Changelog

Notable changes for people who run or use Roadmap. The format follows Keep a Changelog, and versions follow Semantic Versioning. The full commit history is on each GitHub release.

On this page

Unreleased #

The first release meant for people outside the project. Everything since v0.0.1.

Sign in from the agent with OAuth. claude.ai, ChatGPT and other clients that take only a URL can connect: the person signs in and clicks Allow, and the connection is listed in Settings → Access tokens, where revoking it disconnects the app. Needs ROADMAP_BASE_URL; ROADMAP_OAUTH=off turns it off. Pasted tokens work as before. See docs/DEPLOYMENT.md.
REST API at /api/v1: one endpoint per MCP tool, an OpenAPI 3.1 document at /api/v1/openapi.json, read-only tokens, a per-token rate limit (ROADMAP_API_RATE_PER_MINUTE) and opt-in CORS (ROADMAP_API_CORS_ORIGINS). See docs/API.md.
Attachments on issues and comments, stored in your S3 bucket. HTML files preview in a sandbox, in a modal or a new tab. Agents can upload through an upload link.
MCP resources for saved views and workspace settings. The MCP surface is 29 tools and 12 resources.
Saved views you can see, change, rename and manage from the page.
Demo content: roadmap demo seed fills a throwaway database with projects, milestones, issues and accounts.
Mail for invites and password resets, over SMTP or Resend. Optional.
A redesigned web UI: app shell, sidebar, review inbox, board and list views, and a design system page at /design.
A docs site built from docs/ with Hugo (task docs), with a quickstart, a guide to connecting an agent, and an MCP tool reference generated from the server.

A public bind (--public) refuses to start until ROADMAP_SECURE_COOKIE is set to true or false. Compose no longer picks one for you.
A password reset link lasts one hour, not seven days.
Changing a password ends the sessions and reset links the old password created.
Adding or changing an issue type is limited to administrators.
An MCP session left idle for an hour is closed, so agents that went away no longer hold server memory. Clients start a new session on their next call; the stdio proxy does this for you (D-112).
roadmap mcp --stdio --addr accepts an https:// URL, so Claude Desktop and other stdio clients can reach a server behind TLS.

Every response sends Referrer-Policy: no-referrer, so no page leaks its URL to the next host.

The first tag: the tracker, the MCP server, the web UI, accounts and tokens, and the compose deployment with Litestream backups.