add API endpoint to delete private notes
- 000326bb Fix: update contact names on upsert instead of discarding them
What's Changed (Auto-generated)
- build(deps-dev): bump vite from 6.4.2 to 6.4.3 in /frontend by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/392
- add learn more link to roles admin page by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/391
- build(deps): bump golang.org/x/net from 0.47.0 to 0.55.0 by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/395
- build(deps): bump golang.org/x/image from 0.38.0 to 0.41.0 by @dependabot[bot] in https://github.com/abhinavxd/libredesk/pull/396
- add livechat widget preview and misc improvements by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/394
- Mark assignment notifications read on ticket action by @ahfoysal in https://github.com/abhinavxd/libredesk/pull/400
- Fix: update contact names on upsert instead of discarding them by @josephsellers in https://github.com/abhinavxd/libredesk/pull/260
- fix dark-mode mention highlight leaking a yellow background by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/401
- Reply box per type drafts by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/399
- Add API endpoint to delete private notes by @josephsellers in https://github.com/abhinavxd/libredesk/pull/261
- fix livechat form submit silently failing on invalid url/number fields by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/402
- add novalidate to remaining vee-validate forms by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/403
- Harden contact create, drop set-away-on-login, make status dots color blind safe by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/404
- Livechat phone field and UI fixes by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/406
- show attachment type in draft preview when there is no draft text by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/407
- hide assign-to-me nudge when agent lacks assignee permission by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/409
- accept phone country code in livechat JWT auth by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/408
- make SLA badges react to prop changes and hide draft label on open conversation by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/410
- fix duplicate contact creation on transient error by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/411
- fix widget draft attachments, prechat phone default, and shadow tweaks by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/412
- clarify phone_number comment in JWT payload example by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/413
- add SplitName util and use it to parse email contact names by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/415
- fix prechat field removal on enter key in livechat inbox form by @abhinavxd in https://github.com/abhinavxd/libredesk/pull/417
New Contributors
- @ahfoysal made their first contribution in https://github.com/abhinavxd/libredesk/pull/400
Full Changelog: https://github.com/abhinavxd/libredesk/compare/v2.4.0...v2.5.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About libredesk
Modern, open source, self-hosted customer support desk. Single binary app.
Beta — feedback welcome: [email protected]