Version: 3.9.8 Bug Fixes Milestones - Fixed reports showing 0% completion and the timeline "Show Tasks" view displaying nothing (#3624, #3625, #3628) Milestone Modal - Resolved focus loss, restored save-and-close, and fixed a 500 error when saving goals (#3605) To-Dos - Kept To-Dos from closed projects browsable once the project is reopened (#3626, #3627) Post-3.9.7 Regressions - Fixed a file brow…
Latest Release of Leantime.
Version: 3.9.7 Highlights Cross-Project Program Views Task views can now span multiple projects as programs, with sprints inherited across the program board so you can plan and track work at a higher level. (#3587) New Features Personal Access Tokens - Completed the move of personal access token management into core with a dedicated token controller and language keys (#3597) MCP Domain Tools - Reo…
Version: 3.9.6 Security Security Hardening - Addressed authorization, SSRF, reset-token, LDAP, and stored-XSS vulnerabilities (#3584) Plugin Management - Plugin management now requires the proper permission and install input is validated more strictly (#3583) Avatar Rendering - User IDs are now encoded in avatar image sources to prevent DOM-based XSS (#3582) API Responses - Credentials are now str…
Version: 3.9.5 New Features Mobile API Endpoints - Added session-scoped mobile endpoints for the notifications inbox and calendar (#3529) Bug Fixes Blueprints Canvas - Fixed a 404 error when adding or editing canvas items (#3544) Editor Mentions - The @mention dropdown now appears directly beneath the caret (#3530) General Fixes - Resolved several recently reported bugs (#3532) Dependency Updates…
Version: 3.9.4 Bug Fixes My Work Across Projects - Fixed an issue that prevented "My Work" from loading tickets across different projects, and exposed and secured the mark-ticket-done action (#3527) What's Changed Other Changes fix(auth): Sanctum-guard session stores role name not raw int (fixes Bearer -32001 on all gated methods) by @marcelfolaron in #3525 Release v3.9.3 by @marcelfolaron in #352…
Version: 3.9.3 Bug Fixes Bearer Authentication - Resolved a Bearer token error (-32001) that denied every permission-gated API method for mobile and token-based integrations. The Sanctum-guard session stored the raw role integer instead of the role name the permission engine expects (#3525) Improvements Unified Session Handling - All authentication paths (web login, API key, and Bearer token) now…
Version: 3.9.2 Bug Fixes Route Caching - Automatically recovers from stale route cache and corrects an invalid exception import to prevent routing errors (#3523) Bearer/PAT Authentication - Fixed Bearer and personal access token authentication by validating against the core token store (#3522) What's Changed Other Changes fix(auth): establish user context for Sanctum Bearer API requests (3.9.0 reg…
Version: 3.9.1 Bug Fixes Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514) Improvements API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513) What's Changed Other Changes Security: comprehensive remediation across 7 vulnerability families by @marcelfolaron in #3399 Modernize all controllers fr…
Version: 3.9.0 Highlights Native Permission Engine A brand-new permission engine now governs access across the entire application, replacing ad-hoc role checks with a centralized, fail-closed authorization layer. The engine was rolled out domain by domain — Tickets, Comments, Users, Clients, Settings, Sprints, Wiki, Ideas, Goals, Blueprints, Canvas, Calendar, Timesheets, Files, Reports, and the Pr…
Highlights Complete Blade Template Migration All remaining legacy .tpl.php, .sub.php, and .inc.php templates have been converted to Laravel Blade, completing the frontend template unification. 272 legacy files removed, 200 Blade files added (net reduction of 72 files). This covers all 16 canvas domains, shared submodules (Tickets, Comments, Files, Projects), simple domains (Auth, Install, Settings…
Changes in this Release History from `` to @ Commits Contributors Files What's Changed Other Changes Translated to Brazilian Portuguese by @lucasvieira2902 in #3274 build(deps): bump lodash-es and mermaid by @dependabot[bot] in #3273 build(deps): bump minimatch by @dependabot[bot] in #3286 fix: backend bug fixes from phase-0 modernization branch by @marcelfolaron in #3289 feat(tokens): add design…
Changes in this Release Bug Fixes Migration Fails on MySQL Strict Mode — Fixed SQL syntax error in migrations update_sql_30200 and update_sql_30411 caused by using double quotes for string defaults (DEFAULT "ocean"); MySQL interprets these as identifier quotes, not string literals (#3284) Ticket Inline Edits Not Updating UI — Fixed patch() returning false for non-status field changes (assignee, mi…