Leantime - Package Updates

[Package Updates]

[1.10.6]

• Update leantime to 3.5.12
• Full Changelog
• fix: issue with new invoice filter
• fix: Remove cpu heavy animations
• feat: Altered Timesheets repo method getAll to take invempl as 0
• feat: Changed invempl from being a checkbox to be a select
• feat: Added handling of invempl as a selected
• feat: Changed default of ticketFilter to be -1 to align with the rest
• feat: Modified projectFilter to better align with current functionality
• feat: Ensured that setting ticketFilter cannot result in an empty query by accident
• feat: Added ticketFilter to timesheets/showAll

[Package Updates]

[1.11.1]

• Update leantime to 3.6.2
• Full Changelog
• Fix timer not starting after v3.6.0 update by @gloriafolaron in #3215
• fix(db): Fix zp_entity_relationship table migration issues by @gloriafolaron in #3221
• Timer Not Starting - Fixed an issue where the stopwatch/timer feature stopped working after the 3.6.0 update (#3208)
• Database Migration Fix - Added migration to fix entity relationship table issues that caused dashboard and ticket errors (#3221)

[Package Updates]

[1.12.0]

• Update leantime to 3.7.0
• Full Changelog
• TinyMCE removed all rich text editing now uses Tiptap. Existing content renders without changes, but any custom TinyMCE plugins or editor extensions will need to be rewritten for the Tiptap API.
• Group by Parent Task new grouping option in To-Do views with root parent resolution for ticket hierarchy
• Comment Reactions HTMX-based emoji reactions on comments (like, love, celebrate, funny, etc.)
• Strategy module relabeled to mission-driven language
• Fixed idea board internationalization issues
• Fixed goal KPI progress calculation
• Fixed milestone collapse behavior
• Fixed calendar duplicate events
• Fixed editor toolbar and border-radius inconsistencies
• Fixed slash menu viewport positioning at screen edges

[Package Updates]

[1.12.2]

• Update leantime to 3.7.3
• Full Changelog
• fix: backend bug fixes from phase-0 modernization branch by @​marcelfolaron in #​3289
• feat(tokens): add design system CSS custom property definitions by @​marcelfolaron in #​3290
• fix: accessibility, view system, and composer improvements from phase-0 by @​marcelfolaron in #​3292
• fix: ticket PATCH 500 errors, quick-add group context, and UI fixes by @​marcelfolaron in #​3313
• fix: address 6 GitHub issues - session, calendar, postgres, todos, users, ldap by @​marcelfolaron in #​3315
• fix: PostgreSQL ROUND(double precision, int) error on ticket queries (#​3301) by @​marcelfolaron in #​3317
• fix: PostgreSQL ROUND error, missing zp_canvas.color migration, and 3.7.2 changelog by @​marcelfolaron in #​3318

[Package Updates]

[1.13.0]

• Update leantime to 3.8.0
• Full Changelog
• Complete Blade Template Migration: All remaining legacy .tpl.php, .sub.php, and .inc.php templates have been converted to Laravel Blade, completing the frontend template unification. 272 legacy files removed, 200 Blade files added (net reduction of 72 files). (#3362)
• Mobile API Surface: Backend API changes to support the Leantime Mobile app (first TestFlight beta). (#3395)
• Task Collaborators: Full multi-collaborator support for task assignment. (#3337)
• PDO Constant Crash on Shared Hosting Guarded all MySQL-specific PDO constants (MYSQL_ATTR_SSL_VERIFY_SERVER_CERT, etc.) with defined() checks in the database config (#3371)
• Commenter Role Cannot Comment Fixed enableCommenterForms() not re-enabling submit buttons inside reply comment boxes (#3194, #3186)
• Wiki Article Creation Fails on Postgres Fixed createArticle() using camelCase sortIndex column name which Postgres rejects (#3382)
• Ideas Saved to canvasId 0 POST handler in IdeaDialog now reads canvasId from the submitted form with session as fallback (#3181)
• Kanban Board Cannot Scroll with 8+ Columns Added overflow-x: auto to the kanban row container (#3394)
• Calendar Zero-Date Crash getCalendar() now skips events with MySQL zero-date sentinels (0000-00-00) instead of crashing the entire calendar feed (#3396)
• Added Arabic (ar-SA) language support (#3370)

[Package Updates]

[1.14.0]

• Update leantime to 3.9.0
• Full Changelog
• Mobile Push Notifications - Mobile devices can now register Expo/FCM push tokens against access tokens and receive ticket and unread-count notifications via a new dispatcher (#3398, #3401, #3457)
• Logic Model Board - Added a Logic Model canvas board with WorkStructure orchestration (#3455)
• Task Collaborators - Completed multi-collaborator support for tasks, ensuring collaborators always receive ticket notifications and appear with full metadata across list and widget views (#1099)
• Postgres Compatibility - Fixed write limits, sequences, pdo_pgsql handling, and JS escaping for PostgreSQL deployments (#3447)
• Auth & Dashboard 500s - Hardened authentication and the dashboard against server errors and offline hangs (#3448)
• Marketplace 500s - Stopped marketplace errors by coercing API data into typed model properties (#3446)
• Milestone & Wiki Dialogs - Restored data binding in the milestone and wiki dialogs (#3444)
• Weekly Timesheet Grid - Blank cells are now skipped when saving the weekly grid (#3449)
• Client Discussion Count - Fixed an inaccurate discussion count on the client detail page (#3426)
• Mobile Responsiveness - Responsive stabilization sweep for phones and tablets (#3442)

[Package Updates]

[1.14.1]

• Update leantime to 3.9.2
• Full Changelog
• Route Caching - Automatically recovers from stale route cache and corrects an invalid exception import to prevent routing errors (#3523)
• Bearer/PAT Authentication - Fixed Bearer and personal access token authentication by validating against the core token store (#3522)
• Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514)
• API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513)

[Package Updates]

[1.14.2]

• Update leantime to 3.9.4
• Full Changelog
• My Work Across Projects - Fixed an issue that prevented "My Work" from loading tickets across different projects, and exposed and secured the mark-ticket-done action (#3527)
• Bearer Authentication - Resolved a Bearer token error (-32001) that denied every permission-gated API method for mobile and token-based integrations. The Sanctum-guard session stored the raw role integer instead of the role name the permission engine expects (#3525)
• Unified Session Handling - All authentication paths (web login, API key, and Bearer token) now build the user session through a single factory, so the role and two-factor state can no longer diverge between them. This also makes two-factor handling consistent for token-based authentication and adds clearer diagnostics when an unresolvable role is encountered (#3526)
• API Auth Test Coverage - The Bearer JSON-RPC contract tests now run through the real server auth path and cover non-manager roles, catching authorization regressions for non-admin users that owner-only testing missed (#3526)

[Package Updates]

[1.14.3]

• Update leantime to 3.9.5
• Full Changelog
• Mobile API Endpoints - Added session-scoped mobile endpoints for the notifications inbox and calendar (#3529)
• Blueprints Canvas - Fixed a 404 error when adding or editing canvas items (#3544)
• Editor Mentions - The @mention dropdown now appears directly beneath the caret (#3530)
• General Fixes - Resolved several recently reported bugs (#3532)
• symfony/yaml - Promoted to a production dependency (#3543)

[Package Updates]

[1.14.4]

• Update leantime to 3.9.6
• Full Changelog
• Security Hardening - Addressed authorization, SSRF, reset-token, LDAP, and stored-XSS vulnerabilities (#3584)
• Plugin Management - Plugin management now requires the proper permission and install input is validated more strictly (#3583)
• Avatar Rendering - User IDs are now encoded in avatar image sources to prevent DOM-based XSS (#3582)
• API Responses - Credentials are now stripped from getUser API responses (#3556, #3576)
• Content Templates - Introduced a generic content templates domain (#3493)
• My Day Schedule API - Added a getMyDaySchedule API endpoint that respects work hours and timezone (#3579)
• Personal Access Tokens - Added shared AI/MCP support classes and personal access token management (#3560)
• Domain Events - Added class-based domain events and filters with a legacy-string plugin bridge (#3503)
• Project Roles - Fixed user role inheritance when adding a user to a project (#3580)
• Kanban View - Fixed a rendering error caused by an undefined variable in the kanban view (#3554)

[Package Updates]

[1.14.5]

• Update leantime to 3.9.7
• Full Changelog
• Personal Access Tokens - Completed the move of personal access token management into core with a dedicated token controller and language keys (#3597)
• MCP Domain Tools - Reorganized MCP tool classes into their respective domain modules (#3581)
• Program Board - Fixed milestones, kanban rendering, and status rollup clarity on the program board (#3592)
• MCP Runtime - Repaired runtime bugs in domain tools uncovered during live end-to-end testing (#3586)
• System Update - System updates now properly clear cached bootstrap manifests.
• General Fixes - Resolved a batch of recently reported bugs (#3540, #3331, #3310, #3589, #3330, #3546, #3593)
• API Rate Limit - Raised the default API rate limit from 10 to 120 requests per minute (#3591)

[Package Updates]

[1.14.6]

• Update leantime to 3.9.8
• Full Changelog
• Milestones - Fixed reports showing 0% completion and the timeline "Show Tasks" view displaying nothing (#3624, #3625, #3628)
• Milestone Modal - Resolved focus loss, restored save-and-close, and fixed a 500 error when saving goals (#3605)
• To-Dos - Kept To-Dos from closed projects browsable once the project is reopened (#3626, #3627)
• Post-3.9.7 Regressions - Fixed a file browser out-of-memory issue, strategy grouping, and 403 errors for legacy roles (#3621)
• MCP Endpoint - The /mcp endpoint now accepts Leantime API keys, and a shim for the removed php-mcp provider lets in-place upgrades boot (#3601, #3602, #3607)
• Program Board - Moved the card status dropdown below the field row (#3599)
• Sessions - Isolated sessions into their own Redis database to avoid clashes with other cached data (#3604)
• Bumped the McpServer submodule to include the bulkAddTasks fix (#3620, #3622)
• Synced composer.lock content hash with composer.json (#3603)