Changelog

Chat (menu Common → Chat): rooms with chosen users and groups, and direct messages to any user, readable by their participants only, administrators neither. Messages with formatting, files of any type (stored in the data transfer), emoji reactions, threads that can be followed and marked unread, and @ mentions notified in the app and by mail. Confidential messages in direct messages are end-to-end encrypted and never stored by the server. Behind a reverse proxy, the chat needs an unbuffered connection, see the administration guide.

Search: search and selection boxes ignore accents and German umlaut spellings ("Mueller" finds "Müller", "Strasse" finds "Straße"), completely after the next nightly re-index; deactivated users are no longer found in the search of the main menu.

Administration: the backup script of the administration guide compresses the dump of the files to about half the size.

Fixed: the order and invoice caches refreshed each other endlessly when an invoice referred to a deleted order position; projects are found by their number and the name of their customer; outgoing invoices saved in the new interface are found by their customer at once; the time sheet filter for sub structure elements can be switched off; postal codes like "D-34286" are no longer linked as JIRA issues; the log of a running script is shown again.

Chat: confidential messages in direct messages (e.g. for a password), end-to-end encrypted in both browsers, relayed live and never stored by the server, shown to the recipient only once.

Chat

Chat: a file of a message can also be opened in its data transfer area, besides downloading it.

Chat: a message can be marked unread, threads with unread replies are marked, and in a thread a line shows the first unread reply.

Search and selection boxes ignore accents and German umlaut spellings: "Andre" finds "André", "Mueller" and "Muller" find "Müller", "Strasse" finds "Straße", and vice versa. Applies to entries indexed after the update, i.e. completely after the next nightly re-index.

Admin guide: the backup script compresses the dump of the files (about half the size), because pg_dump writes their contents hex encoded.

Outgoing invoices: invoices saved in the new interface were not found by the name of their customer until the next search index rebuild.

JIRA links: an issue key needs at least two leading uppercase letters, so a postal code like "D-34286" in a text is no longer linked as an issue.

Project selection: projects are also found by their number (e.g. 7.002) and by the name of their customer.

Scripts: showing the log of a running script could fail with an error.

Time sheet list: the filter including all sub structure elements could not be switched off. It is replaced by the filter "without structure sub elements", off by default.

The order and invoice caches no longer refresh each other endlessly (e.g. during the daily order book snapshots) when an invoice refers to a deleted order position.

Search in the main menu: deactivated users are no longer found (they still are in the user list).

Ad hoc bookings: who may edit the time sheets of others on a structure element grants colleagues the booking of own time sheets for a period, optionally restricted to some cost units; the colleagues see only the granted structure elements. Employees without this right may propose such a booking, the project management accepts the time sheets afterwards (reminded by a new notification rule).

Notifications: delivery steps by SMS; new rule "Creditor invoices due"; the rule editor lists the variables for subject and text with example values and a copy button, the preview shows the texts with example values.

Creditor invoices: marked as overdue already 2 working days before the due date.

Time sheet form: the recently used entries show the consumption of their budget and can be sorted, filtered and arranged per column (remembered per user); the consumption bar tooltip shows budget, booked and remaining person days.

Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree or found by the same title.

Order statistics: the bubble size of the contribution margin chart shows the contribution margin; titles can be switched on.

Fixed: structure elements created or moved during a background reload could vanish from the structure tree, the responsible person was missing after a change; an invalid search syntax shows a hint instead of an empty list; the info of a structure element is only answered to users who may see it; the password reset mail is limited per user, per client and in total, so it can no longer be requested over and over.

Ad hoc bookings

Consumption bar (structure tree, task list, time sheet form): the tooltip shows the budget, the booked and the remaining person days as a calculation, an overbooked budget in red.

Time sheet form: the recently used entries show the consumption of their budget, and the search also matches it.

Creditor invoices

Notifications

Time sheet form: the table of recently used entries can be sorted and filtered per column, its columns can be reordered, resized, pinned and hidden; the layout is remembered per user.

Notifications: delivery steps by SMS to the mobile phone number of the recipients (if SMS is configured), with an own SMS text of the rule or otherwise the subject and the link.

Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree (the title may differ, e.g. "ACME" for "ACME Inc.") or found automatically by the same title.

Order statistics, contribution margin bubble chart: the size of a bubble shows its contribution margin instead of its costs. The switch "Show titles" labels the own bubbles with their short title and contribution margin %; switched off, the names are in the tooltip only.

The info of a structure element (title, path, project, customer, consumption) was answered to every logged-in user; now only to users who may see the structure element.

Structure tree: a structure element created or moved while the tree was being reloaded in the background could vanish from the tree until the next reload, so no sub-element could be created below it ("Parent structure element is required but not found").

Structure tree: after a structure element was changed, its responsible person was missing in the tree until the next reload.

Password forgotten: the reset mail is limited per user, per client and in total, so it can no longer be requested over and over (mail bombing, invalidating a pending reset link).

Lists: a search term that isn’t a valid search syntax (e.g. "Project: Alpha") now shows a hint instead of an empty list without explanation.

Contribution margin: the order statistics break it down by orders and structure elements (a tree with a monthly chart per row) and show a bubble chart of revenue, contribution margin % and costs per project, project group, customer or customer group, in the colors of the business units.

Former React interface removed: all its pages are part of the new interface, old links (/react/...) lead there.

Security: the CSRF token is checked for every changing request of a logged-in session; changing requests (filters, templates, search index, logout, cancelling a login) are accepted as POST only; history comments need update access; npm dependencies updated.

Fields with several entries: entries can be selected, copied, cut, pasted and dragged into another field of the same kind; Ctrl/Cmd+Z undoes a change.

Administration: structure tree and list show the groups with access rights on an element; the time sheet mass update remaps the cost unit by type, keeping the structure element.

Polls: templates have the state "Template" and no deadline.

Fixed: import of incoming invoices (currencies, periods, header-only exports); cancellation invoices listed with the positions they cancel; the order edit page no longer jumps; the mass update log shows the updated entries again.

Order statistics, contribution margin: bubble chart of revenue, contribution margin % and costs (size) per project, project group, customer or customer group. On request, the other projects of the selection (e.g. of the whole business unit) are shown for comparison, anonymously. The bubbles take the colors of the business units, set with the business units (customer groups page). A switch labels all bubbles with their short title instead (the group name, for a single project its short name).

Fields with several entries (users, groups, employees, …): entries can be selected by sweeping over them with the mouse or by clicking, then copied (Ctrl/Cmd+C) or cut (Ctrl/Cmd+X) and pasted into another field of the same kind with Ctrl/Cmd+V, or dragged there. Ctrl/Cmd+Z undoes a change of the field.

Structure tree and structure element list: column with the groups having access rights on an element (administrators only). Hovering shows the rights of each group, a click opens the access rights of this element.

Time sheet mass update: remap the cost unit by type while every time sheet keeps its structure element, e.g. after a project was linked to it.

Order statistics: the contribution margin broken down by orders and by structure elements, as a tree with a monthly chart per row. The values are calculated from the invoice positions and the time sheets × hourly rate; what can’t be assigned stays with the project as residual.

Polls

Import of incoming invoices

Mass updates: the log window shows the updated entries again.

Cancellation invoices are listed with the order positions they cancel, right after the cancelled invoice (e.g. 17400 and 17400-S), also in the order and forecast exports. On the order page both are struck through; together they still count 0 as invoiced.

Order book: the edit page no longer jumps while a field is changed.

The former React interface is removed: all its pages are part of the new interface, and old links (/react/...) lead there.

The CSRF token is checked for every changing request of a logged-in browser session, no longer only for requests identifying themselves as the new interface; cancelling a login or password reset is accepted as POST only.

Appending a comment to a history entry needs update access to the entry’s object, and is only possible for objects supporting comments (users, groups).

npm vulnerabilities in projectforge-next fixed: next 16.4.2, dompurify 3.4.17 and vitest 4.1.12.

Requests that change something (list and calendar filters, templates, search index, logout) are accepted as POST only; the GET variants of the former React interface are removed.

New interface: bank accounts, transactions and their import (a page of its own with a preview of the differences), visitor book (offers visitors already recorded, filter of incomplete visits), memos, Merlin Word® templates and the job monitor migrated; the Sipgate actions are a menu of the System page.

Project groups: projects of a common parent project are combined into a group on the customer groups page; the project filters offer the group like a single project, forecast, contribution margin and the Excel exports show a project group column.

Import of incoming invoices: no longer overwrites other invoices of the same creditor, keeps invoices with surplus positions, takes paid date and amount paid from the position import, reads German tax rates of DATEV files correctly and shows what changed in a modified row; the comparison and the preview of large files are much faster, and the page stays open after committing.

Configuration: parameters with JSON values can be edited as text and compared with every former version.

Old links: links to pages of the former interfaces are only forwarded if they were sent by mail or shared (orders, to-dos, vacation, data transfer, polls, password change); other bookmarks should be renewed. The 2FA dialog of the old interface is removed.

Improved: list filters with a checklist offer "choose from all"; project wizard with tabs and a summary of what will be set up; mass updates link their log again; deactivated users struck through.

Fixed: calls from an external phone via sipgate; project and cost unit numbers of number ranges without configured segments; structure element fields show a renamed or moved element right away; amounts with two decimal places and currency.

Configuration parameters with JSON values

Project groups: projects belonging together under a common parent project can be combined into a group on the customer groups page. The project filters of the order book, invoices, projects, cost 2, timesheets and order statistics offer the group like a single project; forecast, contribution margin and the Excel exports of the forecast, order book and invoice list show a project group column as soon as one of their projects belongs to a group.

Visitor book: while a new visitor is entered, the name offers the visitors already recorded with it; picking one adds the visit to that visitor instead of creating a duplicate. The company names in use are completed, and the dialog of the first visit opens right after a new visitor is saved.

Visitor book: a pinned filter shows the visitors with incomplete times of visit, e.g. a departure not entered yet. After a visit is saved, the list is shown again.

List filters with a checklist (customer, project, business unit): they say that they only narrow the current result, are narrowed by the list’s search term as well, and offer "choose from all" to pick values the current result doesn’t contain. In the time sheet list they offer values without a period, too.

Sipgate: downloading the configuration, synchronizing and resetting the contacts are now a menu of the System page (shown if Sipgate is configured); the separate Sipgate page and its menu entry are gone. While an action of the System page runs, a progress bar shows; the contact sync no longer reloads all synchronized addresses.

Structure element fields: a click on the selected structure element opens the tree, like the pencil button. Order positions show the consumption bar of their structure element, which leads to its time sheets.

User list: deactivated users are shown struck through.

Mass updates of time sheets, invoices, incoming invoices, projects, addresses, access rights and liquidity entries link their log again: the log viewer shows what the run changed.

Banking

Import of incoming invoices

Creditor invoices: the old upload page of the CSV import has been removed; the import runs in the new interface.

Job monitor migrated to the new interface: running and recently terminated background jobs with their progress, cancelling asks for confirmation first. After an import the page returns to the import once its job has finished, but only to a page of the same server. Old links are redirected.

Memos migrated to the new interface: list and form. A memo stays visible to its owner only.

Visitor book migrated to the new interface: list with the latest visit and the number of visits, form with the contact persons, visits entered in a dialog (preset with today and the current time). Deleting the last visit of a visitor no longer fails, and a visit can no longer be assigned to another visitor. Old links are redirected.

The classic version of the address campaign values (list, mass update and the address form opened from it) has been removed; the new interface covers everything.

Merlin Word® templates migrated to the new interface: list, admin form with the variables and the execution, single and serial.

Links of former versions

Import of incoming invoices

Number ranges: a range with customers and without configured segments shows its project and cost unit numbers by its digits (e.g. 7.0001.0 for one project digit) instead of 7.000.10.

Project wizard: tabs and a pinned action bar as on the edit pages; the action step lists what will be set up (new customer, new project, path of the new structure elements, access rights) and what is still missing; the finish button is always clickable, and a progress bar shows while the setup runs.

Phone call: calls from an external phone without an assigned number were refused by sipgate.

Structure element fields show the new name and path right after a task was renamed or moved, without a reload.

Amounts

The import of incoming invoices shows what changed in a modified row: the old and new value in every compared column, the gross amount included, and the changed fields without a column of their own (e.g. the paid date of a position-based file) in the status cell.

Groups and team events no longer offer a link to the old interface: its pages no longer worked.

Job monitor: the cancel button of a job is only offered to users allowed to cancel it; others saw a button without effect.

The 2FA dialog of the old interface was removed: a second factor for protected actions is only asked for in the new interface. Pages of the old interface get an access denial instead, old links lead to the start page.

Security: changing, deleting and restoring an entry is decided by the stored entry, not only by the posted one; stricter Content Security Policy and new security headers; requests that change something are sent as POST; more pages require the second factor of their area; QR codes are no longer delivered as image links.

Customers: creating, changing and deleting customers needs the new user right "Customers" (finance); being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard also works with only one of the rights for customers and projects.

Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including invoices, forecast and contribution margins.

Configuration: config.xml is replaced by configuration parameters with their own editors (holidays, JIRA servers, contract types, accounting settings) and taken over automatically on the first start; projectforge.properties can be compared with its backups.

New interface: polls (reworked, with templates and a results tab), contracts, currency pairs, skill matrix, inbox and outbox, two-factor setup, customizing the menu, e-invoice checker and birthday butler migrated.

Removed: the d.velop interface.

Fixed: the forecast of the current month adds the invoiced figures and the remaining forecast, the plan is the order book of the planning date (deleted orders corrected); sorting customers by number; a damaged JCR repository no longer prevents the start when files are stored in the database.

Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including their invoices, forecast and contribution margins (new tab in the customer groups editor).

System page: projectforge.properties can be compared with its backups, or two backups with each other. Optionally the order is ignored, so only changed values and comments are shown; values of secrets stay hidden, only whether they changed is shown.

Customize my menu: migrated to the new interface. Entries are dragged or clicked into the own menu, groups can be added, renamed and removed; empty groups are no longer stored as broken entries.

When arranging chart dashboards, the drag handle (top left of a tile) and the tile menu (top right) are shown in solid orange.

E-invoice checker: migrated to the new interface. Validity, invoice data, seller, buyer and amounts are shown side by side, amounts in the invoice’s currency; embedded attachments are downloaded with a click.

Notifications to be confirmed: several of them are shown underneath each other in one toast instead of stacked behind each other, and the toast steps aside while the bell’s list is open.

Birthday butler: migrated to the new interface. The current month is preselected, and without a configured organization the page says so instead of offering a download that can only fail.

Two-factor authentication setup migrated to the new interface: mobile phone, authenticator app and WebAuthn tokens on one page, a token is renamed or deleted in a dialog. Deleting a WebAuthn token now also requires a recent second factor. Old links are redirected.

config.xml replaced by configuration parameters

Contracts migrated to the new interface: list with a period filter on the date, form with suggestions from other contracts, the configured contract types, JIRA links, attachments and cloning. A year filter stored by the former list is still shown and can be removed. Old links are redirected.

Customers: new user right "Customers" (finance), like the one for projects. Creating, changing and deleting customers needs it with read and write access; being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard needs it for new customers.

Polls migrated to the new interface and reworked: list, form and answer page, questions reordered or taken from templates (built-in ones or own polls marked as template), polls cloned, a results tab beside the Excel export. Attendees and full access also by group (later members included). Multiple choice questions accept several answers again, answers stay with their question when questions change. Only users with full access see the results; finished polls can no longer be answered or changed, and their end is mailed once. Old links are redirected.

Inbox and outbox migrated to the new interface: list and form, with the autocompletion of the free texts. Old links are redirected.

Customer wizard: also usable with only one of the rights for customers and projects. With the right for customers only, a new customer is created (and optionally its structure element); with the right for projects only, a project is set up for an existing customer. With both, "No project" creates the customer only. The groups and their access rights are optional, and no group is preselected any more.

Skill matrix migrated to the new interface: list and form, ratings as stars, the Excel export of the statistics in the list, and a mass update of rating, interest and comment. Old links are redirected.

Currency pairs migrated to the new interface: list with the rate valid today, form with the conversion rates of the pair, edited in a dialog directly in the form. For a new rate, the rates of both directions are proposed from the online source for its date; the rate valid today is marked, rates still ahead are shown muted. Old links are redirected.

Customer list: sorting by the customer number works again.

Forecast of the order statistics and its Excel export: in the current month, the invoiced figures and the remaining forecast are added (as well as the invoices and the forecast of the plan), instead of taking the greater value. The cumulated forecast and plan now match the sums of the project overview. The note on this in the Excel sheet 'Grafiken 1' is removed.

Forecast plan: the plan is the order book of the planning date. The forecast charts of the order statistics now include the orders deleted since, as the Excel export does. Orders already deleted on the planning date are no longer part of it: daily (incremental) order book snapshots kept the orders deleted since the beginning of the month. This is corrected for existing snapshots as well.

Files: with projectforge.files.store=db, a JCR repository that can’t be opened (e.g. damaged) no longer prevents the start. ProjectForge starts without it and logs an error; files not yet migrated out of the JCR are missing then, and the migration, backup and sanity check of the JCR are skipped.

Lists migrated to the new interface ignore columns and a sort order stored by the old list for columns it no longer has; columns missing from a stored order appear in their usual place instead of at the end.

Properties editor: values of all parameters ending in "key" (e.g. projectforge.receiveSmsKey) are treated as secrets and no longer shown.

The d.velop interface (synchronization of customers and vendors as trading partners) was removed.

More pages require the second factor of their area: the imports of salaries, incoming invoices and bank account records, the upload of incoming invoices, the bank accounts, currency pairs and conversion rates, the customer groups and the project wizard (finance), as well as the structure wizard, the caches and the Sipgate page (administration). The system statistics no longer require the second factor of the administration.

The QR codes of the authenticator key (two-factor setup), of the REST client token (my account) and of the calendar subscriptions are sent within the response instead of as an image link, so the secret or token no longer shows up in access logs. QR code images are not cached anymore. The WebAuthn options no longer contain the session id, and changes of the two-factor setup check the CSRF token themselves.

Security hardening

Customer wizard: sets up customer, project with cost 2 types, structure element and groups with access rights in one step, with a preview; group names follow a configurable naming convention.

Projects: a contact person and any number of further ones, as in orders, replace the project manager, the head of business manager and the sales manager (migrated).

Data transfer: the external access of an area has moved to the new interface; areas with external access are administered on the internal instance and synced to the gateway.

Administration: editor for projectforge.properties with descriptions, defaults and a backup before every save; functions can be switched off by configuration (menu entries gone, pages and REST services 404).

Vacation: leave account entries migrated to the new interface; vacation and absence entries can be edited as the other kind.

DATEV import: one upload fills both accounting records and chart of accounts.

Fixed: saving a changed entry in the new interface no longer empties its creation date (lost dates restored from the history); menu visibility with a list of several groups works.

Switching off functions

Groups: a configurable naming convention (configuration parameter "Group nomenclature": description, pattern of customer and project fields, suffixes per role, letter case). The project and structure wizards suggest the names of new groups following it, and its description is shown at the name of a group and in the wizards.

Customer wizard: sets up a project in one go – the customer (an existing one or a new one), the project with its cost 2 types, its structure element below a chosen one, and the groups of team, managers and externals (existing ones or new ones with their members) with their access rights, shown in a preview before anything is saved. Available to users who may create customers, projects and structure elements, who may create groups and access rights through the wizard as an exception. Offered on the customer list, the project list, the structure tree and the task list.

Vacation and availability: an entry can be edited as the other kind ("Edit as absence" / "Edit as vacation"), like time sheets and calendar events (now "Edit as event" / "Edit as time sheet", formerly "Switch to …"). Person, period, comment and substitutes are taken over into a new entry, created only when it is saved; an entry already saved stays as it is. The button’s tooltip says so.

Administration → System: editor for projectforge.properties. All parameters grouped by topic with descriptions and defaults, search, secrets masked. Before every save a copy of the file with a timestamp is written; changes take effect after a restart.

Availability entries: the location of a new entry is no longer preset to remote, and an empty type or location is shown as "Not specified". New type "Mobile Tätigkeit" (mobile activity) for working remotely without a workation; installations with their own list of types (projectforge.availability.types) add it there.

DATEV import: one upload of the tax office’s file fills both tabs, accounting records and chart of accounts, so each can be reconciled without uploading the file again.

Data transfer with a gateway

Data transfer: the external access of an area (login with the area’s password, then its files) has moved to the new interface. The area’s link now points there; links sent before lead there as well. As in the area itself, a click on a file opens its details (read-only for files of others), the files are sorted newest first, and the column layout is kept (in the browser). Own uploads can now also be encrypted. External users no longer see who uploaded the other files unless they are logged in to ProjectForge as well and have access to the area there (who also see its activities), and can no longer rename files of others. Logging in to or out of the external access no longer ends a login to ProjectForge in the same browser.

Projects: a contact person plus any number of further contact persons, as orders have them, replace the project manager, the head of business manager and the sales manager (migrated: the project manager becomes the contact person, the others further contacts). All contacts have the same access to the project and its orders and invoices; the project list shows them in one column, the mass update sets the contact person, and picking a project in an order prefills its contacts.

Leave account entries (corrections of the leave account) migrated to the new interface: list and form. HR staff can add a correction for the employee shown directly in the vacation account; a correction opened there returns to it. Old links are redirected.

Menu visibility (projectforge.menu.visibility.*): a list of several groups works, separated by comma or semicolon (only a single group was recognized, a list not at all).

Saving a changed entry in the new interface no longer empties its creation date. The date of the last change is always set by the server. Creation dates lost this way are restored from the history.

Employees: list and form in the new interface; status, weekly hours and leave days edited in dialogs.

Cost search: in the new interface, also as a movable panel on every page (Alt+K) or a small window of its own.

Edit forms: "Create" for a new entry, "Save" for an existing one; saving never creates a copy.

Availability: "Reachable if urgent" merged into "Reachable if needed"; the public comment, shown in red in the form, is visible to the team, also in the tooltips of the absence charts.

Website: German version of the pages, FAQ, changelog and guides at projectforge.org/de.

Invoices: an invoice with deleted positions only can be deleted and restored again.

Website: German version of the pages, the FAQ, the changelog and the user, administration and quick start guides at projectforge.org/de, with a language switch; the help link of the search field opens the German user guide for German users.

Availability: "Reachable if urgent" is merged into "Reachable if needed". The comment of an entry is called "Public comment" and is shown in red in the form; every team member who sees the entry sees it, also in the tooltips of the absence charts (e.g. the chart of a vacation’s substitutes).

Cost search: migrated to the new interface. Its menu entry shows it as a movable panel over the current page, which stays open on every page (also via the button in the top bar or Alt+K; the position is remembered). It can also be opened in a small separate window.

Edit forms: a new entry is saved with "Create", an existing one with "Save". Both are separate writes: saving an existing entry can no longer create a copy of it, and creating one never overwrites an existing entry.

Employees: the list and the form of the employees are migrated to the new interface. Status, weekly working hours and annual leave days are edited in dialogs directly in the form; the entry valid today is marked, entries still ahead are shown muted.

Invoices and incoming invoices: an invoice stored earlier with deleted positions only can be deleted and restored again; only saving it is refused.

Address campaigns and accounts: saving an existing entry in the new interface no longer adds a copy of it (e.g. setting a campaign inactive); campaign titles are unique.

Orders and invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.

Further fixes: search term of multiple choice selection boxes, column headings of the availability entries in the leave account, build date in the footer.

Address campaigns and accounts: saving an existing entry no longer creates a copy of it (e.g. when setting a campaign inactive). A campaign’s title must not be taken by another campaign.

Footer: the build date is shown without a zone suffix (2026-10-19 instead of 2026-10-19Z).

Orders, invoices and creditor invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.

Selection boxes with multiple choice: after a pick the search term stays selected, so typing the next name replaces it instead of being appended to it.

Leave account: the columns type, availability, location and comment of the availability entries show their headings instead of text keys.

Addresses: list, view and form migrated to the new interface, with vCard import, takeover from pasted text, exports, mass update and the favorite star in the list; the address books are migrated as well.

Address campaign values: migrated to the new interface, with a comparison campaign (e.g. last year’s) whose values can be adopted in the mass update or the form; campaigns can be set inactive.

Availability: new entries for periods of reduced availability (e.g. parental leave, workation) with substitutes and conflicts, shown in the calendar, team calendars, the team vacation calendar and a quick view of the next weeks.

Vacations of others: visible to the members of the person’s groups from 1 January of the current year; the team vacation calendar picks users, freelancers included.

Customers and projects: system-wide unique project numbers, usable without cost units, configurable number ranges with the next free number offered.

Selection boxes and lists: inactive entries only on request, name matches first and found by parts of the name, long lists ask for a search term; inactive entries struck through thin and grey in lists.

Further: notification rules end their pending notifications when deactivated and choose the target of "Open", script editor compares versions, exchange rate API tested on the system dashboard, new test data for the setup.

Fixes: approval of vacations by managers, absences in team calendars on the gateway, banners of manual notification rules, consumption bar of the time sheet form, events converted into time sheets, outdated list requests.

Availability

System dashboard: the exchange rate API is tested daily and shown as an interface tile, so that a change of the API is noticed early. The test can be started at once in the scheduler tab.

Address campaign values: a comparison campaign (e.g. last year’s) shows its values and comments beside the selected campaign’s, with filters on its values and on the differences. Its values can be adopted for a selection in the mass update or one by one in the form. Address campaigns can be set inactive: their values can’t be changed any more.

Availability at a glance

Script editing: a "Show changes" button in the code editor’s toolbar compares two versions of the code side by side (inline on small screens): the code being edited, the stored version or any of the script’s backups.

Selection boxes (groups, users, employees, addresses, address books, accounts, bank accounts): entries whose name matches the search term are listed first, before entries found only by other fields such as organization or email. Groups, user names, projects, customer identifiers, address books, calendars and bank accounts are also found by parts of their name, e.g. PF_Controlling by "controlling".

Selection boxes of users and groups: deactivated or deleted users and groups are shown struck through, in the picked values as in the search results.

Lists: ended projects and no longer active customers are struck through, as in the selection boxes. Entries that are no longer active but not deleted (ended projects, inactive customers, cancelled invoices, rejected or replaced orders, inactive notification rules, deactivated references) are now struck through thin and grey, distinct from deleted entries, each with its own legend entry.

Monthly report: when the configuration parameter "Report time sheets without Kost2?" is enabled, entries booked without Kost2 are marked, in the view as in the PDF export.

Selection boxes

Team vacation calendar: people are picked as users, and the members of a chosen group are shown also without an employee record (e.g. freelancers), with their availability entries, in the chart and the Excel export. Choices and favorites stored before are taken over.

Addresses

Addressbooks: the list and the form of the address books are migrated to the new interface. The list shows the users and groups with full and read-only access in columns of their own.

Lists: for entities with fewer than 100,000 entries, the gear menu offers only the full re-index of the search index, for every user — it takes just seconds there. Larger entities keep the re-index of the newest entries, and the full one for administrators.

Notification rules

Setup with test data: new, larger sample data (customers, projects, orders, invoices, half a year of time sheets, vacations, calendar, liquidity planning) with dates relative to the day of the setup. The sample users get the admin password. The setup page shows the progress. The default plugins are active right after the setup, without a restart.

Vacations of others: the members of the person’s groups see them from 1 January of the current year on (before: up to 31 days after their end), in the calendar, team calendars and their subscriptions alike. Manager and substitutes of a vacation, HR and finance staff see all of it, now also in the vacation list (HR staff with read-only access, finance and controlling included). The team vacation calendar shows the availability entries of others to finance staff as to anybody else: of the members of their groups, from today on.

Customers and projects independent of cost units

Selection boxes for users, employees, projects, customers and cost units no longer offer inactive entries (deactivated users, employees who have left, ended projects and customers). A "Show inactive" checkbox in the selection box brings them back; for users and employees it is available to HR, finance, organisation and administrators only. An inactive entry already set stays selectable.

Address campaign values: list, form and mass update migrated to the new interface. The address opens in a dialog from the organization and address columns; the previous page stays available as the classic version.

Time sheet form: the consumption bar of the task is up to date after booking and no longer counts deleted time sheets.

Notification rules

Order statistics: on a low screen (e.g. a phone in landscape) the page scrolls, so the charts can be reached.

Vacations: managers can approve and reject vacations again; entries stored without half day information were refused with a missing HR right.

Calendars pushed to the gateway: a team calendar including absences is generated for each user and shows exactly the absences this user may see; before, it could show those of another user with the same access to the calendar.

Converting a calendar event into a time sheet: an event ending on another day no longer produces a time sheet spanning several days ("Maximum duration exceeded"); the end time is taken on the start day.

Lists: after quickly paging back and forth (e.g. a year back and forth again), a list could come back from an entry with the filter paged past, when its outdated request was answered last.

Users: list and form migrated to the new interface, with rights adapting to the assigned groups at once, tokens renewed and devices logged out from the form and passwords changed in a dialog; alternative e-mail addresses of other users are rejected.

Team calendars: list and form migrated to the new interface, with the subscription link in the form and the subscriptions of time sheets, weeks of year and holidays in the export menu.

Team vacation calendar: the vacations of the chosen employees and groups shown per quarter or year with adjustable day width, printable in page width, choices saved as favorites; users without HR or finance rights choose from their own groups only.

Vacations: days bar in the vacation account, long vacations squeezed into the bar; the vacation list of users without HR or finance rights shows only the vacations relevant to them.

Time sheets without Kost2: optional hint on saving and a daily notification rule, switched on by a new configuration parameter; the configuration list can be filtered by category.

System dashboard: muted, ignored and resolved problems can be listed from the counts of key figures and subsystem tiles.

Fixes: rights changed together with groups, stricter access checks, carry-over and mails of vacations, Excel export and automatic booking of vacations, contribution margin for contacts of orders, width of the calendar edit dialog.

Time sheets without Kost2

Calendar: the edit dialog of time sheets and events is no longer stretched over the whole width of large screens.

System dashboard: muted problems can be listed with their own status filter, a click on the muted, ignored or resolved count of a key figure or subsystem tile lists exactly these problems, and a problem leaving the list after a status change can be shown again from a notice.

Users, alternative and former e-mail addresses: an address already used by another user is rejected, the primary address isn’t stored twice.

Vacation account: days bar

Team vacation calendar: the vacations of the chosen employees and groups are now also shown on the page, per quarter or calendar year, with an adjustable width of the days (up to fitting the whole period into the window); the Excel export starts with the period shown, and the calendar can be printed (or saved as PDF) in the width of the page. Choices of employees and groups can be saved as favorites. Users without HR or finance rights choose from their own groups only and no longer see previous years. Vacations beginning before a sheet of the Excel export are now shown on it, too.

Calendars: the list and the form of the team calendars are migrated to the new interface. A stored calendar shows its subscription link with a switch for the reminders, the list offers the subscription of time sheets, weeks of year and holidays in its export menu.

Users: the list and the form of the user administration are migrated to the new interface. The rights offered adapt to the assigned groups at once, and tokens can be renewed and devices logged out directly from the form; passwords are changed in a dialog, here as on the own account page.

Vacation list: users without HR or finance rights see their own vacations, the ones they approve or substitute for, and the vacations of their substitutes overlapping their own ones, no longer all current vacations of their group colleagues.

Contribution margin: contact persons and additional contacts of an order see the contribution margin of its project, as in the order book. The access check of orders no longer loads their positions and payment schedules one by one, e.g. for the forecast chart and the contribution margin.

Users: rights changed in the same save as the groups are now stored correctly. A right set together with joining a group was lost, and a right of a group the user left stayed set.

Vacations: stricter access checks (a manager can no longer be swapped in on running or past entries, deleting and restoring use the stored entry and restoring is validated again, the vacations of replacements always count as conflicts, shown with dates and status only where the user may not read them otherwise, leave account corrections need write access); the remaining leave of the previous year is credited correctly for vacations crossing the end of the carry-over period and recalculated after later changes; special leave counts in the collision check; rejected vacations no longer appear in calendars and subscriptions; the comment is no longer mailed to replacements, and removed managers and replacements are notified. Excel export: weekends and holidays inside a vacation, half days and half working days are shown correctly, approved vacations win over those in progress. Automatic vacation booking of time sheets: days no longer covered by a vacation are removed, an unbookable vacation task fails the run instead of skipping days, the next successful run books all days missed since, and days are booked by the user’s time zone. The vacation account loads faster. Team vacation calendar: readable by screen readers, the stored choice is no longer overwritten by an outdated page state.

Leave applications: list and form migrated to the new interface, with bars over the calendar days showing the days without any substitute, a year filter paging back and forth and the days left updated while editing.

Leave account: migrated to the new interface, with the next year in the statistics and leave applications without any substitute marked red.

Lanes & Planes: the active employees are pushed with their cost centers, cost units and creditor account, safeguarded against suspiciously small user lists and email changes; employees have a new field creditor account.

Users: new fields alternative and former e-mail addresses, searchable and in the Excel export.

Data transfer: files in the file system are compressed and can be encrypted at rest (AES-256).

Passwords: change password and change WLAN password in the new interface; a wrong old password counts as failed login attempt, and a password change ends the user’s other sessions.

System administration: system statistics load at once, copy & paste samples for the alert message; the Docker image is based on Java 21.

Fixes: contribution margin by booking period, year filter of leave applications and contracts, lists returning with an outdated filter, sorting of the vacation list, rejected leave applications in the vacation export, cost unit cache refresh in the time sheet form, phone lookup key and CSRF check of force delete.

Employees: new field creditor account (the DATEV account of the employee, e.g. for travel expenses), also shown as a column in the list and in the Excel export.

Lanes & Planes interface

Data transfer: files stored in the file system are compressed and can be encrypted at rest (AES-256, key in projectforge.files.fileSystemEncryptionKey), so backups of the file system don’t contain them in plain text.

Users: new fields alternative and former e-mail addresses (comma separated, e.g. after a change of name), also searchable and in the Excel export.

System administration: two copy & paste samples for the alert message (maintenance, new release), with the next full hour and the next release filled in.

Change password and change WLAN password are pages of the new user interface and show when the password was last changed.

System statistics

Leave account

Leave applications

Leave applications

Docker image: based on Java 21 (Eclipse Temurin 21 JRE) instead of Java 17. ProjectForge still runs on Java 17 or newer.

Contribution margin (order book and scripts)

Time sheet form: choosing a task could fail now and then with "Session/EntityManager is closed" while the cost unit cache was being refreshed.

Lists

Security

Vacation export

Vacation list: sorting by the status or the days column had no effect.

Year filter

Changing the own password or WLAN password: a wrong old password counts as failed login attempt and locks further attempts for a while, like the login does.

A password change (own, by an admin or by a password reset) now also ends the user’s other open sessions, not only the stay-logged-in devices. The session the own password was changed in stays logged in.

Vacation: a nightly job books past approved vacation days without time sheets, enabled on the configuration page; unbooked vacation days count again as days without time sheets in the monthly report and the notifications, listed separately and bookable with a click.

Configuration: parameters grouped by category, showing who may see and change each one; the former vacation settings of projectforge.properties are taken over once.

Admin log viewer: a tab of the system dashboard; search in the log files of the last days, the context of each entry inline, customizable tables.

System dashboard: hanging cache refreshes and scheduler runs can be terminated, blocked database statements time out, a failed cache refresh is retried after a minute at the earliest; the last successful run of a job is shown.

My account: migrated to the new interface, with the devices staying logged in, the usage of access tokens and longer GPG and SSH keys.

Notifications: new rule for passwords not changed for a given number of days.

Changelog: the releases of a major version newest first.

Fixes: exchange rate suggestions, JCR migration in the packaged application, sorting of the Merlin template list.

Admin log viewer

System dashboard

Approved vacation can be booked as time sheets automatically: a nightly job books the past vacation days without any time sheet on the configured vacation task and cost unit, never in advance and never further back than its last successful run, so a deleted vacation time sheet isn’t booked again. Finance and controlling enable it on the configuration page (maximum days back, vacation task and cost unit); the former settings in projectforge.properties are taken over into the configuration once (a property still set afterwards is ignored and reported as a problem on the system dashboard on every start, so it can be removed), and invalid values are refused on saving. The configuration list now groups the parameters by category and shows who may see and who may change each parameter. The statistics of the scheduled jobs also keep the last successful run; after a failed run, the system dashboard shows when the job succeeded last.

Notifications: a new rule notifies users whose password hasn’t been changed for more than a given number of days, with a link to change it. The notification is resolved once the password is changed.

Changelog: the releases of a major version are listed newest first, the release opening it last, linked from the top of the major; the release notes of an update link to it as well.

The admin log viewer is now a tab of the system dashboard; its own menu entry is gone, and old links lead to the tab.

Approved vacation days without time sheets count again as days without time sheets in the monthly report and the notifications about missing time sheets. The monthly report lists working days and vacation days without time sheets separately, a click on the vacation days opens the dialog for booking several days; notification texts can list all days, only the vacation days or only the other working days without time sheets.

My account

Migration of files out of the JCR failed in the packaged application with "No LoginModule found".

Currency conversion: current exchange rates are suggested again when a new conversion rate is created or its valid-from date is changed (the exchange rate API had moved).

Merlin templates: sorting the list by the admins, users or groups column works (the list was left unsorted).

My account: GPG and SSH public keys may now have up to 20,000 characters (were 4,096, a longer GPG key couldn’t be saved); a key that is still too long is shown as an error at the field.

Notifications (experimental): rules notify users in the app (toast, banner, menu counter) and by mail, also as a cascade; first rules for missing time sheets and expiring vacation days, plus manual messages.

System dashboard: the problem dashboard becomes the system dashboard, with the system statistics and the new tabs scheduler and caches; problems (in German now "Störungen") can be changed many at once, the tiles count only open ones.

Scripts: list, form and execution pages in the new interface with a code editor and toolbar; the output gets a tab of its own; a script can appear as a button on selected pages and gets their filter.

Time sheets: bookings on the same cost 2 may no longer overlap; new configuration parameter for overlap groups.

Rich text: markdown is shown formatted and taken over by the editor, which now offers headings and tables; also used for the message of the day and the AI-savings note.

Forecast: snapshot date for the order book as of a given day, hint for the planning date.

Lists and data transfer: exports in an Export menu; data transfer with capacity bar, configurable file columns and the activity log as a tab.

Fixes: HTML in user-entered mail texts, poll mails, cancelled invoices count as paid, attachment rename, liquidity entries cloneable, task tree under concurrent changes, project list sorted by number.

Statistics, forecast

Notifications (experimental): admins and finance can set up rules that notify users in the app (toast, toast to be confirmed or banner, with the levels info, important and urgent, optionally as a menu counter) and by mail, also as a cascade (e.g. a mail if not confirmed in the app within two days). First rules: missing time sheets and vacation days about to expire; a manual rule sends a message on demand. Recipients are groups, users and employees by status, by default only those concerned. Texts are formatted and contain variables such as the list of days without time sheets. Who confirmed a notification and when is recorded. The problem dashboard shows the state of the notification jobs. Approved vacation days no longer count as days without time sheets, also in the monthly report.

Scripts: a script can be shown as a button with a tooltip in the top right corner of selected pages, e.g. the order book or other lists, and the forecast or contribution margin tab of the order statistics. The button opens the script’s execution page, and the script gets the current filter of that page as variable pageContext (e.g. pageContext.list() for the shown entries).

System dashboard: new tab "Scheduler"

System dashboard: new tab "Caches"

Data transfer: the used capacity of an area is shown as a colored fill-level bar, in the list and in the file view.

Mass update: the file name of the Excel protocol now contains the entity name (e.g. invoices).

Configuration: the note on AI savings in time sheets and the message of the day on the login page are edited with the rich text editor (bold, italic, lists, links, colours).

Problem dashboard: the key figures and the subsystem tiles now count only the problems that still need a look. Resolved, ignored and muted problems are shown separately below each figure, so handling a problem changes the tiles at once.

Rich text: texts written in markdown (e.g. older tooltips and notes) are shown formatted instead of with their raw markup, and the editor takes them over directly; they are stored in the rich text format on the next save. Markdown pasted as plain text is converted as well. The editor now also offers headings (levels 1 to 4) and tables.

System dashboard: the problem dashboard is now called system dashboard and also shows the system statistics in a tab of their own, which replaces their menu entry; old links are redirected. The statistics are part of the new interface and show each section as soon as its figures are collected instead of waiting for all of them. Memory, disks, the database connection pool and the database server connections are shown as fill-level bars, and new figures were added: pool configuration and maximum size, database version and size, CPU load, processors, physical memory, operating system, non-heap memory, garbage collection and thread counts.

Code editor (scripts): a toolbar with undo, redo, search and replace and comment out, each naming its keyboard shortcut in the tooltip, and an info button listing all shortcuts. The search panel is shown at the top and in the user’s language.

Dark mode: the text is rendered in a lighter weight and smoothed, so it no longer looks overly bold on the dark background.

Data transfer: the columns of an area’s file table can be shown, hidden, reordered, pinned and resized like in every list; the layout and the sort order are kept per user for all areas.

Lists: the exports (Excel, PDF, forecast, cost assignments, ics) are now in an "Export" menu right beside the gear menu, each entry with its explanation shown directly in the menu.

System dashboard: with the multi selection, many problems can be picked at once and acknowledged, resolved, ignored, reopened, muted or unmuted together. In German the problems are now called "Störungen".

Data transfer: the activity log of an area is a tab of its own (after Info) instead of a dialog.

Scripts: the script list, the script form, "My scripts" and the execution pages are part of the new interface, with a code editor with syntax highlighting. The descriptions of a script and of its parameters are rich text (existing Markdown is converted on the next save). A stored script now always runs as stored; only the parameter values are taken from the form. Code executed directly (without a stored script) now runs as Kotlin instead of Groovy.

Scripts: the output of an execution (result, log) is shown in its own tab, which opens after the run. A file to download is shown prominently at the top of both the output and the execution tab.

Groovy scripts: only the Groovy core and its date, JSON, XML and template modules are bundled; the other modules (e.g. Ant, SQL, Swing, console) were removed.

Attachments: a changed file name or description was not saved.

Project list: sorting by the number column had no effect.

Personal box and employee fields: the "select me" button for picking oneself was missing.

Time sheet list: the hint that the filter needs a date or structure element is now shown highlighted above the list instead of easily overlooked below it.

Outgoing invoices: cancelled invoices and their cancellations now count as paid. They no longer appear under the filter 'unpaid' and are no longer included in the sums above the list (gross, net, open).

Problem dashboard: a mail that couldn’t be sent is now reported once as a mail problem, no longer a second time as an unexpected error of the function that sent it.

Task list and task tree: no more sporadic internal errors while another user creates or moves a task at the same time.

Attachments: long file names without spaces are wrapped in the attachment table instead of widening it.

Liquidity planning: entries can be cloned again; a clone of a recurring entry is a standalone entry.

Mails: names, titles, file names and texts entered by users are no longer taken over as HTML (e.g. in the mails of polls, data transfer areas, vacations and to-dos); only simple formatting and links remain in the mail text of a poll.

Polls

Time sheets: no more overlapping bookings on the same cost unit

npm vulnerabilities in projectforge-next and projectforge-webapp fixed: @modelcontextprotocol/sdk, proxy-addr, sharp and source-map-js updated.

File store: with projectforge.files.store=db all files are stored in the database, data transfer files in the file system; existing installations stay on the JCR until switched.

JCR migration: after switching, files are copied in the background and verified by size and checksum, with a report; switching back or a rollback stays possible. The system page shows the active store and starts backup ZIP and migration.

Backups: the admin guide describes a main dump and a separate dump of the files; the backup purge handles several prefixes.

Calendar: booking several days also books days that already have time sheets, as long as nothing collides; the preview shows each overlap.

Data transfer: areas sorted by last modification, latest first.

Problem dashboard fixes: structure tree and list filters without a session, field error for a time sheet without a task, invoices found by order number, fewer needless error log entries.

Projects: changing cost 2 types of an ended project in the mass update is reported as an error, with the reason in the Excel export.

Fixes: user settings saved again on logout, Safari browser back, tall company logos on legacy pages, wider mail layout, e-invoice checker error message, rare internal error when opening an order.

File store

Calendar, book several days: a day already booked is booked as well if the new time sheet doesn’t collide with an existing one (an overlap allowed by a shared cost element is fine); the preview shows each overlap and whether it is allowed.

Data transfer: the list of areas is sorted by the last modification, latest first, by default.

Problems from the problem dashboard

Legacy pages: a tall company logo is limited in height and no longer covers parts of the application.

Mails: wider layout; field names in the change history no longer wrap letter by letter.

Projects: changing the cost 2 types of an already ended project in the mass update is an error instead of being silently skipped; the Excel export of the mass update shows the changed cost 2 types and lists failed entries with their reason. The edit form of an ended project shows its existing cost 2 units checked and ended.

Safari: browser back from an entry returns to the list again instead of skipping it and landing on an earlier page.

Changed user settings (e.g. list filters and column layouts) are saved again on logout instead of being lost.

E-invoice checker: an e-invoice whose amount due doesn’t match its lines is shown with this error instead of "no e-invoice data found".

Orders: opening an order could rarely fail with an internal error.

Calendar: book several days at once, e.g. a vacation or an absence for a colleague; weekends, holidays and booked days are skipped, half working days booked pro rata.

Orders: one contact person plus any number of further contact persons instead of project manager, head of business and key account manager; they get the same access and the change mail.

Charts: chart pages show charts as tiles that can be reordered, resized and hidden, stored per user.

Statistics: forecast and contribution margin calculated much faster; forecast analysis of an order opens in a dialog from the forecast tables.

Project list: sortable columns for the last time sheet, last order date and last activity to spot ended projects.

Problem dashboard: a click on a key figure shows the problems it counts; the mail tile shows the outcome of the last mail; failing calendar subscriptions are reported in the error digest.

Lists: the search box gets the focus on page load; statistics and problem dashboard moved to new URLs with redirects.

Fixes: a cloned time sheet keeps its user, search terms highlighted in cells with JIRA links, no stale frontend files in the release jar.

Project list: columns for the last time sheet, the last order date and the last activity (the later of both), sortable, to spot projects that have probably ended.

Problem dashboard: a click on a key figure (new problems, regressions, external systems etc.) shows exactly the problems it counts.

Chart pages (statistics, liquidity forecast, invoices, my statistics): charts as tiles that can be reordered by drag and drop, resized in steps and hidden; the arrangement is stored per user.

Calendar: book several days at once, e.g. a vacation or an absence booked on behalf of a colleague; weekends, holidays and already booked days are skipped, half working days are booked pro rata, templates, recent time sheets and the booked user’s vacations can be taken over (vacation task and cost unit configurable via projectforge.timesheet.vacation.taskId/kost2).

Statistics: a pill behind the order number in the forecast tables opens the forecast analysis of the order in a dialog, without leaving the table.

Lists: the search box gets the focus on page load (not on touch devices).

Orders: one contact person plus any number of further contact persons instead of project manager, head of business and key account manager (existing entries are migrated, the old fields remain in the database). Further contact persons have the same access to the order and its invoices as the contact person, and the change mail now also goes to them and to everyone who has edited the order before.

Statistics: forecast and contribution margin are calculated much faster; the contribution margin is cached per project.

Contribution margin configuration: a cost unit assigned twice is marked as an error.

Cost units: the cost type is shown only for customer cost units (4.x and 5.x) in the list and export, as in the monthly report.

Problem dashboard: the mail tile shows the outcome of the last mail sent (unknown, OK, send failed or mail server unreachable).

Failing calendar subscriptions no longer send a separate mail to the administrator and the feedback address; the error digest reports them.

The statistics page moves to /next/finance/statistics and the problem dashboard to /next/problemDashboard; old links are redirected.

A cloned time sheet (e.g. dragged in the calendar) keeps its user if the logged-in user may book for them.

Search terms are highlighted in list cells with JIRA links, too (order title and reference, task, time sheet, HR planning).

The release jar no longer carries stale frontend files of earlier builds.

Problem dashboard and error digest: problems instead of occurrences as lead key figure, numbers with thousands separators; subsystem tiles count only open problems.

Projects: the status can be changed in the mass update.

Gateway: the ICS push delivers all calendars of a user again and generates each team calendar only once per run.

Fixes: nightly search re-index no longer fails on tables of inactive plugins, long values no longer break mail tables, no needless error log entries when saving orders.

Problem dashboard and error digest mail: problems instead of occurrences as the lead key figure, so one frequent problem no longer hides all others; numbers with thousands separators.

The status of projects can be changed in the mass update.

The gateway’s ICS push generates each team calendar only once per run.

The gateway’s ICS push delivered only the first calendar of each user.

A subsystem tile of the problem dashboard counts only open problems, like the list behind it.

Long file names and values no longer push tables beyond the mail card.

The nightly re-index of the search no longer fails on tables of non-active plugins.

No more needless error log entries when saving orders.

New frontend projectforge-next: all pages migrated, including calendar, time sheets, order book, invoices, structure tree, access rights, monthly report, liquidity planning and administration. The classic Wicket module has been removed.

Problem dashboard: log events are classified and aggregated into problems with a persistent status, with links into the log viewer, a JSON export for an AI-assisted analysis and prioritized error digest mails instead of one mail per error.

Charts and key figures: order statistics with budget scenario, contribution margins, forecast, invoicing and net sum charts with a year-earlier comparison, invoicing quota and error figures in the system statistics.

Robust interfaces: timeouts, connection pools, bounded sync threads and sync statistics for LDAP, identity provider, iCal, SMS, Sipgate and the gateway; an unreachable system fails fast instead of blocking, failing calendar subscriptions are retried with a growing interval.

E-invoicing: XRechnung and ZUGFeRD export of outgoing invoices, PEPPOL validation, cancellation invoices and an e-invoice checker.

Identity provider: synchronization of users, groups and passwords with Authentik or Keycloak (module projectforge-idp).

Finance: recurring liquidity entries, DATEV import of incoming invoices, salary import, currency conversion with online exchange rates.

Technology: Spring Boot 4.1, Spring 7, Hibernate 7.4, Hibernate Search 8.4, Tomcat 11, Kotlin 2.3, Next.js 16, React 19, TanStack Table.

projectforge-next

E-invoicing

Identity provider integration (module projectforge-idp): users, groups and passwords synchronized with Authentik or Keycloak, including WLAN password hashes.

Problem dashboard

Charts and key figures

Recurring series in the liquidity planning.

Address import and export as vCard and from free text, with a diff view and a warning about duplicates.

Incoming invoices imported from DATEV, with currency and exchange rates looked up online.

Gateway for external data transfer with delta sync, CardDAV favorites and a public heartbeat.

ICS import of team events with a diff preview.

Changelog with news, search and highlighting under /next/changelog, also in German.

All pages migrated to projectforge-next, among them calendar, time sheets, order book, outgoing and incoming invoices, structure tree, access rights, monthly report, liquidity planning, DATEV and salary import, HR planning, Gantt charts and administration; links and bookmarks of the classic pages lead to the new ones.

Configurable customer groups and business units as filters for time sheets, invoices, projects and orders.

Structure element picker with recently used entries and favorites; JIRA issue links in lists and forms.

Server-side paging of order and invoice lists; deleted entries can be restored.

Robust interfaces

Order book and invoices no longer freeze when two caches refresh at once.

Many N+1 query floods removed; large ID lists stay under the database’s bind parameter limit.

Subscribed calendars, the MS Project export of Gantt charts, the Word-to-PDF conversion and the LDAP sync repaired.

CSRF protection and complete field validation for the REST calls; access checks for all REST endpoints, enforced by an architecture test.

Security review of the filter chain: trusted proxies, client IP detection, throttling, safe redirect URLs.

2FA required for sensitive pages; deleted groups never grant access rights.

Module projectforge-wicket with all classic pages, Wicket-only i18n keys and libraries no longer used.

AG Grid (replaced by TanStack Table), react-scripts (replaced by Vite) and JAXB.

Legacy XML user preferences are migrated to the JSON store.

Spring Boot 4.1, Spring 7, Hibernate 7.4, Hibernate Search 8.4, Tomcat 11.

Kotlin 2.3, JUnit 6, Gradle 9.8, Next.js 16, React 19, TanStack Table, Vite and Vitest.

Versions are numbered X.Y.Z and built by a release script, the version is set in one place.

AI time savings in time sheets with reporting.

Customizable personal menu via drag and drop.

Forecast and order book: snapshots, planning data and filterable forecast export.

Groups: Description and organization of groups are now visible for non-admins.

Group Excel export: Includes email addresses of assigned users.

Menu customization: Drag & drop functionality implemented for personalized menu organization.

AI time savings tracking in timesheets with calculation and reporting features.

Cost search functionality supports plain number string searches.

Timesheet collision prevention on multiple button events.

Excel export functionality added to accounting record list page.

User registration process made more user-friendly for new employees.

Modal dialogs on calendar page support ESC key and click-outside closing.

2FA code input field with improved UX (numeric inputmode, autoComplete).

Excel export of timesheets with AI-savings data included.

Improved forecast and orderbook functionality with planning data.

History entries now support user comments for administrative changes.

Enhanced AG Grid implementation with German translations, filtering, and sorting.

Vacation validator improvements for edge cases with remaining days from previous year.

Sipgate contact synchronization service with configurable cron job scheduling.

Data transfer functionality with sanity checks and backup capabilities.

JCR memory leak fixes and improved repository management.

Enhanced user and group access control with menu visibility configuration.

Forecast export functionality with filtering by unit, customer, and projects.

Structure wizard support for optional external groups.

Multi-selection improvements for employees in visitor book and vacation entries.

JCR memory leaks in DataTransfer module resolved.

DynamicButton disabled state during fetch operations.

Accounting record list page tooltips fixed.

Timesheet recent entries display corrected (kost2, project, customer info).

VacationValidator edge case handling for vacation day calculations.

NPE fixes in vacation account management and group services.

Structure tree access checking improvements for timesheet editing.

Order forecast data and invoice cache handling corrections.

User group cache and right handling stability improvements.

Address forced deletion after MGC migration fixed.

History formatting and user comment handling corrected.

Various UI fixes for AG Grid tables and component rendering.

Excel export XML escaping for structure element titles in timesheet exports.

Cost assignment export improvements for invoice handling.

Login redirect functionality after authentication.

Calendar and timesheet page rendering issues resolved.

Employee selection improvements without autocompletion quirks.

Mass update functionality with proper Excel modification tracking.

Multiple deadlock issues resolved in caching and logging components.

Wicket session store size increased from 100kB to 2MB: prevents session loss on large pages.

CSRF token handling and exception registry improvements.

File stream handling corrections ensuring proper resource closure.

Enhanced administration capabilities with user group cache debugging tools.

System sanity checks with automated error reporting via email.

Improved cron job scheduling using separate threads to prevent blocking.

Database testing tools accessible via admin interface.

Configuration parameter management for AI time savings features.

Menu item visibility configuration by user groups.

Enhanced logging and exception handling for proactive error reporting.

CVE updates: Tomcat upgraded from 10.1.33 to 10.1.39.

Improved access control for addresses and address campaigns (marketing users only).

Enhanced user and group visibility restrictions for non-admin users.

CSRF protection improvements and token handling enhancements.

Wicket upgraded to version 10.5.0 with improved page store handling.

Spring framework updates and dependency management improvements.

AG Grid integration with advanced filtering, sorting, and column pinning.

React Router dependency management and compatibility fixes.

Enhanced Kotlin coroutines implementation for asynchronous operations.

JCR (Java Content Repository) improvements with RDB storage preparation.

Jackson library updates with Hibernate 6 module integration.

Excel processing improvements with Apache POI enhancements.

Database migration scripts and flyway integration updates.

Docker container improvements for multi-architecture support preparation.

Package dependency updates including security patches.

Gradle build system optimizations and test framework enhancements.

Source file headers updated to 2025 copyright year.

Own CardDAV server for contact synchronization.

Docker images for arm64 and amd64.

Java 17, Spring 6, Hibernate 6, jakarta namespace.

Own CardDav-Implementation for synchronization of contacts (tested with Apple contacts (macOS/iOS), Thunderbird).

Sipgate interface implemented for synchronization of address.

Calendar view improved.

Excel-Export of vacations for all employees, teams and colleagues.

Birthdaybutler for monthly birthday list.

Export of timesheets as xlsx.

Attachments to books added.

lots of minor improvements.

several bugs fixed.

Docker container available for arm64 as well as for amd64 (Linux and macOS X).

Persistence layer completely refactored, MGC removed and replaced by a custom persistence layer.

technical debt reduced.

New major versions: Java 17, Spring 6.1.15, Hibernate 6.6.3, Hibernate search 7.2.1, javax → jakarta, React/Router, Wicket 10.2, …​

Calendar: main calendar refactored (colors, functionalities, more customizable).

Vacations: multiple substitutions supported, conflicts are shown.

Data transfer: notifications improved.

History of changes improved; 2FA requests preserve input fields.

Administration: user and group administration in the new version.

Security: issues from the last security pen test implemented.

Fixes: menu customization in the classic version, Yubikey support in Chrome, Edge etc.

Technology: Java 15, new Spring, React/Router and Wicket versions; users and passwords in separate db tables.

The main calendar refactored (colors, functionalities, more customizable etc.)

Datatransfer-Plugin: Notification improved

Vacations

History of changes improved.

2FA-requests preserve now input fields.

lots of minor improvements.

Menu customization in classical version.

Yubikey now also supported in other browsers: Chrome, Edge etc.

several bugs fixed.

User/group administration in new version.

Some issues from last security pen test implemented.

New versions: Java 15, Spring, React/Router, Wicket

Separation of db table user and passwords.

Multi upload with progress bars in data transfer areas.

Password reset for users with a configured second factor.

2FA (use SMS, mail, Authenticator app or Webauthn/Fido2 as 2nd factor for much more security.)

Password reset for users implemented (it’s only usable for users with configured 2FA / mail isn’t supported for password reset due to security reasons).

Scripts may be executed by users/groups without special rights (sudo functionality is supported). You may configure reports e. g. for project managers including financial data.

mass update and selection of invoices for e. g. bank transfers etc.

Datatransfer:

CSRF-Handling: if session token was changed, the user is able to simply reload the page for continuing.

mass update functionality refactored and improved.

pagination for result lists of new UI introduced.

Several minor bugfixes

Password reset for users: Admins may enter cell numbers of users to enable password for users without any configured 2FA.

2FA is now fully supported. You may configure:

Data transfer and Merlin: serial PDFs/Word documents are generated automatically and sent to the personal boxes of users/employees.

Scripting: example scripts, include support and a new source editor for Groovy and Kotlin.

Security: two-factor authentication (2FA) introduced.

Privacy: data protection improvements.

Administration: the SSH public key is also visible for non-admins.

Several minor bug fixes.

Combination of DataTransfer and Merlin: Serial PDFs/Words may be automatically generated and sent to the personal boxes of the users/employees.

Scripting: example-scripts, include supported, new source editor supporting Groovy and Kotlin.

Scripting functionalities improved.

Data protections improvements.

Several minor bugfixes

Ssh public key is also visible for non-admins.

2FA introduced (will be improved soon).

Merlin: Word templating for letters, contracts etc. with variables and if-else expressions; serial execution delivers Word/PDF files to personal boxes; gender for users added for personalized letters.

Log viewer for admins and for users to track their own activity (mass updates, Merlin, DATEV imports).

Data transfer: encryption added.

SEPA export: special characters unsupported by banking software are replaced or removed.

Privacy: deletion of addresses, employee and vacation data etc. including history entries (EU privacy rules).

Administration: no restart after first installation; temporary directories are deleted on shutdown.

Security: passwords handled as char[] instead of String.

Fixes: search for deleted entries and search in history entries.

Word-Templating (Merlin): Word templating for letters, information, contracts etc. with serial execution including variables, if-else-expressions etc. inside docx (like Velocity-Scripting-engine). All users/emloyees may receive letters/contracts etc. (as Word and/or PDF-files) in their personal boxes via serial execution. Example template files included for a quick start.

Log viewer added (for admins as well as for users for tracking own activity for mass updates of time-sheets, usage of Merlin or Datev-imports)

Gender for users added: Used by Merlin (word templating) for creation of personalized letters, contracts etc.

DataTransfer-Plugin: encryption added

Exporting SEPA-cash transfers improved: special characters unsupported by banking software will be replaced/removed.

Features for deleting data such as addresses, employee, vacataion data etc. implemented due to privacy restrictions in the EU. The deletion includes also history entries.

Several minor bugfixes

Search for deleted entries (addresses etc.) fixed.

Search in history entries (keywords, users) fixed.

No restart after first installation required anymore.

During Shutdown some temporarily created directories (tomcat.* and projectforge-application*) will be deleted automatically.

using char[] instead of String for passwords.

Security: fixes from a penetration test.

Data transfer: download of an area in one zip, more options for external users.

Several minor improvements (order book etc.) and bug fixes.

Docker: binaries available on Docker Hub.

The DataTransfer tool is improved: download area in one zip, more options for external users

Security fixes from a penetration test.

Several minor bugfixes

Several minor improvements (order book etc.)

You can download the binaries from Docker hub

Data transfer: personal box of every user for fast one-to-one exchange of large files.

Docker improved.

Technology: update of all JavaScript libraries (React etc.).

Data transfer: Personal box of every user for fast exchange of large files one to one.

Docker improved.

Update of all JavaScript libs (React etc.)

Data transfer: checksums for all files and a nightly sanity job.

CardDAV support improved (cell phone numbers).

Test systems: no more unique constraint violations with test data on new test systems.

Technology: support of Java 13+, major updates of nearly all libraries, multi tenancy removed.

checksums for all files in data transfer as well as nightly run of sanity job.

CardDAV support improved (cell phone numbers)

Test data in test systems: no more unique constraint violations anymore on new test systems.

Support of Java 13+.

Major updates of nearly all libraries.

Multi tenancy removed.

New frontend built with React, with full REST support for most functions, e.g. for other clients such as a smartphone app.

Data transfer tool: sharing files with other users and external customers.

Skill matrix: new plugin for sharing knowledge.

Installation: Docker images and a setup wizard.

Technology: over 20% of the code is now developed with Kotlin.

New front-end

Data transfer tool for sharing files with other user’s and external customers

New plugin: skill matrix for sharing knowledge.

Tons of new functionalities and improvements.

Available as Docker images for fastest installation ever.

Setup wizard for easy setup.

New front-end works with React.

Over 20% of the code is now developed with Kotlin.

Full Rest support for most functionality for other clients (such as a smartphone app).

Technology: update to Spring Boot 2.0.

Start: the ProjectForge Launcher no longer works; only the projectforge-application.jar command-line starter is available.

Invoices: BIC optional for German IBANs; round-off error in invoices fixed.

Security: session fixation and an access management bug fixed.

Fixes: team event invitation mails, call function in the address list, employee status in the employee list export.

BIC for german IBANs optional

Update Spring Boot version to 2.0

Fix round-off error in invoice

Fix session fixation

Fix access management bug

Fix team event invitation mail send

Fix call function from address list page

Fix employee status in employee list export