Leantime - Package Updates
-
[1.14.1]
- Update leantime to 3.9.2
- Full Changelog
- Route Caching - Automatically recovers from stale route cache and corrects an invalid exception import to prevent routing errors (#3523)
- Bearer/PAT Authentication - Fixed Bearer and personal access token authentication by validating against the core token store (#3522)
- Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514)
- API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513)
-
[1.14.2]
- Update leantime to 3.9.4
- Full Changelog
- My Work Across Projects - Fixed an issue that prevented "My Work" from loading tickets across different projects, and exposed and secured the mark-ticket-done action (#3527)
- Bearer Authentication - Resolved a Bearer token error (-32001) that denied every permission-gated API method for mobile and token-based integrations. The Sanctum-guard session stored the raw role integer instead of the role name the permission engine expects (#3525)
- Unified Session Handling - All authentication paths (web login, API key, and Bearer token) now build the user session through a single factory, so the role and two-factor state can no longer diverge between them. This also makes two-factor handling consistent for token-based authentication and adds clearer diagnostics when an unresolvable role is encountered (#3526)
- API Auth Test Coverage - The Bearer JSON-RPC contract tests now run through the real server auth path and cover non-manager roles, catching authorization regressions for non-admin users that owner-only testing missed (#3526)
-
[1.14.3]
- Update leantime to 3.9.5
- Full Changelog
- Mobile API Endpoints - Added session-scoped mobile endpoints for the notifications inbox and calendar (#3529)
- Blueprints Canvas - Fixed a 404 error when adding or editing canvas items (#3544)
- Editor Mentions - The @mention dropdown now appears directly beneath the caret (#3530)
- General Fixes - Resolved several recently reported bugs (#3532)
- symfony/yaml - Promoted to a production dependency (#3543)
-
[1.14.4]
- Update leantime to 3.9.6
- Full Changelog
- Security Hardening - Addressed authorization, SSRF, reset-token, LDAP, and stored-XSS vulnerabilities (#3584)
- Plugin Management - Plugin management now requires the proper permission and install input is validated more strictly (#3583)
- Avatar Rendering - User IDs are now encoded in avatar image sources to prevent DOM-based XSS (#3582)
- API Responses - Credentials are now stripped from getUser API responses (#3556, #3576)
- Content Templates - Introduced a generic content templates domain (#3493)
- My Day Schedule API - Added a getMyDaySchedule API endpoint that respects work hours and timezone (#3579)
- Personal Access Tokens - Added shared AI/MCP support classes and personal access token management (#3560)
- Domain Events - Added class-based domain events and filters with a legacy-string plugin bridge (#3503)
- Project Roles - Fixed user role inheritance when adding a user to a project (#3580)
- Kanban View - Fixed a rendering error caused by an undefined variable in the kanban view (#3554)
-
[1.14.5]
- Update leantime to 3.9.7
- Full Changelog
- Personal Access Tokens - Completed the move of personal access token management into core with a dedicated token controller and language keys (#3597)
- MCP Domain Tools - Reorganized MCP tool classes into their respective domain modules (#3581)
- Program Board - Fixed milestones, kanban rendering, and status rollup clarity on the program board (#3592)
- MCP Runtime - Repaired runtime bugs in domain tools uncovered during live end-to-end testing (#3586)
- System Update - System updates now properly clear cached bootstrap manifests.
- General Fixes - Resolved a batch of recently reported bugs (#3540, #3331, #3310, #3589, #3330, #3546, #3593)
- API Rate Limit - Raised the default API rate limit from 10 to 120 requests per minute (#3591)
-
[1.14.6]
- Update leantime to 3.9.8
- Full Changelog
- Milestones - Fixed reports showing 0% completion and the timeline "Show Tasks" view displaying nothing (#3624, #3625, #3628)
- Milestone Modal - Resolved focus loss, restored save-and-close, and fixed a 500 error when saving goals (#3605)
- To-Dos - Kept To-Dos from closed projects browsable once the project is reopened (#3626, #3627)
- Post-3.9.7 Regressions - Fixed a file browser out-of-memory issue, strategy grouping, and 403 errors for legacy roles (#3621)
- MCP Endpoint - The /mcp endpoint now accepts Leantime API keys, and a shim for the removed php-mcp provider lets in-place upgrades boot (#3601, #3602, #3607)
- Program Board - Moved the card status dropdown below the field row (#3599)
- Sessions - Isolated sessions into their own Redis database to avoid clashes with other cached data (#3604)
- Bumped the McpServer submodule to include the bulkAddTasks fix (#3620, #3622)
- Synced composer.lock content hash with composer.json (#3603)
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login