Version: 3.10.3 Upgrade Notes Set LEAN_APP_URL - Password reset and invite emails now link only to a trusted app URL. If LEAN_APP_URL is not set, Leantime learns the URL the first time an owner or admin signs in (after 2FA). Until then, reset and invite emails are not sent, and admins see a banner explaining why. Setting LEAN_APP_URL is recommended. (#3826) Plugin cron jobs now run - Console runs…
Latest Release of Leantime.
Version: 3.10.2 This is a security release. All self-hosted installations should upgrade. Security Authentication - Password-reset tokens are now generated with a cryptographically secure generator and stored hashed; the session id rotates on login, 2FA and logout; other sessions end after a password change or reset; login, password-reset and 2FA-code attempts are rate limited. (#3810) OIDC - ID t…
Version: 3.10.1 New Features Personal Webhooks - Added personal webhook delivery for notifications. (#3799) Beta Badge - Added a Beta badge variant for navigation menu items. (#3777) Bug Fixes Timezones - The PHP process now always runs in UTC and the user's timezone is applied explicitly. This fixes timestamps (comments, history, audit, files, canvas items, wiki) being stored in the viewer's loca…
Version: 3.10.0 Highlights Telegram Messenger Integration Connect Leantime to Telegram to receive rich, auto-detected task notification cards directly in your chats, keeping your team informed without leaving their messenger. (#3726) Redesigned Goals with Multi-Milestone Support The goal dialog has been rebuilt with a split layout, monitor/manage tabs, and inline updates, and a single goal can now…
Version: 3.9.8 Bug Fixes Milestones - Fixed reports showing 0% completion and the timeline "Show Tasks" view displaying nothing (#3624, #3625, #3628) Milestone Modal - Resolved focus loss, restored save-and-close, and fixed a 500 error when saving goals (#3605) To-Dos - Kept To-Dos from closed projects browsable once the project is reopened (#3626, #3627) Post-3.9.7 Regressions - Fixed a file brow…
Version: 3.9.7 Highlights Cross-Project Program Views Task views can now span multiple projects as programs, with sprints inherited across the program board so you can plan and track work at a higher level. (#3587) New Features Personal Access Tokens - Completed the move of personal access token management into core with a dedicated token controller and language keys (#3597) MCP Domain Tools - Reo…
Version: 3.9.6 Security Security Hardening - Addressed authorization, SSRF, reset-token, LDAP, and stored-XSS vulnerabilities (#3584) Plugin Management - Plugin management now requires the proper permission and install input is validated more strictly (#3583) Avatar Rendering - User IDs are now encoded in avatar image sources to prevent DOM-based XSS (#3582) API Responses - Credentials are now str…
Version: 3.9.5 New Features Mobile API Endpoints - Added session-scoped mobile endpoints for the notifications inbox and calendar (#3529) Bug Fixes Blueprints Canvas - Fixed a 404 error when adding or editing canvas items (#3544) Editor Mentions - The @mention dropdown now appears directly beneath the caret (#3530) General Fixes - Resolved several recently reported bugs (#3532) Dependency Updates…
Version: 3.9.4 Bug Fixes My Work Across Projects - Fixed an issue that prevented "My Work" from loading tickets across different projects, and exposed and secured the mark-ticket-done action (#3527) What's Changed Other Changes fix(auth): Sanctum-guard session stores role name not raw int (fixes Bearer -32001 on all gated methods) by @marcelfolaron in #3525 Release v3.9.3 by @marcelfolaron in #352…
Version: 3.9.3 Bug Fixes Bearer Authentication - Resolved a Bearer token error (-32001) that denied every permission-gated API method for mobile and token-based integrations. The Sanctum-guard session stored the raw role integer instead of the role name the permission engine expects (#3525) Improvements Unified Session Handling - All authentication paths (web login, API key, and Bearer token) now…
Version: 3.9.2 Bug Fixes Route Caching - Automatically recovers from stale route cache and corrects an invalid exception import to prevent routing errors (#3523) Bearer/PAT Authentication - Fixed Bearer and personal access token authentication by validating against the core token store (#3522) What's Changed Other Changes fix(auth): establish user context for Sanctum Bearer API requests (3.9.0 reg…
Version: 3.9.1 Bug Fixes Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514) Improvements API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513) What's Changed Other Changes Security: comprehensive remediation across 7 vulnerability families by @marcelfolaron in #3399 Modernize all controllers fr…
Version: 3.9.0 Highlights Native Permission Engine A brand-new permission engine now governs access across the entire application, replacing ad-hoc role checks with a centralized, fail-closed authorization layer. The engine was rolled out domain by domain — Tickets, Comments, Users, Clients, Settings, Sprints, Wiki, Ideas, Goals, Blueprints, Canvas, Calendar, Timesheets, Files, Reports, and the Pr…
Highlights Complete Blade Template Migration All remaining legacy .tpl.php, .sub.php, and .inc.php templates have been converted to Laravel Blade, completing the frontend template unification. 272 legacy files removed, 200 Blade files added (net reduction of 72 files). This covers all 16 canvas domains, shared submodules (Tickets, Comments, Files, Projects), simple domains (Auth, Install, Settings…
Changes in this Release History from `` to @ Commits Contributors Files What's Changed Other Changes Translated to Brazilian Portuguese by @lucasvieira2902 in #3274 build(deps): bump lodash-es and mermaid by @dependabot[bot] in #3273 build(deps): bump minimatch by @dependabot[bot] in #3286 fix: backend bug fixes from phase-0 modernization branch by @marcelfolaron in #3289 feat(tokens): add design…
Changes in this Release Bug Fixes Migration Fails on MySQL Strict Mode — Fixed SQL syntax error in migrations update_sql_30200 and update_sql_30411 caused by using double quotes for string defaults (DEFAULT "ocean"); MySQL interprets these as identifier quotes, not string literals (#3284) Ticket Inline Edits Not Updating UI — Fixed patch() returning false for non-status field changes (assignee, mi…