Kimai - Package Updates
-
-
[2.57.0]
- Update kimai to 2.65.0
- Full Changelog
- Added Serbian translations (#6121)
- Translation updates (#6118) (#6119)
- Preload customer, project and activity teams - fixes N+1 for teamleads (#6120)
- Flag (already hidden) API route as deprecated (#6123)
- Speed up timesheet listing calls by pre-fetching info about involved teams (#6123)
- BC fix for DEFAULT_URI (#6123)
- Added check for activity team permissions in timesheet listings (#6123) thanks to @Rajib-Mahmud
- Harden permission check on team management API routes (#6123) thanks to @ashrexon
- Change "create default team" logic to use a form modal (#6124) thanks to @mattmumford-git
-
[2.58.0]
- Update kimai to 2.66.0
- Full Changelog
- Added a lock date to active projects to limit timesheet editing for past periods - read docs (#6103)
- Activity listing now allows to use "create timesheet" for users with
create_own_timesheetonly (#6151) - Improve documentation link with higher contrast and page title (#6129)
- Adds
budget,timeBudgetandbudgetTypeto customer, project and activity collection endpoints (#6140) - New API endpoint to delete invoices (#6141)
- Timesheet API improvements (#6139)
- New "favorites" endpoints (#6143)
- Fix weekly invoice grouping merging the same week from different years (#6134)
- Two-factor (2FA) form was not visible with SAML and deactivated login form (#6136)
- This release contains several security fixes, you are advised to upgrade your system ASAP.
-
[2.59.0]
- Update kimai to 2.67.0
- Full Changelog
- Use timeout in network call, fixes Doctor screen in airgapped environments (#6172)
- Do not hijack the export form for submitting the actual export request, use JS for it (#6172)
- Fix broken redirect on missing permission
edit_teamafter usingcreate_team(#6172) - Remove legacy code and deprecate form option (#6172)
- Fix NelmioApiDocBundle warning (#6172)
- Translations update from Hosted Weblate (#6163)
- API: validate recent activity collection limit (#6171)
- Use only translated locales for routes and cache warming (#6148)
-
[2.60.0]
- Update kimai to 2.68.0
- Full Changelog
- Dropdowns: visible label length increased to 180 char + scroll to selected element on open (#6222)
- Reports: sticky first column in horizontal tables (#6216)
- Better duration input handling on all duration fields (#6210)
- Shorter duration entry: Interpret ints < 10 as hours and >= 10 as minutes (#6146)
- API: added endpoint to update invoice (#6184)
- SAML/LDAP - fix invalid Avatar prevents login (#6223)
- Fix URLs with untranslated locales using subregions (broken user profiles) (#6184)
- API: invoice payment date is a date, not a date-time (BC) (#6184)
- Disable password reset if
TRUSTED_HOSTSis not configured (#6226) - Timesheet batch-update: throw if timesheet may not be edited, instead of skipping it (#6184)
-
[2.61.0]
- Update kimai to 2.69.0
- Full Changelog
- Reset user security signature on change of relevant fields (#6230)
- Allow to switch LDAP/SAML accounts to internal (#6229)
- New choice form type that supports re-ordering and that keeps the saved column order when editing (#6228)
- Login links should always use 2FA (#6228)
- Translations update from Hosted Weblate (#6225)
- The "Project details" report was not visible for teamleads (#6228)
- Missing "Project details" route did not highlight report menu (#6228)
- Use
DEFAULT_URIin login-link command to fix "Untrusted Host" (#6228)
-
[2.62.0]
- Update kimai to 2.70.0
- Full Changelog
- Password strength configuration (#6242)
- CSS classes for customization (working contract screen) (#6240)
- Translations update from Hosted Weblate (#6235) (#6253)
- Prevent internal preferences from being updated via API - thanks @sharma19d (#6240)
- Make sure that remembered users cannot skip the password-change wizard - thanks @sharma19d (#6240)
- Update security-signature on password-reset and end all active sessions - thanks @Tan-JunWei (#6240)
- Added EnvVarProcessor to parse TRUSTED_HOSTS - thanks @dylanzonix (#6246)
- Only the logged-in user can activate 2fa - thanks @AzureADTrent (#6240)
-
[2.63.0]
- Update php-base | final to 8.5-20261021
- security: fix RCEs CVE-2026-109618 / CVE-2026-109619
-
[2.63.1]
- Update kimai to 2.70.2
- Full Changelog
- This release exists mainly to trigger a rebuild of our Docker images, which will the ship fixed PHP versions.
- See our blog post for more information or peek in #6262.
- Use correct body type in JS form posts (#6264)
-
[2.64.0]
- Update kimai to 2.71.0
- Full Changelog
- Remove API password from user profile screen (#6277)
- Deactivate API passwords (#6267) - thanks @haxxordan
- Check if API is allowed to set begin (#6275) - thanks @Deniiz23
- Use edit permission to check if times can be set via API (#6276) - thanks @Deniiz23
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login