Redmine - Package Updates

[Package Updates]

[3.11.5]

• Update redmine to 6.1.3
• Full Changelog
• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

[Package Updates]

[3.11.6]

• Update redmine_oauth to 4.0.9

[Package Updates]

[3.12.0]

• Update redmine_oauth to 4.1.0

[james]

Redmine update 7.0.0 blocked due to regression in redmine_oauth.
Waiting for new release of redmine_oauth to fix the issue.

[Package Updates]

[3.20.0]

• Update redmine to 7.0.0
• Full Changelog

[Package Updates]

[3.20.1]

• Update redmine_oauth to 4.2.1
• Full Changelog

[Package Updates]

[3.20.2]

• Update redmine_oauth to 4.2.2
• Full Changelog
• Bug: #141 - Azure AD truncates last_name field

[Package Updates]

[3.20.3]

• Update redmine oauth to 7.0.1

[Package Updates]

[3.20.4]

• Update redmine to 7.0.2
• Full Changelog

[Package Updates]

[3.20.5]

• Update redmine_oauth to 4.2.3

[Package Updates]

[3.20.6]

• Update base | final to 6.0.1
• security: fix eMudhra cert compromise

[Package Updates]

[3.20.7]

• Update redmine to 7.0.3
• Full Changelog