Releases

Releases are on GitHub. Images publish to ghcr.io/lets-parley/parley for linux/amd64 and linux/arm64 from published GitHub Releases with exact vMAJOR.MINOR.PATCH tags, and are anonymously pullable.

Publishing a GitHub Release for vX.Y.Z publishes X.Y.Z and X.Y, and moves latest. Creating or moving a tag without publishing a Release does not run the publication workflow.

Beginning with the first release produced by the hardened workflow, each release includes two SPDX JSON SBOMs — one scanned from the published linux/amd64 image, one from the source tree covering the Go and web/ npm dependencies — plus Compose and Kubernetes manifests pinned to the published image digest. Releases v0.1.0 through v0.2.1 were not backfilled with these artifacts or attestations. Verify a hardened release’s digest before deployment:

The build job has no registry write permission. A separate publisher copies the immutable build to a run-specific staging tag, verifies its digest and the release tag’s commit, and assigns final tags only after both checks pass.

gh attestation verify \
  "oci://ghcr.io/lets-parley/parley@sha256:YOUR_RELEASE_DIGEST" \
  --repo lets-parley/parley \
  --signer-workflow lets-parley/parley/.github/workflows/release.yml

v0.5.1

Your chosen avatar resets to initials, the marks are now voxel-art portraits, and accessories are retired.

• Every avatar picked before this release stops rendering and falls back to your initials. The old silhouettes were replaced wholesale, so the twelve retired ids — parrot, kraken, anchor, lighthouse, wheel, gull, buoy, crate, rubber-duck, coffee, terminal and pager — are no longer known to any client. Nothing was lost and nothing needs migrating: open the profile dialog and pick again. Those twelve ids are retired permanently and are never reused for a new avatar
• Thirty voxel-art portraits replace the eight maritime silhouettes and the four-icon dev pack. One sheet, one set of ids, and the art is committed SVG — nothing is fetched from a third party at render time. The portrait fills the chip rather than sitting inside it, so it stays legible at the 38px picker preview and the 46px seat. Sizes are unchanged
• Accessories are gone. PATCH /api/me/avatar no longer stores accessory — the field is still accepted so an older client is not rejected, but it is ignored — and avatarAccessory no longer appears in GET /api/me, space members, or session participants. The picker’s accessory control and the chip overlay are removed too, so the second axis is gone from every surface. The avatar_accessory column is left in place, unwritten and unread, and a later migration drops it. See Choosing an avatar

v0.2.3

A packaging release. No code changes — v0.2.2 remains the release that fixed the broadcast crash, and running it is equally safe.

• The Helm chart is published for the first time. The job that publishes it landed after v0.2.2 was tagged, so helm install from the registry could not reach a fixed chart until now
• The compose file, Kubernetes manifest and chart appVersion name a current image, and the install commands in the README and on this site name a tag the registry actually serves — the previous v-prefixed examples were never pullable

v0.2.2

Security release. Upgrade from any earlier version.

• A client disconnecting during a broadcast could kill the server. Every release before this one could be crashed remotely by an ordinary participant closing a tab at the wrong moment, taking down every room on the instance rather than only theirs. Denial of service only — no data disclosure, and unrevealed votes were never affected. See Known vulnerable versions
• The first tests for internal/hub, including a race-detector test covering concurrent close and broadcast

v0.2.1

Parley moved to the lets-parley organisation. The module path is github.com/lets-parley/parley and images now publish to ghcr.io/lets-parley/parley. No functional changes from v0.2.0.

v0.2.0

• Sign-in through any OpenID Connect provider, with AUTH_MODE=open unchanged as the default
• A fix for a room-code throttle that could be bypassed when Parley was reachable directly
• Estimates validated against the session’s own deck
• A new look: chart paper and navy ink, with tabular figures for vote counts

v0.1.0

The first release: planning poker with four decks, daily standup, spaces with passcodes, CSV export, and the documentation site.

Do not run v0.1.0

It contains the room-code throttle bypass fixed in v0.2.0. When Parley is reachable directly rather than through a proxy, the per-address limit on wrong room-code guesses could be evaded, making codes brute-forceable.

The tag and image were deliberately not moved onto fixed code. Retagging would silently change what that version means for anyone who had already pulled it and would break digest verification — a clearly-labelled bad version is safer than a mutated one.

Upgrade to v0.2.2. v0.2.0 and v0.2.1 fix this bypass but are themselves affected by the broadcast crash.

There is no GitHub Release object for v0.1.0, only a tag and an image — it was tagged before release notes were being written. Its absence from the releases list does not mean it was withdrawn.

Upgrading

See Upgrading. Migrations are forward-only and the binary refuses to start against a schema newer than it knows, so take a backup before moving between versions.