<![CDATA[OpenProject - Package Updates]]>You can use this thread to track updates to the OpenProject package.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/2473/openproject-package-updatesRSS for NodeMon, 14 Sep 2026 17:53:07 GMTThu, 07 May 2020 16:45:58 GMT60<![CDATA[Reply to OpenProject - Package Updates on Fri, 04 Sep 2026 23:39:16 GMT]]>[3.53.0]

  • Update openproject to 17.8.0
  • Full Changelog
  • Feature: Sprints and backlog buckets can be updated on bulk updating work packages [#73103]
  • Feature: Add create_work_package MCP tool [#75408]
  • Feature: Introduce target versions replacing version [#76181]
  • Feature: Global restrictions/limits for time entries [#78132]
  • Feature: Display relations in the work package table to the community edition [#78598]
  • Feature: Add milestones to the project lifecycle widget [#76749]
  • Feature: Activity tab: Journalise and add information about when a work package is added or discussed in a meeting [#61057]
  • Bugfix: Both "Target version" and "Version" filters are present when target versions is enabled [#78408]
  • Bugfix: Meeting invitation email shows event shifted by +1 hour for dates between 2026-09-29 and 2026-10-24 [#77624]
  • Bugfix: Sprint names and assignments leaking through activity without view_sprints permission [#78436]
]]>https://forum.cloudron.io/post/129041https://forum.cloudron.io/post/129041Fri, 04 Sep 2026 23:39:16 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 14 Aug 2026 06:46:04 GMT]]>[3.52.2]

  • Update openproject to 17.7.2
  • Full Changelog
  • Bugfix: The hourly rate cannot be adjusted for individual projects [#78111]
  • Bugfix: Non-working days saved while reschedule job is running are not applied to work packages [#78219]
  • Bugfix: Bubble with + in timeline view does not make sense [#78284]
  • Bugfix: When using multiple seeded custom styles, most are lost [#78397]
]]>https://forum.cloudron.io/post/128149https://forum.cloudron.io/post/128149Fri, 14 Aug 2026 06:46:04 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 06 Aug 2026 20:20:30 GMT]]>[3.52.1]

  • Update openproject to 17.7.1
  • Full Changelog
  • Bugfix: Retrying a stopped import creates duplicate OpenProject users [#78165]
  • Bugfix: Jira attachment authors are not created as users [#78168]
  • Bugfix: Resource management permissions not visible under Roles > Administration [#78202]
  • Bugfix: Wrong activation of project attributes in PIR [#78153]
]]>https://forum.cloudron.io/post/127855https://forum.cloudron.io/post/127855Thu, 06 Aug 2026 20:20:30 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 06 Aug 2026 07:35:51 GMT]]>[3.52.0]

  • Update openproject to 17.7.0
  • Full Changelog
  • Feature: Add multi-select drop-down for sprint and backlog buckets [#73611]
  • Feature: Multiple active sprints without sharing [#77079]
  • Feature: Adapt BCF Export and Import for semantic identifiers [#74362]
  • Feature: Show project attributes as separate tab in a WorkPackage [#75699]
  • Feature: Add a setting to disable users editing their own email address [#76754]
  • Feature: Filter project by portfolio and programm [#74718]
  • Feature: Global wiki page index [#76743]
  • Bugfix: Users can deleted descendent work packages in projects they are not authorized to [#76930]
  • Bugfix: Members: Changing a group's role results in a 404 error [#77450]
  • Bugfix: WebAuthn Form not submitting [#77298]
]]>https://forum.cloudron.io/post/127783https://forum.cloudron.io/post/127783Thu, 06 Aug 2026 07:35:51 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 09 Jul 2026 14:55:52 GMT]]>[3.51.0]

  • Update openproject to 17.6.0
  • Full Changelog
  • Feature: Sprint goals [#71059]
  • Feature: XWiki integration [#53738]
  • Feature: "All sprints" view - simple list [#74594]
  • Feature: Display backlog bucket in work package [#73887]
  • Feature: Create work package out of Meeting Agenda Item [#57053]
  • Feature: Allow cost types to be enabled/disabled per project [#42037]
  • Feature: Escape possible control characters in CSV export [#75486]
  • POST/PATCH/DELETE /api/v3/meetings/:id/agenda_items) is no longer available, they have been moved to the /api/v3/meeting_agendas/ respectively. The same is true for outcomes and sections.
  • Bugfix: GET /api/v3/meetings/{id}/agenda_items returns incorrect section link format unusable for PATCH and POST requests [#75615]
  • Bugfix: User without save_cost_reports can save public cost reports [#76398]
]]>https://forum.cloudron.io/post/126598https://forum.cloudron.io/post/126598Thu, 09 Jul 2026 14:55:52 GMT<![CDATA[Reply to OpenProject - Package Updates on Tue, 16 Jun 2026 08:50:17 GMT]]>[3.50.1]

  • Update openproject to 17.5.1
  • Full Changelog
  • Bugfix: Capital letters in user email or login break import with error. [#75924]
  • Bugfix: Page scrolls down to the bottom if user clicks on WP description when top of description is out of screen [#74186]
  • Bugfix: Creation of new work packages and status transitions not possible aber upgrade to 17.5 [#75961]
  • Bugfix: Renaming of projects causes AMPF sync to fail [#76022]
  • Bugfix: Direct upload failing on SaaS since new prefix key is added [#75811]
]]>https://forum.cloudron.io/post/125790https://forum.cloudron.io/post/125790Tue, 16 Jun 2026 08:50:17 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 11 Jun 2026 06:45:22 GMT]]>[3.50.0]

  • Update openproject to 17.5.0
  • Full Changelog
  • Feature: Exclude certain work package types from automated backlog (per project) [#71305]
  • Feature: Jira Migrator imports project-based semantic issue identifiers [#72427]
  • Feature: Jira Migrator supports due date, estimated hours and remaining hours. [#74807]
  • Feature: Meeting series: Add monthly scheduling options [#61522]
  • Feature: Debounce emails for meetings [#66645]
  • Feature: Workflows UX improvement: Allow multi-selection of roles in workflow [#72242]
  • Feature: Bring sprint sharing (SAFe) to corporate plan [#74147]
  • Bugfix: POST/PATCH/DELETE requests to APIv3 return unauthorized [#73499]
  • Bugfix: Nextcloud integration shows "No connection to Nextcloud" for folders that have "&" in the name [#73855]
  • Bugfix: Wrong calendar week in My time tracking [#68272]
]]>https://forum.cloudron.io/post/125687https://forum.cloudron.io/post/125687Thu, 11 Jun 2026 06:45:22 GMT<![CDATA[Reply to OpenProject - Package Updates on Mon, 08 Jun 2026 13:31:18 GMT]]>[3.49.1]

  • Update openproject to 17.4.1
  • Full Changelog
  • CVE-2026-47193 - Journal diff endpoint bypasses object, journal, and field visibility checks
  • CVE-2026-49355 - Private work package data disclosure through single meeting agenda item API
  • GHSA-3vpx-94qx-xpw6 - IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
  • GHSA-6crw-7f5r-4qj9 - CSRF on TARGET through /users/:id via POST parameter "user[admin]"
  • GHSA-98vw-2r87-fx2r - SQL injection in timestamps functionality
  • GHSA-h83w-5q5x-pq27 - Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
  • GHSA-q33w-f822-hg8x - Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
  • GHSA-qj96-f42f-6336 - Cache store poisoning leads to Remote Code Execution (RCE)
  • Bugfix: Migration 2025092 failing due to update code failing on not-yet fully migrated schema [#75286]
]]>https://forum.cloudron.io/post/125593https://forum.cloudron.io/post/125593Mon, 08 Jun 2026 13:31:18 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 14 May 2026 18:38:57 GMT]]>[3.49.0]

  • Update openproject to 17.4.0
  • Full Changelog
  • Feature: Add meetings and recurring meetings APIv3 endpoints [#32280]
  • Feature: Workflow UX improvement: Apply workflow setting from one role to another role [#72383]
  • Feature: Backlog buckets in "Backlog and sprints" view [#73081]
  • Feature: Allow webhook secrets for GitHub and Gitlab integrations [#73387]
  • Feature: Have a sprint start/complete button in the sprint header [#73402]
  • Feature: Backlog card draggable + one-click for side panel [#73473]
  • Feature: Add widget for upcoming meetings on project overview and home page and remove users widget [#73684]
  • Feature: Jira Migrator imports custom fields [#73147]
  • Bugfix: Users can execute custom actions despite conditions not applying [#74294]
  • Bugfix: Copying a work package with instance wide sharing leads to two projects sharing instance wide [#74721]
]]>https://forum.cloudron.io/post/124737https://forum.cloudron.io/post/124737Thu, 14 May 2026 18:38:57 GMT<![CDATA[Reply to OpenProject - Package Updates on Wed, 13 May 2026 18:41:13 GMT]]>[3.48.2]

  • Update openproject to 17.3.2
  • Full Changelog
  • GHSA-r85r-gjq2-f83r - Docker Container starts with SECRET_KEY_BASE default value
  • CVE-2026-44731 - Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure
  • CVE-2026-44732 - IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
  • CVE-2026-44733 - Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
  • CVE-2026-44734 - Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename
  • CVE-2026-44735 - Shares API Information Disclosure
  • Bugfix: Performance impact of large Markdown/HTML templates caused by the tagfilter GFM extension [#74151]
  • Bugfix: Budget widget breaks when lots of cost types defined [#74189]
  • Bugfix: Direct login prevents authentication from mobile app [#74569]
]]>https://forum.cloudron.io/post/124700https://forum.cloudron.io/post/124700Wed, 13 May 2026 18:41:13 GMT<![CDATA[Reply to OpenProject - Package Updates on Mon, 20 Apr 2026 14:17:10 GMT]]>[3.48.1]

  • Update openproject to 17.3.1
  • Full Changelog
  • Bugfix: Some macros cannot be used (displayed behind modal) while creating a new child via relations tab [#62585]
  • Bugfix: The 'Reload' action in the banner about the meeting being updated in the background no longer auto-scrolls to the previous position [#70559]
  • Bugfix: Items multiplying on page and page becoming unresponsive when macros and code snippet are used [#73117]
  • Bugfix: Remove a 2FA device from a user as admin does not work [#73218]
  • Bugfix: Error when changing wp type from the wp list [#73224]
  • Bugfix: Internal error on custom actions form [#74131]
]]>https://forum.cloudron.io/post/123731https://forum.cloudron.io/post/123731Mon, 20 Apr 2026 14:17:10 GMT<![CDATA[Reply to OpenProject - Package Updates on Sun, 19 Apr 2026 13:27:35 GMT]]>[3.48.0]

  • Update openproject to 17.3.0
  • Full Changelog
  • Bugfix: Performance Issues with Backlog on v17.2.2 [#73557]
  • Bugfix: Remove a 2FA device from a user as admin does not work [#73218]
  • Bugfix: Users without permissions can see project attributes [#73208]
  • Feature: Introduce sprints and replace versions in current backlogs view [#70496]
  • Feature: Create boards on Sprint start [#69139]
  • Feature: Closing a sprint [#73100]
  • Feature: Display all work package types in backlogs module [#73101]
  • Feature: Remove EE guards from boards [#73188]
  • Feature: Inplace edit for project attributes on project overview page [#71380]
  • Feature: Allow nesting Groups [#73527]
]]>https://forum.cloudron.io/post/123659https://forum.cloudron.io/post/123659Sun, 19 Apr 2026 13:27:35 GMT<![CDATA[Reply to OpenProject - Package Updates on Tue, 31 Mar 2026 13:40:24 GMT]]>[3.47.3]

  • Update openproject to 17.2.3
  • Full Changelog
  • CVE-2026-34717 - SQL Injection in Cost Reporting =n Operator via parse_number_string
  • The =n operator in cost reports did not appropriately treat user input
  • This vulnerability was reported by user Ochk0 through a GitHub security advisory. Thank you for responsibly disclosing your findings.
  • For more information, please see the GitHub advisory #GHSA-5rrm-6qmq-2364
]]>https://forum.cloudron.io/post/122747https://forum.cloudron.io/post/122747Tue, 31 Mar 2026 13:40:24 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 27 Feb 2026 08:23:34 GMT]]>[3.46.2]

  • Update openproject to 17.1.2
  • Full Changelog
  • Bugfix: Error when creating a new work package after uploading an attachment to the previous one that was opened in details view [#​67980]
  • Bugfix: Pasting rich text into CKEditor crashes it [#​69597]
  • Bugfix: external_redirect URL always engaged, making copy&pasting links harder [#​71946]
  • Bugfix: Parent project name visible in breadcrumb irrespective of parent access [#​71972]
  • Bugfix: Trying to attach a calendar part when no mail is being generated fails [#​72244]
  • Bugfix: Meetings appear duplicate in the ical subscription after an interim response [#​72259]
  • Bugfix: Can't create automatically managed project folder when project name contains forbidden Nextcloud characters [#​72525]
]]>https://forum.cloudron.io/post/120861https://forum.cloudron.io/post/120861Fri, 27 Feb 2026 08:23:34 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 20 Feb 2026 21:16:51 GMT]]>[3.46.1]

  • Update openproject to 17.1.1
  • Full Changelog
  • Bugfix: Documents: zooming in issue on iOS [#​71023]
  • Bugfix: Seeding in zh-TW fails [#​71869]
  • Bugfix: Default document types are recreated after every OpenProject update [#​71877]
  • Bugfix: External links in notification emails not captured [#​71907]
  • Bugfix: External links with encoded space in path lead to OpenProject home page [#​71931]
  • Bugfix: Error in meeting PDF exports if cover image file storage is broken [#​71945]
  • Bugfix: Last admin can delete themselves [#​71980]
]]>https://forum.cloudron.io/post/120535https://forum.cloudron.io/post/120535Fri, 20 Feb 2026 21:16:51 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 13 Feb 2026 16:06:53 GMT]]>[3.46.0]

  • Update openproject to 17.1.0
  • Full Changelog
  • Work package created for a project initiation request
  • Automatically generated project initiation artifact (PDF)
  • Add new or existing work packages as meeting outcomes
  • Show iCal responses in OpenProject
  • Duplicate agenda items to the next recurring meeting occurrence
  • Release Attribute highlighting to Community
]]>https://forum.cloudron.io/post/120145https://forum.cloudron.io/post/120145Fri, 13 Feb 2026 16:06:53 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 06 Feb 2026 12:27:29 GMT]]>[3.45.3]

  • Update openproject to 17.0.3
  • Full Changelog
  • GHSA-q523-c695-h3hp - Stored HTML injection on time tracking
  • GHSA-x37c-hcg5-r5m7 - Command Injection on OpenProject repositories leads to Remote Code Execution
  • Bugfix: Unable to change to earlier finish date for automatically scheduled successor [#65130]
  • Bugfix: DPA/AVV cannot be downloaded [#67323]
  • Bugfix: hocupocus logs [onAuthenticate] fetch failed and connection to collaboration server not possible [#70542]
  • Bugfix: Wrong sidebar sort order in System Admin Guide -> Authentication [#70914]
  • Bugfix: "form_configuration-status=422" Unable to Change Custom fields in Work Packages without Enterprise Plan [#71093]
]]>https://forum.cloudron.io/post/119784https://forum.cloudron.io/post/119784Fri, 06 Feb 2026 12:27:29 GMT<![CDATA[Reply to OpenProject - Package Updates on Tue, 27 Jan 2026 22:19:49 GMT]]>[3.45.2]

  • Update openproject to 17.0.2
  • Full Changelog
  • Bugfix: Unable to change to earlier finish date for automatically scheduled successor [#​65130]
  • Bugfix: Meeting outcomes cannot be saved with ctrl/cmd+enter [#​69974]
  • Bugfix: AXe Accessibility error: invalid list structure [#​70573]
  • Bugfix: Fix AXe Accessibility error: Navigation toggler must have discernible text [#​70574]
  • Bugfix: Documents module is missing meaningfull html title [#​70614]
  • Bugfix: Users with the "Manage Users" permission did not see links to Lock/Unlock users [#​70796]
  • Bugfix: Cannot authorise OpenProject app with OpenProject when user has 2FA enabled [#​70966]
  • Bugfix: Running docker slim image, runs slim-bim one [#​70980]
  • Bugfix: 'For all projects' project attributes are not displayed during new project creation [#​70982]
  • Bugfix: Fix revision parsing in git diff output [#​71020]
]]>https://forum.cloudron.io/post/119262https://forum.cloudron.io/post/119262Tue, 27 Jan 2026 22:19:49 GMT<![CDATA[Reply to OpenProject - Package Updates on Mon, 19 Jan 2026 14:05:27 GMT]]>[3.45.1]

  • Update openproject to 17.0.1
  • Full Changelog
  • Bugfix: BlockNote: OpenProject work packages are sorted by their ID instead of the last updated by [#​67536]
  • Bugfix: Required project attributes not enforced on POST /api/v3/projects [#​70107]
  • Bugfix: NoMethodError in Storages::Admin::AccessManagementController#update [#​70492]
  • Bugfix: Form Configuration for Work Package Types does not properly validate Enterprise Plan [#​70503]
  • Bugfix: PDF export with custom uploaded logo/fonts fails with some storage configurations (S3) [#​70560]
]]>https://forum.cloudron.io/post/118780https://forum.cloudron.io/post/118780Mon, 19 Jan 2026 14:05:27 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 16 Jan 2026 08:29:56 GMT]]>[3.45.0]

  • Update openproject to 17.0.0
  • Full Changelog
  • Real-time documents collaboration
  • Programs and portfolios for strategic structuring (Enterprise add-on)
  • Better meeting management with draft mode, presentation mode, multiple outcomes, and iCal subscription
  • Updated SharePoint integration with more restrictive permissions (Enterprise add-on)
  • Redesigned project overview with new tabs, configurable widgets, and an improved layout
  • Improved project creation flow with better template selection
  • Option to guard the privacy of users not working in the same project more strictly
  • Updated invitation flow with Primer components
  • Smarter global search including type and status, improving precision in several autocompleters
  • Accessibility improvements with ALT texts and improved chart colors
]]>https://forum.cloudron.io/post/118619https://forum.cloudron.io/post/118619Fri, 16 Jan 2026 08:29:56 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 09 Jan 2026 08:19:19 GMT]]>[3.44.4]

]]>https://forum.cloudron.io/post/118180https://forum.cloudron.io/post/118180Fri, 09 Jan 2026 08:19:19 GMT<![CDATA[Reply to OpenProject - Package Updates on Thu, 11 Dec 2025 13:10:19 GMT]]>[3.44.3]

  • Update openproject to 16.6.3
  • Full Changelog
  • Bugfix: Shared WP inaccessible to non-project members (Error 404) #​68852 [#​68921]
  • Bugfix: User not fully deleted if that user created a recurring meeting [#​69517]
  • Bugfix: No message when using "forgot password" with unknown email [#​69730]
]]>https://forum.cloudron.io/post/116814https://forum.cloudron.io/post/116814Thu, 11 Dec 2025 13:10:19 GMT<![CDATA[Reply to OpenProject - Package Updates on Tue, 02 Dec 2025 13:08:36 GMT]]>[3.44.2]

  • Update openproject to 16.6.2
  • Full Changelog
  • Bugfix: Error when creating a new work package after the previous one is opened in details view [#​67980]
  • Bugfix: OpenID Connect: Claims escaped twice [#​69079]
  • Bugfix: Disable editing of sendmail attributes through UI [#​69577]
  • Changed: Restrict editing of user email addresses to superadmins, rather than "Manage user" permissions
]]>https://forum.cloudron.io/post/116365https://forum.cloudron.io/post/116365Tue, 02 Dec 2025 13:08:36 GMT<![CDATA[Reply to OpenProject - Package Updates on Fri, 14 Nov 2025 07:36:13 GMT]]>[3.44.1]

  • Update openproject to 16.6.1
  • Full Changelog
  • Bugfix: Switching a multi select list cf to a single select cf of projects breaks opening the editing modal on the overview page [#​68040]
  • Bugfix: Updating the formula takes long after "Save" on larger instances [#​68346]
  • Bugfix: When project is copied, work packages with empty mandatory custom fields are not copied [#​68705]
  • Bugfix: Selected project phase doesn't show on wp form if it contains letters from latin extended set or cyrillic alphabet [#​68726]
  • Bugfix: Error message when clicking on Details tab after editing items of the Weighted item list [#​68789]
  • Bugfix: Hierarchy and Weighted Items List CFs cannot be used to filter on project list [#​68794]
  • Bugfix: Short name/Weight are not visible in the 'Edit attribute' modal on Project overview page [#​68802]
  • Bugfix: Error 403 on project dashboard access with news widget [#​68850]
  • Bugfix: Failed to construct 'URL': Invalid URL on saving work packages [#​68935]
]]>https://forum.cloudron.io/post/115359https://forum.cloudron.io/post/115359Fri, 14 Nov 2025 07:36:13 GMT