Changelog

CVE-Clinic: findings follow a status workflow (new to fixed, mitigated or risk accepted) with approval of risk acceptances and "fix planned" on a version change; all affected versions of a library are named; the language of an AI prompt is selectable; the trees start collapsed and remember their open nodes.

Login: password spraying (the same password against many users) is slowed down by counting failed logins per tried password.

Two-factor setup: passkeys and security keys are easier to find and to add.

Docker: the image no longer contains curl, wget and gnupg, the compose examples run nginx on Alpine; this removes many known vulnerabilities.

E-invoice: a ZUGFeRD invoice without a buyer reference is no longer reported as faulty; the XRechnung export names the missing reference beforehand.

Order notifications: the daily summary shows status, net sum, customer, project and the changed properties of each order.

App Version 1.1.1 of the app is in the App Store (since November 12): pages menu, push messages with content, shared timer and time grid, favorite star of addresses and a booking form the keyboard no longer covers.

Fixes: Kotlin scripts find the entities of the CVE-Clinic plugin again, the horizontal scrollbar of tables no longer hides the last row, and time sheet templates are applied again in the mobile app.

App Version 1.1.1 of the app is available in the App Store (released on November 12, 2026): pages menu with open categories on tablets, push messages with content, shared timer and time grid in the settings, the star of an address, the booking form no longer hidden by the keyboard, login behind an SSO proxy without detour to Safari, and updated libraries (known vulnerabilities in build tools removed).

CVE-Clinic: status workflow of the findings, risk acceptance and fix planned on a version change

CVE-Clinic: the language of an AI prompt can be chosen (German or English), whatever language the web app is set to.

Login: password spraying (the same password tried against many users) is slowed down. Failed logins are also counted per tried password, kept as a keyed hash in memory only.

Order notifications: the daily summary shows status, net sum, customer and project of each order and which properties were changed.

CVE-Clinic: the inventory and catalogue trees start collapsed; which nodes are open is remembered in the user settings.

Docker: the image no longer contains curl, wget and gnupg of the base image (only needed for downloading the JDK), which removes their vulnerabilities.

Docker: the compose examples run nginx on Alpine (stable-alpine-slim) instead of Debian, without curl, perl, libxml2 and the image libraries of the Debian image, which caused most of its known vulnerabilities.

Two-factor setup revised: passkeys and security keys are easier to find and to add.

App Time sheet templates are applied again when booking (task, cost unit and texts were left empty).

CVE-Clinic: if a component contains several affected versions of a library (e.g. two versions of one npm package), the finding, the libraries and the report now name all of them instead of only one.

Scripts: the entities of the CVE-Clinic plugin (e.g. CvrCaseDO) are found again by Kotlin scripts ("Unresolved reference 'cveradar'").

Tables: the horizontal scrollbar no longer hides the last row.

E-invoice: a ZUGFeRD invoice without a buyer reference (BT-10) is no longer reported as faulty by the check, the rule BR-DE-15 belongs to XRechnung only. The XRechnung export names the missing reference (Leitweg-ID or customer reference) beforehand. Hints on the customer reference (BT-10) and on contact person and department (together BT-56).

Time sheets: a timer in the top bar of the web pages, kept on the server and shared with the app and other devices (stopping opens a new time sheet); a time grid in "My account" (default 15 minutes), to which the timer rounds the start down and the end up.

Lists: title, search and actions share one line, filters and totals stay on one line, on narrow screens the actions are behind a "more" button and on tablets and phones the head scrolls away with the rows; the invoice and liquidity lists switch to their charts or forecast with a button instead of tabs.

CVE-Clinic: the CVE-Radar is now called CVE-Clinic; old links are redirected, plugin id, settings and database tables keep their names.

Custom logo: the height of the logo in the header can be set with projectforge.logoHeight (in px).

Mobile app (in preparation): the timer is shared with the web pages, its start comes from the server’s clock; the time grid and the theme (light, dark, system) can be chosen in the settings and apply to the web pages as well.

App The time grid and the theme (light, dark, system) can be chosen in the settings; both are shared with the web pages.

Custom logo: the height of the logo in the header can be set with projectforge.logoHeight (in px).

Time sheets: a time grid (default 15 minutes) in "My account". The timer rounds the start down and the end up to it; the times can still be set to 5 minutes.

Time sheets: a timer in the top bar of the web pages, shared with the app. Started on one, it can be stopped on the other; stopping opens a new time sheet.

App The timer is kept on the server: it is shared with the web pages and other devices, and its start is taken from the server’s clock (needs a current server; otherwise it stays on the device).

Lists: the head takes less height. Title, search and actions share one line, the filters and the totals stay on one line, and on narrow screens the actions are collected behind a "more" button. On tablets and phones the head scrolls away with the rows. The invoice and liquidity lists switch to their charts or forecast with a button in the head instead of tabs, and the structure tree and the notification log use the same compact head.

The CVE-Radar is now called CVE-Clinic. Old links to its pages are redirected; the plugin id, settings (projectforge.plugin.cveradar.*) and database tables keep their names.

CVE-Radar: a zip with the SBOMs of many repositories and container images can be imported into an area in one go (preview, adaptable codes and names, largest zip set per area); "Report by package" downloads the vulnerabilities per package and version as PDF, Excel or JSON; single vulnerabilities can be left out of the report and the AI prompt; the file of a vulnerability shows the ratings of all its sources side by side; the inventory counts the findings of a node by severity, each CVE once; the progress bar of imports and matching runs until the findings are stored, SBOMs are read as a stream; the severity of a vulnerability known from OSV only follows its CVSS score, Maven versions with a qualifier like -jre or .RELEASE count as the release itself, and a file above the upload limit is refused at once; an area, system, instance or component can be deleted with everything below it for good, after a list shows what goes.

Backup and history: the data of the CVE-Radar sources isn’t backed up any more (the separate dump projectforge_cveradar_… is gone, the imports fill it again after a restore); technologies, libraries and imported vulnerabilities are no longer kept in the history.

Notifications: push messages show the title and the beginning of the notification (switchable per user and for the whole server with projectforge.push.content=false); the text of chat notifications no longer repeats their title.

Chat and changelog: the arrow keys keep paging in the full size view of several images; a link of the table of contents opened as a drawer scrolls to its entry again.

Invoices: the contact person of the customer is no longer printed in the invoice address of the document (the e-invoice still states it, templates may print it), and the text after the colon in the customer reference is no longer bold.

Sipgate: a permanently deleted address no longer comes back through the contact sync, its Sipgate contact is deleted instead.

Mobile app (in preparation): the pages menu opens its categories on a tablet and remembers opened ones, behind an SSO proxy the pages no longer open in Safari after the session of the proxy ended, a favorite star in the address view, and the booking form scrolls the edited field and the optional fields into view above the keyboard.

CVE-Radar findings export and ad-hoc check: single vulnerabilities can be left out of the report and the AI prompt ("Select vulnerabilities"), e.g. to handle an update with big changes in a branch of its own. The prompt now asks first for a newer release of the direct dependency that brings in the fixed version, and forcing the version only if there is none.

App Addresses: the star in the view of an address marks it as a favorite or removes the mark at once.

CVE-Radar findings export and ad-hoc check: "Report by package" downloads the vulnerabilities per package (library and version) as PDF, Excel or JSON: tiles per severity, an overview with the highest score and the version that fixes all of them, then per package its vulnerabilities with score, description, affected versions and a link to the NVD or the advisory. For an ad-hoc check as for an area, a system, an instance or a component of the inventory; the selection of vulnerabilities and the replaced names apply.

CVE-Radar

CVE-Radar: the file of a vulnerability shows the ratings of its sources side by side (NVD, the CNA, the OSV advisories with GitHub’s own rating, the EUVD, kept also once the NVD rated the vulnerability), so a differing severity can be traced.

App Pages menu: on a tablet the categories of the main menu are open, opened or closed ones stay so; the main menu tab comes second.

Notifications

App Booking: opening "Location, reference, tag" scrolls its fields into view.

Invoices: the contact person of the customer (BT-56) is no longer printed in the invoice address of the invoice document, below the company name; the e-invoice still states it, and an invoice template may print it via the variable Ansprechpartner (with the condition isAnsprechpartner).

Invoices: in the customer reference of the invoice document, the text after the colon of each line (e.g. "Supplier number: 1140300") is no longer printed bold; the label stays bold, as for the order number.

CVE-Radar: the progress bar of an SBOM import (also of a zip with many SBOMs), of an uploaded library list and of matching again also runs while the components are matched against the vulnerabilities, with the OSV advisories checked and the findings stored.

Backup: the data of the CVE-Radar sources (details of the vulnerabilities, OSV advisories, indexes) isn’t backed up any more, the separate dump projectforge_cveradar_… is gone. After restoring, the imports fill it again by themselves: the NVD import reads the NVD since 1999 once more for the stored vulnerabilities without details, and their findings stay as they are until then.

CVE-Radar inventory: the findings of a node are shown as CVEs by severity (critical, high, medium/low) and those only possibly affected, each CVE counted once, matching the key figures of its tooltip.

CVE-Radar: the technologies and libraries of a component and the imported vulnerabilities are no longer kept in the history; existing entries are removed.

CVE-Radar: an area, a system, an instance or a component of the inventory can be deleted with everything below it, its libraries and all its findings, for good. Before, a list shows what goes with the numbers of findings, libraries and technologies of every entry.

App Behind an SSO proxy, the pages no longer open in Safari after the proxy’s session ended: after the new login the page asked for is loaded in the app again, and the pages tab no longer starts with the proxy’s login.

CVE-Radar: a Maven version with a qualifier other than a pre-release (Guava’s 33.7.2-jre or 33.7.2-android, 1.0-jdk8, 5.3.18.RELEASE) is the release itself, no longer a pre-release of it that is still affected.

CVE-Radar library upload: a file above the limit (5 MB, a zip 10 MB) is refused at once with its message instead of failing in the browser, and the progress bar stays visible above the buttons.

CVE-Radar: the severity of a vulnerability known from OSV only (not yet from the NVD) belongs to its CVSS score, no longer to the rating of GitHub (e.g. critical with a score of 6.1); stored entries are corrected.

App Booking: the keyboard no longer covers the text field being edited; the form scrolls it into view.

Chat: in the full size view of several images, the arrow keys keep paging after the first or last image was reached. Changelog: a link of the table of contents opened as a drawer (narrow screens, app) scrolls to its entry again instead of back to the top.

Sipgate: a permanently deleted address no longer comes back through the contact sync; its Sipgate contact is deleted instead.

Chat and rich texts: a link in a message shows a preview of the linked page (fetched by the server, removable, can be switched off by administrators); urls in chat messages and all rich texts are clickable, an edited link leads to the edited url; opening a conversation puts the cursor into the message field (not on touch devices).

CVE-Radar: the dialog of an area, system, instance or component lists its open findings with key figures by severity, also per library with the update fixing its CVEs, filterable by the uploaded file they were found in, and can check them again by hand; packages of Debian and Ubuntu are matched against the advisories of their release and by their source package (backported fixes no longer show, also for dpkg-query lists with /etc/os-release), CPE entries of another platform or, by name, of another vendor no longer meet a library, advisories for other operating systems only no longer meet a Linux component; uploading libraries runs in the background; the answers of a team check show their counts and can be filtered; optional connection to Dependency-Track (for now the connection is tested); the imported vulnerability data goes into a dump of its own (adapt an existing backup script, see adminguide).

New ProjectForge logo: in the web interface (light and dark theme), on the website, as favicon and home screen icon, on the Wallet pass of the business card and as app icon.

Changelog: a table of contents of the major versions and their releases beside the text, as on the website (on narrow screens and in the app behind a button); the entry in view is highlighted, the column can be hidden.

Lists: the empty filters business unit, customer and project are shown as one pill in the lists of orders, invoices, projects, cost units and time sheets and in the order statistics.

Mobile app (in preparation): the changelog opens from the "more" menu, the app starts with the tab used last, the menu of the pages has several columns on wide screens and searches while typing, the navigation in landscape can be placed at the right side, the server switch and the settings slide up over the tabs, the daily progress of the time sheets follows the own weekly working hours.

Docker: the image is based on Ubuntu 24.04 and installs the security updates of the base image when it is built; the compose example uses PostgreSQL 17 instead of 13 (an existing database has to be dumped and restored, see docker/README.adoc).

Security: the CSRF token of a session is renewed after an hour at the latest, the task tree and the data transfer box choice change by POST only, requests with a foreign Origin or Referer are refused; security updates of freemarker (2.3.35) and jsoup (1.23.2).

App The changelog opens from the "more" menu (the entry with the version).

App On a wide screen (landscape, iPad) the menu of the pages shows its entries in several columns.

App In the settings, the navigation in landscape (the column of icons) can be placed at the right side instead of the left, e.g. for the right thumb.

Chat: a link in a message shows a preview of the linked page (title, description, image), as in other chats, already while writing. The server fetches it, so the browser loads nothing from the linked site; the author can remove the preview (before or after sending), administrators can switch the previews off (projectforge.chat.linkPreview.enabled=false).

CVE-Radar: optional connection to Dependency-Track, as a second detection of the findings in parallel to the own matching; for now the connection is tested and shown on the system dashboard.

CVE-Radar: the dialog of an area, system, instance or component has a tab "Findings" with its open findings (key figures of the CVEs by severity, also as filters, counts, filter by certainty, a click opens the CVE); a click on the counts of the tree opens it directly, hovering over them shows the key figures, and the export of the findings stays visible on every row with findings.

CVE-Radar: the answers of the members to a team check show their counts (answered, not answered yet, affected, per answer) and can be filtered by answer with pinned pills.

Security: the CSRF token of a session is renewed after an hour at the latest; the task tree and the choice of a personal data transfer box are only changed by POST requests; for browsers without fetch metadata, requests whose Origin or Referer names a foreign host are refused.

The lists of orders, invoices, projects, cost units and time sheets and the order statistics show the empty filters business unit, customer and project as one pill; a filter gets its own pill once something is selected in it.

Chat messages and all rich texts (descriptions, notes, alerts) show their urls (with http(s):// or www.) as clickable links, also older texts and a url typed as the last word.

Changelog: a table of contents of the major versions and their releases beside the text (on narrow screens and in the app behind a button), as on the website; the entry in view is highlighted and the column can be hidden.

Chat: opening a conversation puts the cursor into the message field (not on touch devices, where the keyboard would cover the messages).

CVE-Radar

CVE-Radar

App The app starts with the tab used last on the device instead of always with the business cards, and the pages tab (globe) with the page shown last.

App The server switch and the settings of the "more" menu slide up over the tabs like the notifications, the tab bar stays visible below them (adding a server and the log open within them, with an arrow back); the "more" menu grows as high as its entries need.

App New app icon with the new ProjectForge logo.

App The progress of a day in the time sheets is measured against a fifth of the own weekly working hours valid on that day instead of 8 hours.

CVE-Radar: the imported data of the vulnerabilities is stored in a table of its own; the backup script writes it with the OSV advisories and the state of the imports into a dump of its own (projectforge_cveradar_…), restorable from the sources. Cases, team checks, answers and findings stay in the main dump, which is complete without it. Adapt an existing backup script (adminguide, “Backup script”).

New ProjectForge logo: in the web interface (light and dark theme), on the website, as favicon and icon of the browser and the home screen, and on the Wallet pass of the business card.

Docker: the image is based on Ubuntu 24.04 (Eclipse Temurin 21 JRE, formerly Ubuntu 22.04) and installs the security updates of the base image when it is built; the compose example uses PostgreSQL 17 instead of 13, which is out of support (an existing database has to be dumped and restored, see docker/README.adoc).

App The + of the addresses opens the form of a new address instead of an error page (not found).

App The search of the pages menu shows its results while typing, above the keyboard (not only after the search key).

Chat messages and rich texts: a link whose url is edited afterwards leads to the edited url, not to the one typed first.

Security updates of the libraries freemarker (2.3.35) and jsoup (1.23.2).

CVE-Radar: import of the European Union Vulnerability Database (EUVD, off by default) with EUVD id, EPSS and exploitation day; the source (NVD, OSV, EUVD) is shown as a badge and can be filtered; a team check can ask every member of a group and stays open until all active members answered; new notification rule "Unanswered team checks of a case"; statistics can look back 1, 2, 5 or 10 years.

Mobile app (in preparation): pushes of all logged-in servers, the ProjectForge tab opens with a menu (favorites, last pages, main menu, user menu with appearance, search), web tabs have a browser menu, the system message is shown, contacts can be added to the device or shared as vCard, the notifications and the "more" menu slide up over the tab bar, the week strip of the time sheets snaps to whole weeks.

Lists: new column "Edited by" in the lists of address campaign values, invoices, orders, leave corrections, liquidity entries, mail, contracts, the visitor book, notification rules, customers and projects; address campaign values can be filtered by editor.

E-invoice: the generated XRechnung/ZUGFeRD file is checked by the e-invoice checker and the result is shown; the recipient email (BT-49) and the contact email (BT-58) are separate fields, the seller’s contact email (BT-43) is prefilled and editable.

Digital business cards: the photo is linked by a public url with a random token, also without a gateway (update the gateway together with the server; photo links of earlier QR codes stop working); the card lists its contents below the QR code, which is rendered sharper.

Chat and notifications: the search lists all matching people with buttons for a direct message or an encrypted chat, a long press on a reaction shows who reacted, chat notifications show the beginning of the message, notification mails contain a link; the rule types of notification rules come from the active modules and plugins.

Fixes: calendar entries can be resized from the start time, a time sheet opened from a break keeps its end time, plugin menu entries can be chosen in notification rules, the badges of the app follow chat reads and done notifications at once.

CVE-Radar: import of the vulnerabilities of the European Union Vulnerability Database (EUVD) as a supplement to the NVD. It adds the EUVD id, the EPSS and the day of exploitation, and brings vulnerabilities the NVD doesn’t have yet, also ones without a CVE id. The EUVD names products only, so these match as possible. Off by default.

CVE-Radar: the list and the file of a vulnerability show where its data comes from (NVD, OSV, EUVD) as badges, and the list has a pinned filter to select by source.

App The system message of the administrators (e.g. maintenance work) is shown above the pages, as in the web version.

Address campaign values: new filter "Edited by" to list the entries a chosen user has created or changed.

App The web tabs have a browser menu with back, forward, reload, find in the page, share link, open in the browser and restart; pull to refresh now also works on the pages with the menu, and a lost connection shows an error with a retry instead of an empty page.

New column "Edited by" with a pill for everybody who created or changed an entry, in the lists of address campaign values, outgoing and incoming invoices, orders, leave corrections, liquidity entries, incoming and outgoing mail, contracts, the visitor book, notification rules, customers and projects.

CVE-Radar, notification rules: new rule type "Unanswered team checks of a case". The rule names a case and reminds the members who haven’t answered one of its team checks asking every member yet, at most once a day, by schedule or triggered by hand. The reminder is done as soon as they answered.

App All servers the app is logged in at send pushes, not only the one shown. The push names its server, a tap on one of another server offers to switch there and opens it; their open notifications are shown at the menu, in the server list and in the notification center, the icon counts all of them. Older servers push only while shown, as before.

App A contact of the address book can be added to the own contacts of the device or shared as vCard (messages, mail, messengers), also without a connection to the server.

App The ProjectForge tab (globe) opens with a menu that is easy to reach on a phone: tabs for the favorites, the pages opened last, the main menu with expandable areas and the user menu with the appearance (light, dark, system; the tab chosen last opens again), and a search across all entries (or in all data). Tapping the globe again closes the menu and shows the page as it was; tapped once more, it opens the menu again.

CVE-Radar, tab "Statistics": optionally look back 1, 2, 5 or 10 years.

CVE-Radar, My CVE-Radar: "Done" and "Not affected" ask before saving and explain that they answer for yourself only and don’t close the case. The case card also shows the checks of your own groups with their answer button. If such a check asks every member, its answer is your answer to the case as well, so there is only one answer per person. In the table of these checks the identifying columns and the actions stay pinned.

Chat: on touch devices and in the app, a long press on a reaction shows who reacted.

Chat: the search lists all matching people, each with buttons to start a direct message or an encrypted chat.

E-invoice: the customer’s invoice recipient email (BT-49) and the email of its contact person (BT-58) are separate fields now, on invoice and account. The seller’s contact email (BT-43) is prefilled from the configuration and editable on the invoice.

App Below the QR code of a business card a small list shows every field the card contains, including the photo, also without a connection to the server.

Digital business card: below the QR code a small list shows every field the card contains, including the photo.

The QR code of a business card is rendered at a higher resolution, so it stays sharp when shown large (e.g. in the app).

Digital business cards: the photo is linked by a public url with a random token (no login, not guessable), also without a gateway; the url stays the same when the image is replaced or deleted, and can be revoked with "Renew photo link" on the card. The base url can be set with projectforge.businessCard.photoBaseUrl. Update the gateway together with the server; photo links of earlier QR codes stop working.

Creating an e-invoice (XRechnung, ZUGFeRD) now runs the e-invoice checker over the generated file and shows the result (valid, warnings or errors) in a dialog.

Notification rules: the rule types come from the modules and plugins that provide them. The rule types of a deactivated plugin (e.g. the CVE-Radar) aren’t offered any more, and its rules wait until the plugin is active again.

App The week strip of the time sheets follows the finger when swiped and snaps to a whole week; the week starts on the first day of the week set in "My account".

The notifications of chat messages show the beginning of the message (in rooms with its author) instead of repeating their title, in the app and in the notification center of the web pages. Only for the recipient while they may read the conversation; mails and pushes keep their generic text.

App The notifications (bell) and the "more" menu slide up over the tabs like the menu of the pages, the tab bar stays visible below them; pulling them down, a tap above them or their button again closes them.

CVE-Radar: a team check can ask every member of the group (e.g. everyone checks the own client); each answer is stored and the check stays open until all members answered who logged in within the last 90 days (configurable). Before, every answer replaced the one before.

Calendar: the start time of an entry can now be changed by dragging its top edge, not only the end time.

Notification mails (e.g. about new chat messages) now contain a link to the chat or the concerned entry.

Notification rules: the menu entries of plugins (e.g. the CVE-Radar) can be chosen as menu counter and as link of the notifications.

App The badges of the chat and the notifications follow at once: a push sets the bell’s count when it arrives, and a chat read or a notification done in the pages removes them right away, no longer only with the next update a minute later.

Calendar: a time sheet opened from a break keeps its end time when the start time is changed.

Chat: messages of others can be reported to the administrators, and users can be blocked: no direct messages, notifications, mentions or search hits of them.

CVE-Radar: the libraries of the inventory are matched by package and version against the advisories of OSV.dev (Maven, npm, PyPI, NuGet, Packagist, Go, crates.io), also when the NVD names them late or not at all.

Login: the number of character classes a password must contain (e.g. 3 of 4) is configurable next to the minimum length; login names in projectforge.2fa.exemptUsers need no second factor, e.g. the account of an app store review.

Mobile app (in preparation): the chat tab shows no menu of the web version, tapping the chat button again leads back to the chat start page; sharper address images in the address list.

Fixes: the gross sum of an invoice is the net sum plus the vat sum and no longer differs by a cent from the e-invoice; the e-invoice export refuses sums that differ from the invoice; the invoice document shows quantity and unit price with all their decimals.

Setting projectforge.2fa.exemptUsers: login names that need no second factor, e.g. for the account of an app store review.

Chat: messages of others can be reported to the administrators, and users can be blocked (no direct messages, no notifications, mentions or search hits of them).

CVE-Radar: the libraries of the inventory are matched by package and version against the advisories of OSV.dev (Maven, npm, PyPI, NuGet, Packagist, Go, crates.io), also when the NVD names them late or not at all; a matching advisory becomes a vulnerability whatever its score.

Passwords: the number of character classes a password must contain (uppercase letters, lowercase letters, digits, special characters, e.g. 3 of 4) is configurable next to the minimum length.

Address images: larger preview images, so they look sharp in the app’s address list (existing previews are renewed when the images are shrunk again in the administration).

App The chat tab shows no menu of the web version; tapping the chat button again leads back to the chat start page.

Invoices: the invoice document and the e-invoice use the same formulas

E-invoice: new fields order number (BT-13), department of the orderer (BT-56) and cost center (BT-19) on the invoice and the account; the form labels name the e-invoice term (BT-x); the invoice template gets the variables Bestellnummer and Kostenstelle, the department is part of the address.

Mobile app (in preparation): the logins of several servers are kept and the server can be switched in the account menu; time sheets choose the structure element in the task tree, with a search over the whole path, and cost units in a scrollable selection box; a warning if the app is too old for the server or the server too old for the app, "My account" marks outdated apps.

Error digest: sent once a day at 07:00, only urgent problems send it early (at most once an hour); configurable.

Order mails: clearer layout with the buttons at the top and a button to the order notification settings.

Fixes: connecting the app behind an SSO proxy works at the first attempt, also when the proxy returns the browser without the parameters of the link.

App A warning if the app is too old for the server or the server too old for the app; "My account" marks outdated apps.

App The logins of several servers are kept, and the server can be switched in the account menu without logging in again; another server is added there too.

E-invoice: new fields order number (BT-13), department of the orderer (BT-56) and cost center (BT-19) on the invoice and the account (department, cost center); the labels of the invoice and account forms name the e-invoice term (BT-x) the field is sent in. The invoice template gets the variables Bestellnummer and Kostenstelle (with isBestellnummer/isKostenstelle), the department is part of the address.

App Time sheets: the structure element can be chosen in the task tree (level by level, starting at the current one, with a search in the level and everything below it), the search finds words of the whole path, the path is shown above the title, cost units are chosen in a scrollable selection box with number and text, the time sheet tab is no longer marked as under construction, and the templates open in a list instead of a row of chips.

Order mails: clearer layout with the buttons at the top, and a button to the order notification settings.

Error digest: the regular digest is sent once a day at 07:00 instead of every hour, only urgent problems (security, data, immediate events) send it early, at most once an hour. Configurable by projectforge.support.errorDigest.interval, sendAt and urgentMinGap.

App Connecting the app behind an SSO proxy works at the first attempt, also when the proxy brings the browser back from its login without the parameters of the link.

Invoices: the cost 1 and cost 2 units of a cost assignment can be copied without dots, in the folded position as well as beside the fields of an open one, e.g. for entering them in another accounting system.

Chat: code blocks in messages and room descriptions have a copy button.

Fixes: Kotlin scripts no longer fail with "Unresolved reference 'cveradar'", the classes of the CVE-Radar and IHK plugins are in the script classpath again.

Chat: code blocks in messages and room descriptions have a copy button.

Invoices: the cost 1 and cost 2 units of a cost assignment can be copied without dots, e.g. for entering them in another accounting system.

Scripting: Kotlin scripts failed with "Unresolved reference 'cveradar'", the classes of the CVE radar and IHK plugins were missing in the script classpath.

Mobile app (in preparation): notifications of the web version with push messages (iPhone, APNs); an address book like the Contacts app, also offline; login behind an SSO proxy, recently used servers, more room for the pages and the light or dark appearance of the web pages.

CVE-Radar: a notification rule for new findings without details, a rule type for outdated lists of libraries of a component, a description tab in the file of a case, and a faster start page.

Calendar on small screens: the calendar chooser has a line of its own instead of being covered.

Fixes: Kost2 no longer missing in overviews such as the structure tree, the project list or the cost unit selection of a time sheet (e.g. after a project was reactivated); in the order book a payment schedule dated in a following month also defers the invoice of a finished position; the file of a CVE-Radar case without a CVE opens again.

Mobile app: notifications and push (iPhone)

Mobile app (in preparation): time sheets

CVE-Radar: notification without details and about outdated lists of libraries

Mobile app (in preparation)

Faster first page of big lists: the CVE-Radar start page no longer loads every vulnerability to build the list

Calendar on small screens: the calendar chooser has a line of its own under the title and the buttons instead of being covered by them.

CVE-Radar: the file of an incident opens again and has a tab for its description

Kost2 sometimes missing in overviews such as the structure tree, the project list or the cost unit selection of a time sheet, although it existed: for instance after a project was reactivated, or for a cost unit created while the caches were being reloaded in the background.

Order book: a payment schedule dated in a following month now also defers the invoice of a finished position (filter "to be invoiced", next invoice date)

CVE-Radar: ad-hoc check of lockfiles, SBOMs or a zip of such lists against all vulnerabilities without storing anything; export of the open findings of a project with a prompt for advice on the fix; research of a new case with an AI system; download and import of a case as JSON; upload of all lists of a component in one zip and the lockfile of pnpm.

Digital business cards: add a card to the Apple Wallet (needs a Pass Type ID certificate).

Mobile app (in preparation): login via the browser with second factor, the own business cards also without network, connected apps listed in My account.

Mobile devices: on narrow or low screens the logo row and the status bar are hidden, smaller paddings, a compact list footer, scrollable tabs; very low screens scroll.

Fixes: planned invoices no longer count in the statistics of the invoice list.

Digital business cards: add a card to the Apple Wallet (needs a Pass Type ID certificate, see the admin guide).

CVE-Radar: ad-hoc check of uploaded files against all vulnerabilities

CVE-Radar: research a new case with an AI system

CVE-Radar: download a case as JSON and import it again

CVE-Radar: export the findings of a project, with a prompt for advice on the fix

CVE-Radar: more ways to upload the libraries of a component

Mobile app (in preparation)

More room for content on mobile devices

Outgoing invoices: planned invoices no longer count in the statistics of the invoice list (gross, net, open, overdue).

Small screens: on a very low display (e.g. a phone in landscape) the page now scrolls, so the content below the header is reachable.

Java 21: required from 9.2 on, the executable JAR no longer starts on Java 17.

Files: the JCR (Apache Oak) is removed, attachments live in the database and data transfer files in the file system.

CVE-Radar: cases and team checks, import of vulnerabilities from the NVD, an inventory of systems with a technology catalogue and library import (SBOM, lockfiles, package lists), matching of vulnerabilities against the inventory with a notification rule for new findings, a file per CVE with ratings, measures and discussion.

Digital business cards: several cards per user with a QR code, data taken over from an address.

Order notifications: per user at once, as a daily summary or not at all; a recipient gets at most one mail and one SMS per rule and day.

Forecast and contribution margin: new table "Breakdown of the forecast", preliminary revenue of unbooked invoices from the cost assignments.

Projects: the status is acquisition, active, paused or ended.

Performance and usability: fewer requests per page view, upload speed in the data transfer, sideways paging of chat images, dialogs ask before discarding input.

Fixes: invoice lists with stale paid status after a mass update, outdated results in long searched lists.

CVE-Radar (plugin, not active by default): first part with real data

CVE-Radar: vulnerabilities from the NVD

Data transfer (also public): the upload shows its current speed in kB/s or MB/s.

CVE-Radar: inventory of systems

CVE-Radar: file of a CVE with ratings, measures and discussion

Digital business cards

Order notifications (a button on the order list and beside the e-mail checkbox of each order): choose per user whether the e-mails about changed orders arrive at once, as one daily summary or not at all, as a default and as exceptions for single projects or customers.

CVE-Radar: vulnerabilities matched against the inventory

Tables no longer store their unchanged column layout again on every page view.

Fewer requests per page view: the unread chat count of the top bar comes with the user status instead of two list requests, it is counted once for menu and status, and the event stream stops retrying after the session expired.

Order statistics, forecast: new table "Breakdown of the forecast" per month with the invoiced sums, the remaining forecast of commissioned fixed price and flat rate positions, of commissioned time & materials positions (run rate) and of not yet commissioned positions (weighted), and the part of the forecast for which an invoice is already planned.

Chat: the images of a message stand side by side (scrolling sideways when there are many), and the full size view pages through them with buttons and arrow keys.

Dialogs with input fields ask before they are closed by a click beside them, Esc or the close button once something was entered, so the input is no longer lost by accident.

Properties editor: the descriptions link to the matching sections of the admin guide and support code, bold text and links.

Java 21 is required from version 9.2 on: ProjectForge is compiled for Java 21, the executable JAR no longer starts on Java 17. The Docker image already contains Java 21.

Contribution margin: the preliminary revenue of unbooked outgoing invoices is taken from the cost assignments of the invoice positions (kost2 → project) if they are completely defined; otherwise from the project of the invoice as before.

Files: the JCR (Apache Oak) is removed, all files are stored by the file store (attachments in the database, data transfer files in the file system). An installation still using the JCR has to migrate with 9.1.x first: ProjectForge refuses to start, if the JCR contains files, which weren’t migrated. The JCR backup and the migration were removed from the system page, projectforge.jcr.maxDefaultFileSize is now projectforge.files.maxDefaultFileSize (the old key is still read, with a warning on start until it is renamed; obsolete JCR properties are reported too).

Projects: the status is one of acquisition, active, paused and ended (or not set). Existing projects were mapped: build phase, productive and maintenance became active, on hold became paused. The history still shows the former values.

The system configuration page now offers the projectforge.properties editor and the comparison with its backups for administrators, as the System page does.

User menu: "Customize my menu" comes before "My account".

Invoice lists: an invoice that was marked as paid could stay in the filter "unpaid" (and in its sums) after a mass update, even after the caches were refreshed.

Notification rules: a recipient gets at most one mail and one SMS per rule and day, even if a rule created several notifications. The next day, it reminds again. Tests are not limited.

Long lists (orders, invoices, time sheets, accounting records, vulnerabilities): a search could show an outdated, e.g. empty, result after changes made at the same time or directly in the database. Reloading the page now always shows the current result.

JCR and Java 17: 9.1.x is the last release that supports the JCR and runs on Java 17. Migrate the files with 9.1.x before updating to 9.2 or later, which require Java 21 (the Docker image already is based on it).

File store: with projectforge.files.store=db all files are stored in the database (schema pf_files), data transfer files in the file system, compressed and optionally encrypted at rest; the JCR files are copied in the background and verified by size and checksum, with a report. Backups: a main dump plus a dump of the files.

Chat: rooms and direct messages with formatting, files, threads, mentions, quotes, search, avatars, end-to-end encrypted confidential conversations and a chat in every data transfer area.

Statistics: contribution margin per order and structure element with a bubble chart, faster forecast and contribution margin, rearrangeable chart tiles, forecast snapshot date, liquidity forecast with a free number of days.

Customers and projects: customer wizard, projects independent of cost units with configurable number ranges, project contacts instead of fixed roles, project groups, order access of project managers per customer, customer group or business unit, new user right Customers.

Time sheets and vacation: book several days at once, ad hoc bookings, no overlaps on the same cost 2, vacation booked as time sheets automatically, availability entries, team vacation calendar.

Migrated to the new interface: users, team calendars, addresses and campaigns, leave applications and account, employees, scripts, polls, contracts, banking, visitor book, memos, Merlin templates, my account and more; the former React interface is removed.

Notifications and operations: rules notifying in the app, by mail and SMS, a system dashboard with scheduler and caches, an admin log viewer and an editor for projectforge.properties; config.xml is replaced by configuration parameters.

Security: stricter access checks, Content Security Policy, CSRF check for every changing request, POST only for changes, brute force protection for password changes, optional second factor on more pages.

Search and usability: search ignores accents and umlaut spellings, selection boxes without inactive entries and name matches first, a German version of the website.

9.1.x is the last release that runs on Java 17 and supports the JCR (Apache Oak). From 9.2 on there is no JCR any more and Java 21 is required. Installations still using the JCR have to migrate their files with 9.1.x first (admin guide, "Moving the files out of the JCR"); a JCR backup ZIP can’t be imported by later releases.

Chat: the whole emoji catalog with search for reactions and messages, messages and room descriptions share one rich text editor (tables, code, emoji), a flashing siren emoji.

Chat: an offered confidential conversation reaches the recipient on every page with a sound, a blinking tab title and a browser notification; a button on the chat list starts an encrypted chat, a gear sets sound and notifications and shows a log of the last signals.

Chat: "Read" with the avatar under the newest read message of a direct message, the search offers users without a direct message yet, chats of data transfer areas carry a pill leading to the area, the action menu no longer overlaps the divider.

Forecast: completed orders that are not yet fully invoiced appear again in the statistics and the Excel export.

Contribution margin bubbles: the anonymous other projects ignore the project filter.

Data transfer: personal boxes are always listed first, also when searching for a user.

Chat: a gear on the chat list for the sound and the browser notifications, with a log of the last signals (whether the browser rang, when and why).

Chat: in a direct message, "Read" with the avatar of the other one is shown under the newest own message they have read.

Chat: button "Encrypted chat" on the chat list to start an end-to-end encrypted conversation by choosing a person.

Chat: chats of data transfer areas are marked with a "Data transfer" pill in the list and in the title, leading to the area.

Chat: the search also offers users without a direct message yet; a click starts the conversation.

Chat: the whole emoji catalog with search and categories ("More emoji"), loaded only when opened, for reactions and via a new button in the formatting bar for messages; the siren emoji flashes, new emoji :siren-blue: and :siren-red:.

Chat: an offered confidential conversation now reaches the recipient on every page, also in a background tab: a sound (can be switched off), a blinking tab title, a dot on the tab icon and, if allowed, a browser notification.

Chat: messages and room descriptions use the same rich text editor. Messages can contain tables, room descriptions code and emoji. The first line of a room description is shown as a teaser, the rest folds out.

Data transfer: personal boxes are always listed first, also when searching for a user.

Contribution margin bubbles: the anonymous other projects now ignore the project filter (business unit and customer filters still apply), so they are shown when a project is filtered.

Chat: the action menu of a message no longer overlaps the divider above it.

Forecast: completed orders that are not yet fully invoiced are listed again in the statistics and the Excel export, with their open amount in the current (or following) month.

Chat: a confidential message in a direct message is now a confidential conversation, end-to-end encrypted and never stored by the server, until one side ends it; the fingerprint covers both keys. Conversations are more compact, with message bubbles, grouped messages and a separator per day.

Chat: the search of the chat page also finds messages in all readable conversations, with a preview of the newest match; a click jumps to the message. A speech bubble in the top bar links to the chat and shows the unread messages, as does the menu entry.

Liquidity forecast: the number of days can be entered freely (1 to 600), the usual horizons remain as quick picks.

Search: closed task structure elements are no longer found in the menu quick search; the detailed search still finds them, struck through.

Chat: the search of the chat page also finds messages in all readable conversations, each with a preview of the newest match; a click jumps to the message, also in a thread.

Chat: a speech bubble in the top bar links to the chat, a counter shows the unread messages there and at the menu entry.

Chat: more compact conversations with message bubbles (own messages on the right), consecutive messages of the same author grouped and a separator per day.

Liquidity forecast: the number of days can be entered freely (1 to 600), the usual horizons remain as quick picks.

Search: closed task structure elements are no longer found in the menu quick search. The detailed search still finds them and shows them struck through, as do the structure tree, the paths and the lists.

Chat: a confidential message in a direct message is now a confidential conversation. Both sides write back and forth, end-to-end encrypted and never stored by the server, until one side ends it. The fingerprint now covers both keys, so a forged message shows as a difference.

Chat in the data transfer: every data transfer area is a chat room for everybody with access to it (its admins moderate), files sent in the chat go into the area; external users see only the files. The personal box of another user opens the direct message with them. The buttons Chat and Direct message and the chat page show the unread messages.

Chat: every conversation lists its members with their avatars; messages can quote another message; a search box narrows the direct messages and the rooms; the room page shows the formatted description of the room and is edited there.

Avatars: users upload their own picture under My account, cut square in a new image editor (also used for the images of addresses); it is shown in the chat and in the user menu to all users sharing a group. Administrators can change or remove any avatar.

Projects: Excel export of the project list; the project selection and the project filters show the customer of each project; the first proposed local project number can be set per number range.

Notifications: the bell lists the archived entries of the last 90 days, so a notification confirmed by mistake can still be opened.

Usability: group fields show the members of a group on hover, customer and project groups in list filters show what they comprise; deleted or deactivated users, groups and employees are struck through in more places; users are found by their nickname; a selected structure element is removed with its own (x); in a list with more than 100 entries a button selects the first 100 for a mass update.

Fixed: with the mail server unreachable, saving an order waited once per recipient of its notification and every notification mail waited for the timeout; the gateway serves the subscriptions of team calendars and of the weeks of the year; the project wizard offered no cost 2 types after "Configure another element".

Addresses: a small image editor cuts a square out of a chosen image, or the one already shown, before it is uploaded (drag and zoom).

Chat in the data transfer

Chat: every conversation, also of a data transfer area, lists its members with their avatars (icon at the top right).

Number ranges: the first proposed local project number can be set per range in the accounting configuration, e.g. 5..01 instead of 5..00; lower numbers can still be entered.

Group fields (e.g. the access lists of calendars, address books and polls): hovering a group shows its members, for whoever may see the group.

Project list: Excel export of the filtered projects with all their fields.

Avatars: users upload their own picture under My account (cut square in the image editor); it is shown in the chat and in the user menu to all users sharing at least one group. Administrators can change or remove the avatar of any user. A click on the own avatar in the user menu opens it under My account.

Chat

List filters: customer and project groups show the customers and projects they comprise as tooltip.

Deleted or deactivated users, groups and employees are now struck through in more places: lists with several names (group members, access lists, contact persons, substitutes), the task tree, chat, history, attachments, the vacation account, booking grants, the HR view, absence charts and the notification log.

Mass update

Notifications: the bell has a button "Archived entries" listing the confirmed or finished notifications of the last 90 days, so a notification confirmed by mistake can still be read and opened.

Project selection of the edit pages and project filter of the lists and statistics: each project shows its customer in brackets.

Structure element selection: a selected structure element is removed with its own (x) (not for mandatory fields), the home icon opens the tree.

User selection: users are also found by their nickname.

Gateway: subscriptions of team calendars and of the weeks of the year are served, holidays in the language of the user; the token within the subscription url is checked as on the main instance.

Notifications: if the mail server isn’t reachable, a failed notification mail is logged only once with its stack trace and its cause is shown in the delivery state; the further mails of the run wait for the next run instead of each waiting for the timeout.

Orders: if the mail server can’t be reached, saving waits only once for it instead of once per recipient of the notification.

Project wizard: after "Configure another element" the project step offered no cost 2 types any more, so the next project had to get them in its edit form afterwards.

Chat (menu Common → Chat): rooms with chosen users and groups, and direct messages to any user, readable by their participants only, administrators neither. Messages with formatting, files of any type (stored in the data transfer), emoji reactions, threads that can be followed and marked unread, and @ mentions notified in the app and by mail. Confidential messages in direct messages are end-to-end encrypted and never stored by the server. Behind a reverse proxy, the chat needs an unbuffered connection, see the administration guide.

Search: search and selection boxes ignore accents and German umlaut spellings ("Mueller" finds "Müller", "Strasse" finds "Straße"), completely after the next nightly re-index; deactivated users are no longer found in the search of the main menu.

Administration: the backup script of the administration guide compresses the dump of the files to about half the size.

Fixed: the order and invoice caches refreshed each other endlessly when an invoice referred to a deleted order position; projects are found by their number and the name of their customer; outgoing invoices saved in the new interface are found by their customer at once; the time sheet filter for sub structure elements can be switched off; postal codes like "D-34286" are no longer linked as JIRA issues; the log of a running script is shown again.

Chat: confidential messages in direct messages (e.g. for a password), end-to-end encrypted in both browsers, relayed live and never stored by the server, shown to the recipient only once.

Chat

Chat: a file of a message can also be opened in its data transfer area, besides downloading it.

Chat: a message can be marked unread, threads with unread replies are marked, and in a thread a line shows the first unread reply.

Search and selection boxes ignore accents and German umlaut spellings: "Andre" finds "André", "Mueller" and "Muller" find "Müller", "Strasse" finds "Straße", and vice versa. Applies to entries indexed after the update, i.e. completely after the next nightly re-index.

Admin guide: the backup script compresses the dump of the files (about half the size), because pg_dump writes their contents hex encoded.

Outgoing invoices: invoices saved in the new interface were not found by the name of their customer until the next search index rebuild.

JIRA links: an issue key needs at least two leading uppercase letters, so a postal code like "D-34286" in a text is no longer linked as an issue.

Project selection: projects are also found by their number (e.g. 7.002) and by the name of their customer.

Scripts: showing the log of a running script could fail with an error.

Time sheet list: the filter including all sub structure elements could not be switched off. It is replaced by the filter "without structure sub elements", off by default.

The order and invoice caches no longer refresh each other endlessly (e.g. during the daily order book snapshots) when an invoice refers to a deleted order position.

Search in the main menu: deactivated users are no longer found (they still are in the user list).

Ad hoc bookings: who may edit the time sheets of others on a structure element grants colleagues the booking of own time sheets for a period, optionally restricted to some cost units; the colleagues see only the granted structure elements. Employees without this right may propose such a booking, the project management accepts the time sheets afterwards (reminded by a new notification rule).

Notifications: delivery steps by SMS; new rule "Creditor invoices due"; the rule editor lists the variables for subject and text with example values and a copy button, the preview shows the texts with example values.

Creditor invoices: marked as overdue already 2 working days before the due date.

Time sheet form: the recently used entries show the consumption of their budget and can be sorted, filtered and arranged per column (remembered per user); the consumption bar tooltip shows budget, booked and remaining person days.

Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree or found by the same title.

Order statistics: the bubble size of the contribution margin chart shows the contribution margin; titles can be switched on.

Fixed: structure elements created or moved during a background reload could vanish from the structure tree, the responsible person was missing after a change; an invalid search syntax shows a hint instead of an empty list; the info of a structure element is only answered to users who may see it; the password reset mail is limited per user, per client and in total, so it can no longer be requested over and over.

Ad hoc bookings

Consumption bar (structure tree, task list, time sheet form): the tooltip shows the budget, the booked and the remaining person days as a calculation, an overbooked budget in red.

Time sheet form: the recently used entries show the consumption of their budget, and the search also matches it.

Creditor invoices

Notifications

Time sheet form: the table of recently used entries can be sorted and filtered per column, its columns can be reordered, resized, pinned and hidden; the layout is remembered per user.

Notifications: delivery steps by SMS to the mobile phone number of the recipients (if SMS is configured), with an own SMS text of the rule or otherwise the subject and the link.

Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree (the title may differ, e.g. "ACME" for "ACME Inc.") or found automatically by the same title.

Order statistics, contribution margin bubble chart: the size of a bubble shows its contribution margin instead of its costs. The switch "Show titles" labels the own bubbles with their short title and contribution margin %; switched off, the names are in the tooltip only.

The info of a structure element (title, path, project, customer, consumption) was answered to every logged-in user; now only to users who may see the structure element.

Structure tree: a structure element created or moved while the tree was being reloaded in the background could vanish from the tree until the next reload, so no sub-element could be created below it ("Parent structure element is required but not found").

Structure tree: after a structure element was changed, its responsible person was missing in the tree until the next reload.

Password forgotten: the reset mail is limited per user, per client and in total, so it can no longer be requested over and over (mail bombing, invalidating a pending reset link).

Lists: a search term that isn’t a valid search syntax (e.g. "Project: Alpha") now shows a hint instead of an empty list without explanation.

Contribution margin: the order statistics break it down by orders and structure elements (a tree with a monthly chart per row) and show a bubble chart of revenue, contribution margin % and costs per project, project group, customer or customer group, in the colors of the business units.

Former React interface removed: all its pages are part of the new interface, old links (/react/...) lead there.

Security: the CSRF token is checked for every changing request of a logged-in session; changing requests (filters, templates, search index, logout, cancelling a login) are accepted as POST only; history comments need update access; npm dependencies updated.

Fields with several entries: entries can be selected, copied, cut, pasted and dragged into another field of the same kind; Ctrl/Cmd+Z undoes a change.

Administration: structure tree and list show the groups with access rights on an element; the time sheet mass update remaps the cost unit by type, keeping the structure element.

Polls: templates have the state "Template" and no deadline.

Fixed: import of incoming invoices (currencies, periods, header-only exports); cancellation invoices listed with the positions they cancel; the order edit page no longer jumps; the mass update log shows the updated entries again.

Order statistics, contribution margin: bubble chart of revenue, contribution margin % and costs (size) per project, project group, customer or customer group. On request, the other projects of the selection (e.g. of the whole business unit) are shown for comparison, anonymously. The bubbles take the colors of the business units, set with the business units (customer groups page). A switch labels all bubbles with their short title instead (the group name, for a single project its short name).

Fields with several entries (users, groups, employees, …): entries can be selected by sweeping over them with the mouse or by clicking, then copied (Ctrl/Cmd+C) or cut (Ctrl/Cmd+X) and pasted into another field of the same kind with Ctrl/Cmd+V, or dragged there. Ctrl/Cmd+Z undoes a change of the field.

Structure tree and structure element list: column with the groups having access rights on an element (administrators only). Hovering shows the rights of each group, a click opens the access rights of this element.

Time sheet mass update: remap the cost unit by type while every time sheet keeps its structure element, e.g. after a project was linked to it.

Order statistics: the contribution margin broken down by orders and by structure elements, as a tree with a monthly chart per row. The values are calculated from the invoice positions and the time sheets × hourly rate; what can’t be assigned stays with the project as residual.

Polls

Import of incoming invoices

Mass updates: the log window shows the updated entries again.

Cancellation invoices are listed with the order positions they cancel, right after the cancelled invoice (e.g. 12345 and 12345-S), also in the order and forecast exports. On the order page both are struck through; together they still count 0 as invoiced.

Order book: the edit page no longer jumps while a field is changed.

The former React interface is removed: all its pages are part of the new interface, and old links (/react/...) lead there.

The CSRF token is checked for every changing request of a logged-in browser session, no longer only for requests identifying themselves as the new interface; cancelling a login or password reset is accepted as POST only.

Appending a comment to a history entry needs update access to the entry’s object, and is only possible for objects supporting comments (users, groups).

npm vulnerabilities in projectforge-next fixed: next 16.4.2, dompurify 3.4.17 and vitest 4.1.12.

Requests that change something (list and calendar filters, templates, search index, logout) are accepted as POST only; the GET variants of the former React interface are removed.

New interface: bank accounts, transactions and their import (a page of its own with a preview of the differences), visitor book (offers visitors already recorded, filter of incomplete visits), memos, Merlin Word® templates and the job monitor migrated; the Sipgate actions are a menu of the System page.

Project groups: projects of a common parent project are combined into a group on the customer groups page; the project filters offer the group like a single project, forecast, contribution margin and the Excel exports show a project group column.

Import of incoming invoices: no longer overwrites other invoices of the same creditor, keeps invoices with surplus positions, takes paid date and amount paid from the position import, reads German tax rates of DATEV files correctly and shows what changed in a modified row; the comparison and the preview of large files are much faster, and the page stays open after committing.

Configuration: parameters with JSON values can be edited as text and compared with every former version.

Old links: links to pages of the former interfaces are only forwarded if they were sent by mail or shared (orders, to-dos, vacation, data transfer, polls, password change); other bookmarks should be renewed. The 2FA dialog of the old interface is removed.

Improved: list filters with a checklist offer "choose from all"; project wizard with tabs and a summary of what will be set up; mass updates link their log again; deactivated users struck through.

Fixed: calls from an external phone via sipgate; project and cost unit numbers of number ranges without configured segments; structure element fields show a renamed or moved element right away; amounts with two decimal places and currency.

Configuration parameters with JSON values

Project groups: projects belonging together under a common parent project can be combined into a group on the customer groups page. The project filters of the order book, invoices, projects, cost 2, timesheets and order statistics offer the group like a single project; forecast, contribution margin and the Excel exports of the forecast, order book and invoice list show a project group column as soon as one of their projects belongs to a group.

Visitor book: while a new visitor is entered, the name offers the visitors already recorded with it; picking one adds the visit to that visitor instead of creating a duplicate. The company names in use are completed, and the dialog of the first visit opens right after a new visitor is saved.

Visitor book: a pinned filter shows the visitors with incomplete times of visit, e.g. a departure not entered yet. After a visit is saved, the list is shown again.

List filters with a checklist (customer, project, business unit): they say that they only narrow the current result, are narrowed by the list’s search term as well, and offer "choose from all" to pick values the current result doesn’t contain. In the time sheet list they offer values without a period, too.

Sipgate: downloading the configuration, synchronizing and resetting the contacts are now a menu of the System page (shown if Sipgate is configured); the separate Sipgate page and its menu entry are gone. While an action of the System page runs, a progress bar shows; the contact sync no longer reloads all synchronized addresses.

Structure element fields: a click on the selected structure element opens the tree, like the pencil button. Order positions show the consumption bar of their structure element, which leads to its time sheets.

User list: deactivated users are shown struck through.

Mass updates of time sheets, invoices, incoming invoices, projects, addresses, access rights and liquidity entries link their log again: the log viewer shows what the run changed.

Banking

Import of incoming invoices

Creditor invoices: the old upload page of the CSV import has been removed; the import runs in the new interface.

Job monitor migrated to the new interface: running and recently terminated background jobs with their progress, cancelling asks for confirmation first. After an import the page returns to the import once its job has finished, but only to a page of the same server. Old links are redirected.

Memos migrated to the new interface: list and form. A memo stays visible to its owner only.

Visitor book migrated to the new interface: list with the latest visit and the number of visits, form with the contact persons, visits entered in a dialog (preset with today and the current time). Deleting the last visit of a visitor no longer fails, and a visit can no longer be assigned to another visitor. Old links are redirected.

The classic version of the address campaign values (list, mass update and the address form opened from it) has been removed; the new interface covers everything.

Merlin Word® templates migrated to the new interface: list, admin form with the variables and the execution, single and serial.

Links of former versions

Import of incoming invoices

Number ranges: a range with customers and without configured segments shows its project and cost unit numbers by its digits (e.g. 7.0001.0 for one project digit) instead of 7.000.10.

Project wizard: tabs and a pinned action bar as on the edit pages; the action step lists what will be set up (new customer, new project, path of the new structure elements, access rights) and what is still missing; the finish button is always clickable, and a progress bar shows while the setup runs.

Phone call: calls from an external phone without an assigned number were refused by sipgate.

Structure element fields show the new name and path right after a task was renamed or moved, without a reload.

Amounts

The import of incoming invoices shows what changed in a modified row: the old and new value in every compared column, the gross amount included, and the changed fields without a column of their own (e.g. the paid date of a position-based file) in the status cell.

Groups and team events no longer offer a link to the old interface: its pages no longer worked.

Job monitor: the cancel button of a job is only offered to users allowed to cancel it; others saw a button without effect.

The 2FA dialog of the old interface was removed: a second factor for protected actions is only asked for in the new interface. Pages of the old interface get an access denial instead, old links lead to the start page.

Security: changing, deleting and restoring an entry is decided by the stored entry, not only by the posted one; stricter Content Security Policy and new security headers; requests that change something are sent as POST; more pages require the second factor of their area; QR codes are no longer delivered as image links.

Customers: creating, changing and deleting customers needs the new user right "Customers" (finance); being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard also works with only one of the rights for customers and projects.

Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including invoices, forecast and contribution margins.

Configuration: config.xml is replaced by configuration parameters with their own editors (holidays, JIRA servers, contract types, accounting settings) and taken over automatically on the first start; projectforge.properties can be compared with its backups.

New interface: polls (reworked, with templates and a results tab), contracts, currency pairs, skill matrix, inbox and outbox, two-factor setup, customizing the menu, e-invoice checker and birthday butler migrated.

Removed: the d.velop interface.

Fixed: the forecast of the current month adds the invoiced figures and the remaining forecast, the plan is the order book of the planning date (deleted orders corrected); sorting customers by number; a damaged JCR repository no longer prevents the start when files are stored in the database.

Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including their invoices, forecast and contribution margins (new tab in the customer groups editor).

System page: projectforge.properties can be compared with its backups, or two backups with each other. Optionally the order is ignored, so only changed values and comments are shown; values of secrets stay hidden, only whether they changed is shown.

Customize my menu: migrated to the new interface. Entries are dragged or clicked into the own menu, groups can be added, renamed and removed; empty groups are no longer stored as broken entries.

When arranging chart dashboards, the drag handle (top left of a tile) and the tile menu (top right) are shown in solid orange.

E-invoice checker: migrated to the new interface. Validity, invoice data, seller, buyer and amounts are shown side by side, amounts in the invoice’s currency; embedded attachments are downloaded with a click.

Notifications to be confirmed: several of them are shown underneath each other in one toast instead of stacked behind each other, and the toast steps aside while the bell’s list is open.

Birthday butler: migrated to the new interface. The current month is preselected, and without a configured organization the page says so instead of offering a download that can only fail.

Two-factor authentication setup migrated to the new interface: mobile phone, authenticator app and WebAuthn tokens on one page, a token is renamed or deleted in a dialog. Deleting a WebAuthn token now also requires a recent second factor. Old links are redirected.

config.xml replaced by configuration parameters

Contracts migrated to the new interface: list with a period filter on the date, form with suggestions from other contracts, the configured contract types, JIRA links, attachments and cloning. A year filter stored by the former list is still shown and can be removed. Old links are redirected.

Customers: new user right "Customers" (finance), like the one for projects. Creating, changing and deleting customers needs it with read and write access; being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard needs it for new customers.

Polls migrated to the new interface and reworked: list, form and answer page, questions reordered or taken from templates (built-in ones or own polls marked as template), polls cloned, a results tab beside the Excel export. Attendees and full access also by group (later members included). Multiple choice questions accept several answers again, answers stay with their question when questions change. Only users with full access see the results; finished polls can no longer be answered or changed, and their end is mailed once. Old links are redirected.

Inbox and outbox migrated to the new interface: list and form, with the autocompletion of the free texts. Old links are redirected.

Customer wizard: also usable with only one of the rights for customers and projects. With the right for customers only, a new customer is created (and optionally its structure element); with the right for projects only, a project is set up for an existing customer. With both, "No project" creates the customer only. The groups and their access rights are optional, and no group is preselected any more.

Skill matrix migrated to the new interface: list and form, ratings as stars, the Excel export of the statistics in the list, and a mass update of rating, interest and comment. Old links are redirected.

Currency pairs migrated to the new interface: list with the rate valid today, form with the conversion rates of the pair, edited in a dialog directly in the form. For a new rate, the rates of both directions are proposed from the online source for its date; the rate valid today is marked, rates still ahead are shown muted. Old links are redirected.

Customer list: sorting by the customer number works again.

Forecast of the order statistics and its Excel export: in the current month, the invoiced figures and the remaining forecast are added (as well as the invoices and the forecast of the plan), instead of taking the greater value. The cumulated forecast and plan now match the sums of the project overview. The note on this in the Excel sheet 'Grafiken 1' is removed.

Forecast plan: the plan is the order book of the planning date. The forecast charts of the order statistics now include the orders deleted since, as the Excel export does. Orders already deleted on the planning date are no longer part of it: daily (incremental) order book snapshots kept the orders deleted since the beginning of the month. This is corrected for existing snapshots as well.

Files: with projectforge.files.store=db, a JCR repository that can’t be opened (e.g. damaged) no longer prevents the start. ProjectForge starts without it and logs an error; files not yet migrated out of the JCR are missing then, and the migration, backup and sanity check of the JCR are skipped.

Lists migrated to the new interface ignore columns and a sort order stored by the old list for columns it no longer has; columns missing from a stored order appear in their usual place instead of at the end.

Properties editor: values of all parameters ending in "key" (e.g. projectforge.receiveSmsKey) are treated as secrets and no longer shown.

The d.velop interface (synchronization of customers and vendors as trading partners) was removed.

More pages require the second factor of their area: the imports of salaries, incoming invoices and bank account records, the upload of incoming invoices, the bank accounts, currency pairs and conversion rates, the customer groups and the project wizard (finance), as well as the structure wizard, the caches and the Sipgate page (administration). The system statistics no longer require the second factor of the administration.

The QR codes of the authenticator key (two-factor setup), of the REST client token (my account) and of the calendar subscriptions are sent within the response instead of as an image link, so the secret or token no longer shows up in access logs. QR code images are not cached anymore. The WebAuthn options no longer contain the session id, and changes of the two-factor setup check the CSRF token themselves.

Security hardening

Customer wizard: sets up customer, project with cost 2 types, structure element and groups with access rights in one step, with a preview; group names follow a configurable naming convention.

Projects: a contact person and any number of further ones, as in orders, replace the project manager, the head of business manager and the sales manager (migrated).

Data transfer: the external access of an area has moved to the new interface; areas with external access are administered on the internal instance and synced to the gateway.

Administration: editor for projectforge.properties with descriptions, defaults and a backup before every save; functions can be switched off by configuration (menu entries gone, pages and REST services 404).

Vacation: leave account entries migrated to the new interface; vacation and absence entries can be edited as the other kind.

DATEV import: one upload fills both accounting records and chart of accounts.

Fixed: saving a changed entry in the new interface no longer empties its creation date (lost dates restored from the history); menu visibility with a list of several groups works.

Switching off functions

Groups: a configurable naming convention (configuration parameter "Group nomenclature": description, pattern of customer and project fields, suffixes per role, letter case). The project and structure wizards suggest the names of new groups following it, and its description is shown at the name of a group and in the wizards.

Customer wizard: sets up a project in one go – the customer (an existing one or a new one), the project with its cost 2 types, its structure element below a chosen one, and the groups of team, managers and externals (existing ones or new ones with their members) with their access rights, shown in a preview before anything is saved. Available to users who may create customers, projects and structure elements, who may create groups and access rights through the wizard as an exception. Offered on the customer list, the project list, the structure tree and the task list.

Vacation and availability: an entry can be edited as the other kind ("Edit as absence" / "Edit as vacation"), like time sheets and calendar events (now "Edit as event" / "Edit as time sheet", formerly "Switch to …"). Person, period, comment and substitutes are taken over into a new entry, created only when it is saved; an entry already saved stays as it is. The button’s tooltip says so.

Administration → System: editor for projectforge.properties. All parameters grouped by topic with descriptions and defaults, search, secrets masked. Before every save a copy of the file with a timestamp is written; changes take effect after a restart.

Availability entries: the location of a new entry is no longer preset to remote, and an empty type or location is shown as "Not specified". New type "Mobile Tätigkeit" (mobile activity) for working remotely without a workation; installations with their own list of types (projectforge.availability.types) add it there.

DATEV import: one upload of the tax office’s file fills both tabs, accounting records and chart of accounts, so each can be reconciled without uploading the file again.

Data transfer with a gateway

Data transfer: the external access of an area (login with the area’s password, then its files) has moved to the new interface. The area’s link now points there; links sent before lead there as well. As in the area itself, a click on a file opens its details (read-only for files of others), the files are sorted newest first, and the column layout is kept (in the browser). Own uploads can now also be encrypted. External users no longer see who uploaded the other files unless they are logged in to ProjectForge as well and have access to the area there (who also see its activities), and can no longer rename files of others. Logging in to or out of the external access no longer ends a login to ProjectForge in the same browser.

Projects: a contact person plus any number of further contact persons, as orders have them, replace the project manager, the head of business manager and the sales manager (migrated: the project manager becomes the contact person, the others further contacts). All contacts have the same access to the project and its orders and invoices; the project list shows them in one column, the mass update sets the contact person, and picking a project in an order prefills its contacts.

Leave account entries (corrections of the leave account) migrated to the new interface: list and form. HR staff can add a correction for the employee shown directly in the vacation account; a correction opened there returns to it. Old links are redirected.

Menu visibility (projectforge.menu.visibility.*): a list of several groups works, separated by comma or semicolon (only a single group was recognized, a list not at all).

Saving a changed entry in the new interface no longer empties its creation date. The date of the last change is always set by the server. Creation dates lost this way are restored from the history.

Employees: list and form in the new interface; status, weekly hours and leave days edited in dialogs.

Cost search: in the new interface, also as a movable panel on every page (Alt+K) or a small window of its own.

Edit forms: "Create" for a new entry, "Save" for an existing one; saving never creates a copy.

Availability: "Reachable if urgent" merged into "Reachable if needed"; the public comment, shown in red in the form, is visible to the team, also in the tooltips of the absence charts.

Website: German version of the pages, FAQ, changelog and guides at projectforge.org/de.

Invoices: an invoice with deleted positions only can be deleted and restored again.

Website: German version of the pages, the FAQ, the changelog and the user, administration and quick start guides at projectforge.org/de, with a language switch; the help link of the search field opens the German user guide for German users.

Availability: "Reachable if urgent" is merged into "Reachable if needed". The comment of an entry is called "Public comment" and is shown in red in the form; every team member who sees the entry sees it, also in the tooltips of the absence charts (e.g. the chart of a vacation’s substitutes).

Cost search: migrated to the new interface. Its menu entry shows it as a movable panel over the current page, which stays open on every page (also via the button in the top bar or Alt+K; the position is remembered). It can also be opened in a small separate window.

Edit forms: a new entry is saved with "Create", an existing one with "Save". Both are separate writes: saving an existing entry can no longer create a copy of it, and creating one never overwrites an existing entry.

Employees: the list and the form of the employees are migrated to the new interface. Status, weekly working hours and annual leave days are edited in dialogs directly in the form; the entry valid today is marked, entries still ahead are shown muted.

Invoices and incoming invoices: an invoice stored earlier with deleted positions only can be deleted and restored again; only saving it is refused.

Address campaigns and accounts: saving an existing entry in the new interface no longer adds a copy of it (e.g. setting a campaign inactive); campaign titles are unique.

Orders and invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.

Further fixes: search term of multiple choice selection boxes, column headings of the availability entries in the leave account, build date in the footer.

Address campaigns and accounts: saving an existing entry no longer creates a copy of it (e.g. when setting a campaign inactive). A campaign’s title must not be taken by another campaign.

Footer: the build date is shown without a zone suffix (2026-10-19 instead of 2026-10-19Z).

Orders, invoices and creditor invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.

Selection boxes with multiple choice: after a pick the search term stays selected, so typing the next name replaces it instead of being appended to it.

Leave account: the columns type, availability, location and comment of the availability entries show their headings instead of text keys.

Addresses: list, view and form migrated to the new interface, with vCard import, takeover from pasted text, exports, mass update and the favorite star in the list; the address books are migrated as well.

Address campaign values: migrated to the new interface, with a comparison campaign (e.g. last year’s) whose values can be adopted in the mass update or the form; campaigns can be set inactive.

Availability: new entries for periods of reduced availability (e.g. parental leave, workation) with substitutes and conflicts, shown in the calendar, team calendars, the team vacation calendar and a quick view of the next weeks.

Vacations of others: visible to the members of the person’s groups from 1 January of the current year; the team vacation calendar picks users, freelancers included.

Customers and projects: system-wide unique project numbers, usable without cost units, configurable number ranges with the next free number offered.

Selection boxes and lists: inactive entries only on request, name matches first and found by parts of the name, long lists ask for a search term; inactive entries struck through thin and grey in lists.

Further: notification rules end their pending notifications when deactivated and choose the target of "Open", script editor compares versions, exchange rate API tested on the system dashboard, new test data for the setup.

Fixes: approval of vacations by managers, absences in team calendars on the gateway, banners of manual notification rules, consumption bar of the time sheet form, events converted into time sheets, outdated list requests.

Availability

System dashboard: the exchange rate API is tested daily and shown as an interface tile, so that a change of the API is noticed early. The test can be started at once in the scheduler tab.

Address campaign values: a comparison campaign (e.g. last year’s) shows its values and comments beside the selected campaign’s, with filters on its values and on the differences. Its values can be adopted for a selection in the mass update or one by one in the form. Address campaigns can be set inactive: their values can’t be changed any more.

Availability at a glance

Script editing: a "Show changes" button in the code editor’s toolbar compares two versions of the code side by side (inline on small screens): the code being edited, the stored version or any of the script’s backups.

Selection boxes (groups, users, employees, addresses, address books, accounts, bank accounts): entries whose name matches the search term are listed first, before entries found only by other fields such as organization or email. Groups, user names, projects, customer identifiers, address books, calendars and bank accounts are also found by parts of their name, e.g. PF_Controlling by "controlling".

Selection boxes of users and groups: deactivated or deleted users and groups are shown struck through, in the picked values as in the search results.

Lists: ended projects and no longer active customers are struck through, as in the selection boxes. Entries that are no longer active but not deleted (ended projects, inactive customers, cancelled invoices, rejected or replaced orders, inactive notification rules, deactivated references) are now struck through thin and grey, distinct from deleted entries, each with its own legend entry.

Monthly report: when the configuration parameter "Report time sheets without Kost2?" is enabled, entries booked without Kost2 are marked, in the view as in the PDF export.

Selection boxes

Team vacation calendar: people are picked as users, and the members of a chosen group are shown also without an employee record (e.g. freelancers), with their availability entries, in the chart and the Excel export. Choices and favorites stored before are taken over.

Addresses

Addressbooks: the list and the form of the address books are migrated to the new interface. The list shows the users and groups with full and read-only access in columns of their own.

Lists: for entities with fewer than 100,000 entries, the gear menu offers only the full re-index of the search index, for every user — it takes just seconds there. Larger entities keep the re-index of the newest entries, and the full one for administrators.

Notification rules

Setup with test data: new, larger sample data (customers, projects, orders, invoices, half a year of time sheets, vacations, calendar, liquidity planning) with dates relative to the day of the setup. The sample users get the admin password. The setup page shows the progress. The default plugins are active right after the setup, without a restart.

Vacations of others: the members of the person’s groups see them from 1 January of the current year on (before: up to 31 days after their end), in the calendar, team calendars and their subscriptions alike. Manager and substitutes of a vacation, HR and finance staff see all of it, now also in the vacation list (HR staff with read-only access, finance and controlling included). The team vacation calendar shows the availability entries of others to finance staff as to anybody else: of the members of their groups, from today on.

Customers and projects independent of cost units

Selection boxes for users, employees, projects, customers and cost units no longer offer inactive entries (deactivated users, employees who have left, ended projects and customers). A "Show inactive" checkbox in the selection box brings them back; for users and employees it is available to HR, finance, organisation and administrators only. An inactive entry already set stays selectable.

Address campaign values: list, form and mass update migrated to the new interface. The address opens in a dialog from the organization and address columns; the previous page stays available as the classic version.

Time sheet form: the consumption bar of the task is up to date after booking and no longer counts deleted time sheets.

Notification rules

Order statistics: on a low screen (e.g. a phone in landscape) the page scrolls, so the charts can be reached.

Vacations: managers can approve and reject vacations again; entries stored without half day information were refused with a missing HR right.

Calendars pushed to the gateway: a team calendar including absences is generated for each user and shows exactly the absences this user may see; before, it could show those of another user with the same access to the calendar.

Converting a calendar event into a time sheet: an event ending on another day no longer produces a time sheet spanning several days ("Maximum duration exceeded"); the end time is taken on the start day.

Lists: after quickly paging back and forth (e.g. a year back and forth again), a list could come back from an entry with the filter paged past, when its outdated request was answered last.

Users: list and form migrated to the new interface, with rights adapting to the assigned groups at once, tokens renewed and devices logged out from the form and passwords changed in a dialog; alternative e-mail addresses of other users are rejected.

Team calendars: list and form migrated to the new interface, with the subscription link in the form and the subscriptions of time sheets, weeks of year and holidays in the export menu.

Team vacation calendar: the vacations of the chosen employees and groups shown per quarter or year with adjustable day width, printable in page width, choices saved as favorites; users without HR or finance rights choose from their own groups only.

Vacations: days bar in the vacation account, long vacations squeezed into the bar; the vacation list of users without HR or finance rights shows only the vacations relevant to them.

Time sheets without Kost2: optional hint on saving and a daily notification rule, switched on by a new configuration parameter; the configuration list can be filtered by category.

System dashboard: muted, ignored and resolved problems can be listed from the counts of key figures and subsystem tiles.

Fixes: rights changed together with groups, stricter access checks, carry-over and mails of vacations, Excel export and automatic booking of vacations, contribution margin for contacts of orders, width of the calendar edit dialog.

Time sheets without Kost2

Calendar: the edit dialog of time sheets and events is no longer stretched over the whole width of large screens.

System dashboard: muted problems can be listed with their own status filter, a click on the muted, ignored or resolved count of a key figure or subsystem tile lists exactly these problems, and a problem leaving the list after a status change can be shown again from a notice.

Users, alternative and former e-mail addresses: an address already used by another user is rejected, the primary address isn’t stored twice.

Vacation account: days bar

Team vacation calendar: the vacations of the chosen employees and groups are now also shown on the page, per quarter or calendar year, with an adjustable width of the days (up to fitting the whole period into the window); the Excel export starts with the period shown, and the calendar can be printed (or saved as PDF) in the width of the page. Choices of employees and groups can be saved as favorites. Users without HR or finance rights choose from their own groups only and no longer see previous years. Vacations beginning before a sheet of the Excel export are now shown on it, too.

Calendars: the list and the form of the team calendars are migrated to the new interface. A stored calendar shows its subscription link with a switch for the reminders, the list offers the subscription of time sheets, weeks of year and holidays in its export menu.

Users: the list and the form of the user administration are migrated to the new interface. The rights offered adapt to the assigned groups at once, and tokens can be renewed and devices logged out directly from the form; passwords are changed in a dialog, here as on the own account page.

Vacation list: users without HR or finance rights see their own vacations, the ones they approve or substitute for, and the vacations of their substitutes overlapping their own ones, no longer all current vacations of their group colleagues.

Contribution margin: contact persons and additional contacts of an order see the contribution margin of its project, as in the order book. The access check of orders no longer loads their positions and payment schedules one by one, e.g. for the forecast chart and the contribution margin.

Users: rights changed in the same save as the groups are now stored correctly. A right set together with joining a group was lost, and a right of a group the user left stayed set.

Vacations: stricter access checks (a manager can no longer be swapped in on running or past entries, deleting and restoring use the stored entry and restoring is validated again, the vacations of replacements always count as conflicts, shown with dates and status only where the user may not read them otherwise, leave account corrections need write access); the remaining leave of the previous year is credited correctly for vacations crossing the end of the carry-over period and recalculated after later changes; special leave counts in the collision check; rejected vacations no longer appear in calendars and subscriptions; the comment is no longer mailed to replacements, and removed managers and replacements are notified. Excel export: weekends and holidays inside a vacation, half days and half working days are shown correctly, approved vacations win over those in progress. Automatic vacation booking of time sheets: days no longer covered by a vacation are removed, an unbookable vacation task fails the run instead of skipping days, the next successful run books all days missed since, and days are booked by the user’s time zone. The vacation account loads faster. Team vacation calendar: readable by screen readers, the stored choice is no longer overwritten by an outdated page state.

Leave applications: list and form migrated to the new interface, with bars over the calendar days showing the days without any substitute, a year filter paging back and forth and the days left updated while editing.

Leave account: migrated to the new interface, with the next year in the statistics and leave applications without any substitute marked red.

Lanes & Planes: the active employees are pushed with their cost centers, cost units and creditor account, safeguarded against suspiciously small user lists and email changes; employees have a new field creditor account.

Users: new fields alternative and former e-mail addresses, searchable and in the Excel export.

Data transfer: files in the file system are compressed and can be encrypted at rest (AES-256).

Passwords: change password and change WLAN password in the new interface; a wrong old password counts as failed login attempt, and a password change ends the user’s other sessions.

System administration: system statistics load at once, copy & paste samples for the alert message; the Docker image is based on Java 21.

Fixes: contribution margin by booking period, year filter of leave applications and contracts, lists returning with an outdated filter, sorting of the vacation list, rejected leave applications in the vacation export, cost unit cache refresh in the time sheet form, phone lookup key and CSRF check of force delete.

Employees: new field creditor account (the DATEV account of the employee, e.g. for travel expenses), also shown as a column in the list and in the Excel export.

Lanes & Planes interface

Data transfer: files stored in the file system are compressed and can be encrypted at rest (AES-256, key in projectforge.files.fileSystemEncryptionKey), so backups of the file system don’t contain them in plain text.

Users: new fields alternative and former e-mail addresses (comma separated, e.g. after a change of name), also searchable and in the Excel export.

System administration: two copy & paste samples for the alert message (maintenance, new release), with the next full hour and the next release filled in.

Change password and change WLAN password are pages of the new user interface and show when the password was last changed.

System statistics

Leave account

Leave applications

Leave applications

Docker image: based on Java 21 (Eclipse Temurin 21 JRE) instead of Java 17. ProjectForge still runs on Java 17 or newer.

Contribution margin (order book and scripts)

Time sheet form: choosing a task could fail now and then with "Session/EntityManager is closed" while the cost unit cache was being refreshed.

Lists

Security

Vacation export

Vacation list: sorting by the status or the days column had no effect.

Year filter

Changing the own password or WLAN password: a wrong old password counts as failed login attempt and locks further attempts for a while, like the login does.

A password change (own, by an admin or by a password reset) now also ends the user’s other open sessions, not only the stay-logged-in devices. The session the own password was changed in stays logged in.

Vacation: a nightly job books past approved vacation days without time sheets, enabled on the configuration page; unbooked vacation days count again as days without time sheets in the monthly report and the notifications, listed separately and bookable with a click.

Configuration: parameters grouped by category, showing who may see and change each one; the former vacation settings of projectforge.properties are taken over once.

Admin log viewer: a tab of the system dashboard; search in the log files of the last days, the context of each entry inline, customizable tables.

System dashboard: hanging cache refreshes and scheduler runs can be terminated, blocked database statements time out, a failed cache refresh is retried after a minute at the earliest; the last successful run of a job is shown.

My account: migrated to the new interface, with the devices staying logged in, the usage of access tokens and longer GPG and SSH keys.

Notifications: new rule for passwords not changed for a given number of days.

Changelog: the releases of a major version newest first.

Fixes: exchange rate suggestions, JCR migration in the packaged application, sorting of the Merlin template list.

Admin log viewer

System dashboard

Approved vacation can be booked as time sheets automatically: a nightly job books the past vacation days without any time sheet on the configured vacation task and cost unit, never in advance and never further back than its last successful run, so a deleted vacation time sheet isn’t booked again. Finance and controlling enable it on the configuration page (maximum days back, vacation task and cost unit); the former settings in projectforge.properties are taken over into the configuration once (a property still set afterwards is ignored and reported as a problem on the system dashboard on every start, so it can be removed), and invalid values are refused on saving. The configuration list now groups the parameters by category and shows who may see and who may change each parameter. The statistics of the scheduled jobs also keep the last successful run; after a failed run, the system dashboard shows when the job succeeded last.

Notifications: a new rule notifies users whose password hasn’t been changed for more than a given number of days, with a link to change it. The notification is resolved once the password is changed.

Changelog: the releases of a major version are listed newest first, the release opening it last, linked from the top of the major; the release notes of an update link to it as well.

The admin log viewer is now a tab of the system dashboard; its own menu entry is gone, and old links lead to the tab.

Approved vacation days without time sheets count again as days without time sheets in the monthly report and the notifications about missing time sheets. The monthly report lists working days and vacation days without time sheets separately, a click on the vacation days opens the dialog for booking several days; notification texts can list all days, only the vacation days or only the other working days without time sheets.

My account

Migration of files out of the JCR failed in the packaged application with "No LoginModule found".

Currency conversion: current exchange rates are suggested again when a new conversion rate is created or its valid-from date is changed (the exchange rate API had moved).

Merlin templates: sorting the list by the admins, users or groups column works (the list was left unsorted).

My account: GPG and SSH public keys may now have up to 20,000 characters (were 4,096, a longer GPG key couldn’t be saved); a key that is still too long is shown as an error at the field.

Notifications (experimental): rules notify users in the app (toast, banner, menu counter) and by mail, also as a cascade; first rules for missing time sheets and expiring vacation days, plus manual messages.

System dashboard: the problem dashboard becomes the system dashboard, with the system statistics and the new tabs scheduler and caches; problems (in German now "Störungen") can be changed many at once, the tiles count only open ones.

Scripts: list, form and execution pages in the new interface with a code editor and toolbar; the output gets a tab of its own; a script can appear as a button on selected pages and gets their filter.

Time sheets: bookings on the same cost 2 may no longer overlap; new configuration parameter for overlap groups.

Rich text: markdown is shown formatted and taken over by the editor, which now offers headings and tables; also used for the message of the day and the AI-savings note.

Forecast: snapshot date for the order book as of a given day, hint for the planning date.

Lists and data transfer: exports in an Export menu; data transfer with capacity bar, configurable file columns and the activity log as a tab.

Fixes: HTML in user-entered mail texts, poll mails, cancelled invoices count as paid, attachment rename, liquidity entries cloneable, task tree under concurrent changes, project list sorted by number.

Statistics, forecast

Notifications (experimental): admins and finance can set up rules that notify users in the app (toast, toast to be confirmed or banner, with the levels info, important and urgent, optionally as a menu counter) and by mail, also as a cascade (e.g. a mail if not confirmed in the app within two days). First rules: missing time sheets and vacation days about to expire; a manual rule sends a message on demand. Recipients are groups, users and employees by status, by default only those concerned. Texts are formatted and contain variables such as the list of days without time sheets. Who confirmed a notification and when is recorded. The problem dashboard shows the state of the notification jobs. Approved vacation days no longer count as days without time sheets, also in the monthly report.

Scripts: a script can be shown as a button with a tooltip in the top right corner of selected pages, e.g. the order book or other lists, and the forecast or contribution margin tab of the order statistics. The button opens the script’s execution page, and the script gets the current filter of that page as variable pageContext (e.g. pageContext.list() for the shown entries).

System dashboard: new tab "Scheduler"

System dashboard: new tab "Caches"

Data transfer: the used capacity of an area is shown as a colored fill-level bar, in the list and in the file view.

Mass update: the file name of the Excel protocol now contains the entity name (e.g. invoices).

Configuration: the note on AI savings in time sheets and the message of the day on the login page are edited with the rich text editor (bold, italic, lists, links, colours).

Problem dashboard: the key figures and the subsystem tiles now count only the problems that still need a look. Resolved, ignored and muted problems are shown separately below each figure, so handling a problem changes the tiles at once.

Rich text: texts written in markdown (e.g. older tooltips and notes) are shown formatted instead of with their raw markup, and the editor takes them over directly; they are stored in the rich text format on the next save. Markdown pasted as plain text is converted as well. The editor now also offers headings (levels 1 to 4) and tables.

System dashboard: the problem dashboard is now called system dashboard and also shows the system statistics in a tab of their own, which replaces their menu entry; old links are redirected. The statistics are part of the new interface and show each section as soon as its figures are collected instead of waiting for all of them. Memory, disks, the database connection pool and the database server connections are shown as fill-level bars, and new figures were added: pool configuration and maximum size, database version and size, CPU load, processors, physical memory, operating system, non-heap memory, garbage collection and thread counts.

Code editor (scripts): a toolbar with undo, redo, search and replace and comment out, each naming its keyboard shortcut in the tooltip, and an info button listing all shortcuts. The search panel is shown at the top and in the user’s language.

Dark mode: the text is rendered in a lighter weight and smoothed, so it no longer looks overly bold on the dark background.

Data transfer: the columns of an area’s file table can be shown, hidden, reordered, pinned and resized like in every list; the layout and the sort order are kept per user for all areas.

Lists: the exports (Excel, PDF, forecast, cost assignments, ics) are now in an "Export" menu right beside the gear menu, each entry with its explanation shown directly in the menu.

System dashboard: with the multi selection, many problems can be picked at once and acknowledged, resolved, ignored, reopened, muted or unmuted together. In German the problems are now called "Störungen".

Data transfer: the activity log of an area is a tab of its own (after Info) instead of a dialog.

Scripts: the script list, the script form, "My scripts" and the execution pages are part of the new interface, with a code editor with syntax highlighting. The descriptions of a script and of its parameters are rich text (existing Markdown is converted on the next save). A stored script now always runs as stored; only the parameter values are taken from the form. Code executed directly (without a stored script) now runs as Kotlin instead of Groovy.

Scripts: the output of an execution (result, log) is shown in its own tab, which opens after the run. A file to download is shown prominently at the top of both the output and the execution tab.

Groovy scripts: only the Groovy core and its date, JSON, XML and template modules are bundled; the other modules (e.g. Ant, SQL, Swing, console) were removed.

Attachments: a changed file name or description was not saved.

Project list: sorting by the number column had no effect.

Personal box and employee fields: the "select me" button for picking oneself was missing.

Time sheet list: the hint that the filter needs a date or structure element is now shown highlighted above the list instead of easily overlooked below it.

Outgoing invoices: cancelled invoices and their cancellations now count as paid. They no longer appear under the filter 'unpaid' and are no longer included in the sums above the list (gross, net, open).

Problem dashboard: a mail that couldn’t be sent is now reported once as a mail problem, no longer a second time as an unexpected error of the function that sent it.

Task list and task tree: no more sporadic internal errors while another user creates or moves a task at the same time.

Attachments: long file names without spaces are wrapped in the attachment table instead of widening it.

Liquidity planning: entries can be cloned again; a clone of a recurring entry is a standalone entry.

Mails: names, titles, file names and texts entered by users are no longer taken over as HTML (e.g. in the mails of polls, data transfer areas, vacations and to-dos); only simple formatting and links remain in the mail text of a poll.

Polls

Time sheets: no more overlapping bookings on the same cost unit

npm vulnerabilities in projectforge-next and projectforge-webapp fixed: @modelcontextprotocol/sdk, proxy-addr, sharp and source-map-js updated.

File store: with projectforge.files.store=db all files are stored in the database, data transfer files in the file system; existing installations stay on the JCR until switched.

JCR migration: after switching, files are copied in the background and verified by size and checksum, with a report; switching back or a rollback stays possible. The system page shows the active store and starts backup ZIP and migration.

Backups: the admin guide describes a main dump and a separate dump of the files; the backup purge handles several prefixes.

Calendar: booking several days also books days that already have time sheets, as long as nothing collides; the preview shows each overlap.

Data transfer: areas sorted by last modification, latest first.

Problem dashboard fixes: structure tree and list filters without a session, field error for a time sheet without a task, invoices found by order number, fewer needless error log entries.

Projects: changing cost 2 types of an ended project in the mass update is reported as an error, with the reason in the Excel export.

Fixes: user settings saved again on logout, Safari browser back, tall company logos on legacy pages, wider mail layout, e-invoice checker error message, rare internal error when opening an order.

File store

Calendar, book several days: a day already booked is booked as well if the new time sheet doesn’t collide with an existing one (an overlap allowed by a shared cost element is fine); the preview shows each overlap and whether it is allowed.

Data transfer: the list of areas is sorted by the last modification, latest first, by default.

Problems from the problem dashboard

Legacy pages: a tall company logo is limited in height and no longer covers parts of the application.

Mails: wider layout; field names in the change history no longer wrap letter by letter.

Projects: changing the cost 2 types of an already ended project in the mass update is an error instead of being silently skipped; the Excel export of the mass update shows the changed cost 2 types and lists failed entries with their reason. The edit form of an ended project shows its existing cost 2 units checked and ended.

Safari: browser back from an entry returns to the list again instead of skipping it and landing on an earlier page.

Changed user settings (e.g. list filters and column layouts) are saved again on logout instead of being lost.

E-invoice checker: an e-invoice whose amount due doesn’t match its lines is shown with this error instead of "no e-invoice data found".

Orders: opening an order could rarely fail with an internal error.

Calendar: book several days at once, e.g. a vacation or an absence for a colleague; weekends, holidays and booked days are skipped, half working days booked pro rata.

Orders: one contact person plus any number of further contact persons instead of project manager, head of business and key account manager; they get the same access and the change mail.

Charts: chart pages show charts as tiles that can be reordered, resized and hidden, stored per user.

Statistics: forecast and contribution margin calculated much faster; forecast analysis of an order opens in a dialog from the forecast tables.

Project list: sortable columns for the last time sheet, last order date and last activity to spot ended projects.

Problem dashboard: a click on a key figure shows the problems it counts; the mail tile shows the outcome of the last mail; failing calendar subscriptions are reported in the error digest.

Lists: the search box gets the focus on page load; statistics and problem dashboard moved to new URLs with redirects.

Fixes: a cloned time sheet keeps its user, search terms highlighted in cells with JIRA links, no stale frontend files in the release jar.

Project list: columns for the last time sheet, the last order date and the last activity (the later of both), sortable, to spot projects that have probably ended.

Problem dashboard: a click on a key figure (new problems, regressions, external systems etc.) shows exactly the problems it counts.

Chart pages (statistics, liquidity forecast, invoices, my statistics): charts as tiles that can be reordered by drag and drop, resized in steps and hidden; the arrangement is stored per user.

Calendar: book several days at once, e.g. a vacation or an absence booked on behalf of a colleague; weekends, holidays and already booked days are skipped, half working days are booked pro rata, templates, recent time sheets and the booked user’s vacations can be taken over (vacation task and cost unit configurable via projectforge.timesheet.vacation.taskId/kost2).

Statistics: a pill behind the order number in the forecast tables opens the forecast analysis of the order in a dialog, without leaving the table.

Lists: the search box gets the focus on page load (not on touch devices).

Orders: one contact person plus any number of further contact persons instead of project manager, head of business and key account manager (existing entries are migrated, the old fields remain in the database). Further contact persons have the same access to the order and its invoices as the contact person, and the change mail now also goes to them and to everyone who has edited the order before.

Statistics: forecast and contribution margin are calculated much faster; the contribution margin is cached per project.

Contribution margin configuration: a cost unit assigned twice is marked as an error.

Cost units: the cost type is shown only for customer cost units (4.x and 5.x) in the list and export, as in the monthly report.

Problem dashboard: the mail tile shows the outcome of the last mail sent (unknown, OK, send failed or mail server unreachable).

Failing calendar subscriptions no longer send a separate mail to the administrator and the feedback address; the error digest reports them.

The statistics page moves to /next/finance/statistics and the problem dashboard to /next/problemDashboard; old links are redirected.

A cloned time sheet (e.g. dragged in the calendar) keeps its user if the logged-in user may book for them.

Search terms are highlighted in list cells with JIRA links, too (order title and reference, task, time sheet, HR planning).

The release jar no longer carries stale frontend files of earlier builds.

Problem dashboard and error digest: problems instead of occurrences as lead key figure, numbers with thousands separators; subsystem tiles count only open problems.

Projects: the status can be changed in the mass update.

Gateway: the ICS push delivers all calendars of a user again and generates each team calendar only once per run.

Fixes: nightly search re-index no longer fails on tables of inactive plugins, long values no longer break mail tables, no needless error log entries when saving orders.

Problem dashboard and error digest mail: problems instead of occurrences as the lead key figure, so one frequent problem no longer hides all others; numbers with thousands separators.

The status of projects can be changed in the mass update.

The gateway’s ICS push generates each team calendar only once per run.

The gateway’s ICS push delivered only the first calendar of each user.

A subsystem tile of the problem dashboard counts only open problems, like the list behind it.

Long file names and values no longer push tables beyond the mail card.

The nightly re-index of the search no longer fails on tables of non-active plugins.

No more needless error log entries when saving orders.

New frontend projectforge-next: all pages migrated, including calendar, time sheets, order book, invoices, structure tree, access rights, monthly report, liquidity planning and administration. The classic Wicket module has been removed.

Problem dashboard: log events are classified and aggregated into problems with a persistent status, with links into the log viewer, a JSON export for an AI-assisted analysis and prioritized error digest mails instead of one mail per error.

Charts and key figures: order statistics with budget scenario, contribution margins, forecast, invoicing and net sum charts with a year-earlier comparison, invoicing quota and error figures in the system statistics.

Robust interfaces: timeouts, connection pools, bounded sync threads and sync statistics for LDAP, identity provider, iCal, SMS, Sipgate and the gateway; an unreachable system fails fast instead of blocking, failing calendar subscriptions are retried with a growing interval.

E-invoicing: XRechnung and ZUGFeRD export of outgoing invoices, PEPPOL validation, cancellation invoices and an e-invoice checker.

Identity provider: synchronization of users, groups and passwords with Authentik or Keycloak (module projectforge-idp).

Finance: recurring liquidity entries, DATEV import of incoming invoices, salary import, currency conversion with online exchange rates.

Technology: Spring Boot 4.1, Spring 7, Hibernate 7.4, Hibernate Search 8.4, Tomcat 11, Kotlin 2.3, Next.js 16, React 19, TanStack Table.

projectforge-next

E-invoicing

Identity provider integration (module projectforge-idp): users, groups and passwords synchronized with Authentik or Keycloak, including WLAN password hashes.

Problem dashboard

Charts and key figures

Recurring series in the liquidity planning.

Address import and export as vCard and from free text, with a diff view and a warning about duplicates.

Incoming invoices imported from DATEV, with currency and exchange rates looked up online.

Gateway for external data transfer with delta sync, CardDAV favorites and a public heartbeat.

ICS import of team events with a diff preview.

Changelog with news, search and highlighting under /next/changelog, also in German.

All pages migrated to projectforge-next, among them calendar, time sheets, order book, outgoing and incoming invoices, structure tree, access rights, monthly report, liquidity planning, DATEV and salary import, HR planning, Gantt charts and administration; links and bookmarks of the classic pages lead to the new ones.

Configurable customer groups and business units as filters for time sheets, invoices, projects and orders.

Structure element picker with recently used entries and favorites; JIRA issue links in lists and forms.

Server-side paging of order and invoice lists; deleted entries can be restored.

Robust interfaces

Order book and invoices no longer freeze when two caches refresh at once.

Many N+1 query floods removed; large ID lists stay under the database’s bind parameter limit.

Subscribed calendars, the MS Project export of Gantt charts, the Word-to-PDF conversion and the LDAP sync repaired.

CSRF protection and complete field validation for the REST calls; access checks for all REST endpoints, enforced by an architecture test.

Security review of the filter chain: trusted proxies, client IP detection, throttling, safe redirect URLs.

2FA required for sensitive pages; deleted groups never grant access rights.

Module projectforge-wicket with all classic pages, Wicket-only i18n keys and libraries no longer used.

AG Grid (replaced by TanStack Table), react-scripts (replaced by Vite) and JAXB.

Legacy XML user preferences are migrated to the JSON store.

Spring Boot 4.1, Spring 7, Hibernate 7.4, Hibernate Search 8.4, Tomcat 11.

Kotlin 2.3, JUnit 6, Gradle 9.8, Next.js 16, React 19, TanStack Table, Vite and Vitest.

Versions are numbered X.Y.Z and built by a release script, the version is set in one place.

Wicket removed: DATEV import, log viewer, HR planning, Gantt charts, calendars, to-dos and more migrated to projectforge-next; the module projectforge-wicket was deleted.

Problem dashboard: log events classified and aggregated into problems with a persistent status, JSON export for an AI-assisted analysis, prioritized error digest mails instead of one mail per error.

Statistics: order statistics page with filter, charts, budget scenario and lost-budget warnings; invoicing quota in My statistics; contribution margin tab in the order book.

Filters: configurable customer groups and business units as filters for time sheets, invoices, projects and orders.

Gateway: delta sync with nightly full sync, CardDAV favorites and a public heartbeat.

Calendar: ICS import of team events with a diff preview; failing subscriptions are retried less often and deactivated after 90 days.

Interfaces: timeouts, connection pools and sync statistics for LDAP, identity provider, iCal, SMS and Sipgate.

Fixes: subscribed calendar parsing, MS Project export of Gantt charts, Kotlin scripts in the fat jar, password reset button and mail details.

Security and technology: access checks for all new REST endpoints enforced by an architecture test; Spring Boot 4.1, Spring 7, Hibernate 7.4, Tomcat 11, Kotlin 2.3, Gradle 9.8.

Problem dashboard

Order statistics page with its own filter, favorites, charts, data tables, budget scenario and warnings about lost budgets.

Invoicing quota as a tab in My statistics.

Gateway: delta sync with a nightly full sync including deletions and CardDAV favorites, public heartbeat, data transfer UI after OAuth2 login.

Kost2: shared cost flag, overriding the structure element (also in the mass update).

ICS import of team events with a diff preview; download of a team event as ics file; shared subscription dialog for time sheets, holidays and weeks of year.

Run several development instances side by side (bin/pfDev.sh slots).

Migrated to projectforge-next

Configurable customer groups and business units; time sheets, invoices, projects and orders can be filtered by business unit, customer and project (checklist filters).

Order book: contribution margin tab including the year before last.

Mass update for to-dos and for the payment type of salaries.

Calendar subscriptions that keep failing are retried less often and deactivated after 90 days.

Timeouts, connection pools and sync statistics for LDAP, identity provider, iCal, SMS and Sipgate clients.

The browser window is named after the page; the open tab of list and report pages is kept in the URL.

Shift+click selects a range in attachment lists.

Subscribed calendars: DTSTAMP no longer breaks parsing; events without DTEND derive their end from DURATION; one event per holiday and week in the feeds.

MS Project export of Gantt charts repaired (mpxj upgraded).

Kotlin script classes are resolved in the fat jar again.

Password reset button, birthday mail locale and inline logo in mails.

The JCR sanity check runs only once per night.

Expected client and authentication failures are logged below error level.

Access checks for all new REST endpoints, enforced by an architecture test.

npm security advisories in next and webapp patched.

Module projectforge-wicket including all Wicket pages, about 90 Wicket-only i18n keys and libraries no longer used.

Spring Boot 4.1, Spring 7, Hibernate 7.4, Hibernate Search 8.4, Tomcat 11 (via Spring Boot 3.5 as intermediate step).

Kotlin 2.3, JUnit 6, Gradle 9.8, kotlin-logging 7.

Migrated to projectforge-next: accounts, address campaigns, license management and customers (Wicket pages removed); customer and free-text customer merged into one field.

Invoices: a cancellation sets the original invoice to cancelled; Word template choice for the ZUGFeRD export, PDF rendered with LibreOffice; empty e-invoice fields filled from the account.

Order and invoice forms: customer column, highlighted head, tinted position headers, sibling cost units in the cost assignment pickers.

Usability: labels and values can be copied; change history shows user and group lists as a diff by name; liquidity planning highlights negative balances.

Fixes: no time sheets on ended or deleted projects, cost assignment index of invoices kept, positions sorted by number, forecast charts match the list, Word-to-PDF works again.

Security: 2FA required for migrated system and plugin pages and the liquidity series split.

Migrated to projectforge-next

Invoices

Order and invoice forms: customer column, highlighted head, tinted position headers, sibling cost units in the cost assignment pickers.

Labels, select values, pickers and section titles can be copied.

Monthly report: the cost type is only shown for customer cost units.

Change history shows user and group lists by name as removed/added diff.

Liquidity planning: negative balances highlighted, credit/debit bars in green/red.

Time sheets can no longer be booked on structure elements of an ended or deleted project.

Saving an invoice no longer shifts the index of its cost assignments.

Positions of orders, invoices and incoming invoices are sorted by number.

Order forecast charts and Excel select exactly the orders of the list.

Word-to-PDF conversion works again (OpenPDF dropped).

2FA required for the migrated system and plugin pages and the liquidity series split.

Migrated to projectforge-next: monthly employee report, customers, projects, cost 2 units and types, accounting records, salaries, access rights with matrix view, system and plugin administration, liquidity planning.

Liquidity planning: recurring series with a scope choice when editing, tri-state paid status and mass update.

Order book and invoices: net sum calculator per position, forecast and net sum charts, invoicing quota, to be invoiced limited to this month, over-invoiced orders flagged, cancellation of e-invoices, clone an order as a draft.

Usability: structure element picker with recent entries and favorites, compact top navigation with counter badges, deleted references struck through, mass update for cost 1 and cost 2.

Fixes: N+1 query floods, cache self-deadlocks in write transactions, issued invoices shown in the order immediately, planned and cancelled invoices no longer count as invoiced.

Security: deleted groups never grant access rights; 2FA for the migrated access rights and cost 2 forms.

Removed: classic Wicket pages for search, order book, outgoing invoices, monthly report and plugin administration.

Migrated to projectforge-next

Liquidity planning

Order book and invoices

Structure element picker with recently selected structure elements and structure element favorites.

Creditor invoices: bank details are filled in from the creditor.

Mass update for cost 1 and cost 2.

Compact top navigation with counter badges; search moved into the main menu.

Deleted or deactivated referenced objects are struck through in list cells.

Temporary page size of 10,000 rows for all lists.

The link to the classic version is labelled Old version and warns on pages that will be removed.

Several N+1 query floods (structure element favorites, access list, customer list, skill matrix, forecast, salary export, order filters).

Self-deadlocks of the project/customer caches inside write transactions.

An issued invoice is shown in its order immediately, not only after the next cache refresh.

Planned and cancelled invoices no longer count as invoiced for order positions.

Change history shows time-of-day values in the user’s time zone.

Cost assignments of incoming invoices are exported again.

Expand/collapse of the classic structure tree restored.

Deleted groups never grant access rights.

2FA required for the migrated access rights, cost 2 and cost 2 type forms.

Classic Wicket pages for search, order book, outgoing invoices, monthly report and plugin administration.

Legacy XML user preferences are migrated to the JSON store.

Search: global full-text search migrated to projectforge-next, results as collapsible tiles.

Mass update: for incoming invoices and time sheets, with live selection statistics and a server-side list of changes before writing.

Time sheets and structure tree: Kost2 and Kost2 type filters, PDF export options, structure tree filter by Kost2 number with wildcards.

Structure elements: max hours has priority switch; an explicit child status overrides an inherited one.

Further improvements: SEPA transfer download for creditor invoices, weekly hours in the employee list, gross working time in the calendar, tooltips on touch devices, start page redirects to the new calendar.

Fixes: time sheet favorites slot collision, exact Kost2 in the monthly report drill-down, deleted invoice positions excluded from sums, correct column sorting.

Technology: faster history value search with pg_trgm indexes, batch fetching for mass reindexing.

Global full-text search migrated to projectforge-next, results as collapsible tiles.

Mass update in projectforge-next

Time sheet list: Kost2 filter with autocomplete, Kost2 type filter, PDF export options dialog with per-entry duration.

Structure tree can be filtered by Kost2 number (wildcards supported).

Structure elements: max hours has priority switch overriding ordered person days; explicit status of a child structure element overrides an inherited one.

Creditor invoices: SEPA bank transfer download.

Employee list: weekly hours column and filtered Excel export.

Calendar day/week statistics show the gross working time.

Tooltips reachable on iOS and other touch devices; list tables adapt to narrow viewports.

Start page redirects to the new calendar, including bookmarked links.

Time sheet favorites: collision of filter and template slots resolved.

Monthly report Kost2 drill-down uses the exact Kost2.

Deleted invoice positions are excluded from cached list sums.

Kost1/Kost2 and user columns sort correctly everywhere.

History value search accelerated with pg_trgm indexes; unused Lucene index of history attributes removed.

Batch fetching of lazy associations during mass reindexing.

npm audit vulnerabilities resolved in next and webapp.

Migrated to projectforge-next: outgoing and creditor invoices, structure tree and wizard, groups, calendar with team events, time sheet list and form.

Lists and forms: multi selection with mass update for invoices, period filters with paging arrows, server-side paging of order and invoice lists, restore of deleted entries.

Usability: light/dark theme toggle, JIRA issue links in lists and forms, recently used menu entries and quick access search for the menu.

Time sheets: overlapping time sheets allowed for shared cost elements.

Invoices: invoice statistics with a year-earlier comparison.

Fixes: order book and invoices no longer freeze on concurrent cache refreshes, many N+1 query floods removed, large ID lists batched, project managers can save orders again, invoiced amounts survive a restart.

Security and Docker: safe redirect URLs, 2FA again when saving orders and cost centres; Docker container buildable and startable again.

Migrated to projectforge-next

Lists and forms

JIRA issue links in structure element, structure tree, order and time sheet lists and forms.

Light/dark theme toggle, logos adapted to dark mode.

Overlapping time sheets allowed for shared cost elements.

Recently used menu entries, shared by all frontends; quick access search for the menu.

Invoice statistics with a year-earlier comparison.

Order book and invoices no longer freeze when two caches refresh at once (cross-lock deadlock); invoice cache no longer refreshes inside a write transaction.

Many N+1 query floods (order list, invoice lists, data transfer audit job, vacation events, employees, books, groups).

Large ID lists are batched to stay under the database’s bind parameter limit.

Project managers can save orders in the new frontend again.

Customer name search finds words inside the name.

Invoiced amounts survive a restart.

Redirect URLs can no longer smuggle in a foreign host.

Saving orders and cost centres asks for a second factor again.

Docker container is buildable and startable again; step by step guide for a test instance.

projectforge-next: the new frontend runs side by side with the existing one under /next; every migrated page links back to its classic counterpart.

Login: login, two-factor authentication and password reset; /next/login is the only login of the application.

Tables: column reordering and pinning, persisted layouts, filter panel, filter pills and saved filter favorites.

Migrated pages: books, Kost1 and the order book with positions, payment schedule, statistics and exports; attachments and change history as a tab.

Forecast and orders: configurable distribution of unused budget, run-rate extrapolation, probability of occurrence shown.

Further additions: reindexing as a cancellable job, clone button for Merlin templates, response compression.

Fixes: regressions after the TanStack migration, invoiced order sums no longer 0, identity provider ID kept on user edit, history value search, order notification mails.

Security: stay logged in with one token per device, filter chain review, CSRF protection and full field validation for REST writes.

projectforge-next

Reindexing as a cancellable job with progress indicator.

Clone button for Merlin templates.

Forecast: configurable distribution of unused budget, run-rate extrapolation for call-off and fixed-rate orders.

Order: probability of occurrence shown; positions marked red only when really due for invoicing.

Numeric columns right-aligned, time sheet periods sorted chronologically.

Response compression enabled.

File transfer, row selection and structure tree regressions after the TanStack migration.

Identity provider ID no longer cleared on user edit.

LDAP move/rename of legacy cn-based entries.

Invoiced sums of orders no longer 0 after concurrent cache refreshes.

Login redirect no longer overwrites the return URL.

Search for a value in the change history works again.

Order notification mails no longer break saving the order.

Stay logged in: one token per device, throttling, cookie only after 2FA, purge job.

Security review of the filter chain: trusted proxies, client IP detection, throttling of public key endpoints, unbiased tokens.

CSRF protection for the REST calls of the new frontend; REST writes validate all fields including string lengths.

The Spring profile is no longer lost via the generated environment.sh.

Tables: moved to TanStack React Table, with typed column filters, date range filters, keyboard multi selection, column reordering and pinning.

Forecast and structure elements: forecast export compares with the year before last; structure element titles up to 100 characters.

Fixes: attachments of outgoing invoices, corrupt downloads of large files, forecast month count, LDAP sync with externally moved entries, Merlin PDF fonts, CardDAV PUT requests on newer macOS.

Admin and security: action to reset the identity provider password sync of all users; high-severity npm vulnerabilities fixed.

Tables (TanStack): typed column filters with active-filter badge, date range filters, keyboard multi selection, column reordering, left pinning and row click actions.

Forecast export: comparison with the year before last.

Structure elements: title length increased from 40 to 100 characters.

Outgoing invoices: attachments on the edit page and attachment column in the list; attachment counter updated after PDF upload/deletion.

Corrupt downloads of large files.

Forecast: number of months for invoicing in the following month.

LDAP sync no longer blocks on entries moved externally.

Merlin PDF conversion handles Identity-H encoding for unregistered fonts.

CardDAV: PUT requests bypassed the filter on newer macOS versions.

Action for resetting the identity provider password synchronization of all users.

High-severity npm vulnerabilities in projectforge-webapp fixed.

Menu: customizing the personal menu reworked.

Fixes: WLAN password hash migration covers all users, plugin menu entries survive a configuration reload, uploads with many files, company name in the invoice export taken from the account.

Security: npm vulnerabilities in projectforge-webapp fixed.

Customizing the personal menu reworked.

WLAN password hash migration includes users without a recorded password change.

Plugin menu entries no longer vanish after reloading the configuration.

Multipart uploads with many files (Tomcat maxPartCount configured).

Invoice export takes the company name from the invoice’s account.

npm vulnerabilities in projectforge-webapp fixed; esbuild, Vite, vitest and others updated.

E-invoicing: XRechnung export and ZUGFeRD PDF with embedded XML, e-invoice fields in a validated dialog, attachments embedded, e-invoice fields moved to the account.

E-invoice checker: displays and validates ZUGFeRD and XRechnung files.

Invoices, orders and forecast: autocompletion of the customer text; forecast template with status column and remaining budget spread over the remaining months.

Fixes: NPE when cloning outgoing invoices, SEPA XML namespaces.

Technology: frontend build moved from react-scripts to Vite, tests from Jest to Vitest.

E-invoicing (XRechnung / ZUGFeRD)

Autocompletion of the customer text in invoices and orders.

Forecast template: status column; remaining budget distributed over the remaining months.

NPE when cloning outgoing invoices.

SEPA XML namespace handling with Spring Boot 3.4.

Frontend build migrated from react-scripts to Vite, tests from Jest to Vitest.

Identity provider: module projectforge-keycloak refactored to projectforge-idp with Authentik support; WLAN password hashes migrated from LDAP to Authentik.

Fixes: LDAP uid rename crash, autocompletion dropdowns and recurrence editor after the React 19 migration.

Technology: React 19 with all frontend dependencies, Spring Boot 3.4.13.

Authentik support: module projectforge-keycloak refactored to projectforge-idp; WLAN password hashes migrated from LDAP to Authentik.

LDAP uid rename crash.

Autocompletion dropdowns and the recurrence editor after the React 19 migration.

React 18 → 19 with all frontend dependencies.

Spring Boot 3.4.13 (Spring Framework 6.2.15); Jackson/npm dependency conflicts resolved.

Keycloak: new module with a login handler for a stepwise introduction, bidirectional attribute and group mappings, WLAN password sync on password change.

Scripting: access to order book snapshots and to employee data including monthly reports.

Fixes: Keycloak sync issues, forecast export, calendar navigation, Wicket session user mismatch forces a new login, structure tree concurrency.

Security: system statistics show reduced information for non-admins.

Keycloak integration

Scripting

Keycloak sync: false positive updates, membership sync, invalid characters in names, missing mail addresses.

Forecast export: NPE and snapshot data.

Calendar navigation and layout.

Wicket session: a user mismatch is detected, logged and forces a new login; breadcrumbs create fresh page instances.

Concurrency and defensive checks in the structure tree hierarchy.

System statistics show reduced information for non-admins.

Exports: ZIP archives with a flat structure and ZIP encryption, also for scripts.

Scripts: new examples for a yearly time sheet export and an SQL dump export.

Kost2: accounting records support Kost2 as string; Kost2 inherits its status virtually from the project.

Technology: AG Grid 34, Wicket 10.8, Podman instead of Docker for the test database.

Export zip archives support a flat structure and zip encryption (also for scripts).

New example scripts: yearly time sheet export, SQL dump export.

Accounting records support Kost2 as string.

Kost2 inherits its status virtually from the project.

AG Grid 34, Wicket 10.8.

Podman instead of Docker for the test database.

Addresses: the address import handles deletion, restoring and forced deletion; the Excel export of address campaigns only for authorized users.

Fix: endless LDAP synchronization caused by empty strings.

Address import handles deletion, restoring and forced deletion.

Address campaigns: Excel export button only for authorized users.

Endless LDAP synchronization (empty strings normalized to null).

Addresses: vCard 3.0/4.0 import and export with contact images, free-text import, import reconciler with diff view, duplicate warning.

Tables: column settings saved automatically with a reset to server defaults; auto scrolling.

Fixes: endless spinner after two-factor authentication, LDAP sync detected all users as modified, Sipgate sync.

Address import/export

Column settings (filter, sorting, order, widths) are saved automatically, with a reset to the server defaults.

Tables: auto scrolling.

Endless spinner after a successful two-factor authentication.

LDAP sync detected all users as modified.

Sipgate sync.

Addresses: address list on the new table with multi selection.

Tables: pinned columns, configurable resizing, reset of column settings, multi-line cells, pagination info on top.

Address campaigns: edit addresses in a dialog from the campaign list, invalid addresses highlighted, filter for own entries.

Fixes and technology: wildcard parameter of the like filter, various table fixes; JAXB removed.

Address list migrated to the new table with multi selection.

Tables: pinned columns, configurable resizing, reset of the user’s column settings, multi-line cells, pagination info on top.

Address campaigns redesigned: edit addresses from the campaign list in a dialog, invalid addresses highlighted, filter for own entries.

QueryFilter.like ignored the auto wildcard parameter.

Various table fixes.

JAXB removed (SEPA XML generator migrated); MarkdownBuilder escapes its input.

Incoming invoices: import from DATEV, with a currency.

Currency conversion: exchange rates with valid-from date; the matching rate is looked up online and proposed.

Survey plugin: better reminder mails, missing answers fixed.

Incoming invoices can be imported from DATEV and carry a currency.

Currency conversion: exchange rates with valid-from date; the matching rate is looked up online and proposed.

Survey plugin: reminder mails improved, missing answers fixed.

Search: ticket keys (e.g. ABC-1234) found in time sheets and structure elements again; cost search improved.

Fix: classic list views show all search fields again, e.g. the Kost2 number in time sheets.

Search for ticket keys (e.g. ABC-1234) in time sheets and structure elements works again.

Cost search improved.

Classic list views showed not all search fields (e.g. Kost2 number in time sheets).

AI time savings in time sheets with reporting.

Customizable personal menu via drag and drop.

Forecast and order book: snapshots, planning data and filterable forecast export.

Groups: Description and organization of groups are now visible for non-admins.

Group Excel export: Includes email addresses of assigned users.

Menu customization: Drag & drop functionality implemented for personalized menu organization.

AI time savings tracking in timesheets with calculation and reporting features.

Cost search functionality supports plain number string searches.

Timesheet collision prevention on multiple button events.

Excel export functionality added to accounting record list page.

User registration process made more user-friendly for new employees.

Modal dialogs on calendar page support ESC key and click-outside closing.

2FA code input field with improved UX (numeric inputmode, autoComplete).

Excel export of timesheets with AI-savings data included.

Improved forecast and orderbook functionality with planning data.

History entries now support user comments for administrative changes.

Enhanced AG Grid implementation with German translations, filtering, and sorting.

Vacation validator improvements for edge cases with remaining days from previous year.

Sipgate contact synchronization service with configurable cron job scheduling.

Data transfer functionality with sanity checks and backup capabilities.

JCR memory leak fixes and improved repository management.

Enhanced user and group access control with menu visibility configuration.

Forecast export functionality with filtering by unit, customer, and projects.

Structure wizard support for optional external groups.

Multi-selection improvements for employees in visitor book and vacation entries.

JCR memory leaks in DataTransfer module resolved.

DynamicButton disabled state during fetch operations.

Accounting record list page tooltips fixed.

Timesheet recent entries display corrected (kost2, project, customer info).

VacationValidator edge case handling for vacation day calculations.

NPE fixes in vacation account management and group services.

Structure tree access checking improvements for timesheet editing.

Order forecast data and invoice cache handling corrections.

User group cache and right handling stability improvements.

Address forced deletion after MGC migration fixed.

History formatting and user comment handling corrected.

Various UI fixes for AG Grid tables and component rendering.

Excel export XML escaping for structure element titles in timesheet exports.

Cost assignment export improvements for invoice handling.

Login redirect functionality after authentication.

Calendar and timesheet page rendering issues resolved.

Employee selection improvements without autocompletion quirks.

Mass update functionality with proper Excel modification tracking.

Multiple deadlock issues resolved in caching and logging components.

Wicket session store size increased from 100kB to 2MB: prevents session loss on large pages.

CSRF token handling and exception registry improvements.

File stream handling corrections ensuring proper resource closure.

Enhanced administration capabilities with user group cache debugging tools.

System sanity checks with automated error reporting via email.

Improved cron job scheduling using separate threads to prevent blocking.

Database testing tools accessible via admin interface.

Configuration parameter management for AI time savings features.

Menu item visibility configuration by user groups.

Enhanced logging and exception handling for proactive error reporting.

CVE updates: Tomcat upgraded from 10.1.33 to 10.1.39.

Improved access control for addresses and address campaigns (marketing users only).

Enhanced user and group visibility restrictions for non-admin users.

CSRF protection improvements and token handling enhancements.

Wicket upgraded to version 10.5.0 with improved page store handling.

Spring framework updates and dependency management improvements.

AG Grid integration with advanced filtering, sorting, and column pinning.

React Router dependency management and compatibility fixes.

Enhanced Kotlin coroutines implementation for asynchronous operations.

JCR (Java Content Repository) improvements with RDB storage preparation.

Jackson library updates with Hibernate 6 module integration.

Excel processing improvements with Apache POI enhancements.

Database migration scripts and flyway integration updates.

Docker container improvements for multi-architecture support preparation.

Package dependency updates including security patches.

Gradle build system optimizations and test framework enhancements.

Source file headers updated to 2025 copyright year.

Own CardDAV server for contact synchronization.

Docker images for arm64 and amd64.

Java 17, Spring 6, Hibernate 6, jakarta namespace.

Own CardDav-Implementation for synchronization of contacts (tested with Apple contacts (macOS/iOS), Thunderbird).

Sipgate interface implemented for synchronization of address.

Calendar view improved.

Excel-Export of vacations for all employees, teams and colleagues.

Birthdaybutler for monthly birthday list.

Export of timesheets as xlsx.

Attachments to books added.

lots of minor improvements.

several bugs fixed.

Docker container available for arm64 as well as for amd64 (Linux and macOS X).

Persistence layer completely refactored, MGC removed and replaced by a custom persistence layer.

technical debt reduced.

New major versions: Java 17, Spring 6.1.15, Hibernate 6.6.3, Hibernate search 7.2.1, javax → jakarta, React/Router, Wicket 10.2, …​

Calendar: main calendar refactored (colors, functionalities, more customizable).

Vacations: multiple substitutions supported, conflicts are shown.

Data transfer: notifications improved.

History of changes improved; 2FA requests preserve input fields.

Administration: user and group administration in the new version.

Security: issues from the last security pen test implemented.

Fixes: menu customization in the classic version, Yubikey support in Chrome, Edge etc.

Technology: Java 15, new Spring, React/Router and Wicket versions; users and passwords in separate db tables.

The main calendar refactored (colors, functionalities, more customizable etc.)

Datatransfer-Plugin: Notification improved

Vacations

History of changes improved.

2FA-requests preserve now input fields.

lots of minor improvements.

Menu customization in classical version.

Yubikey now also supported in other browsers: Chrome, Edge etc.

several bugs fixed.

User/group administration in new version.

Some issues from last security pen test implemented.

New versions: Java 15, Spring, React/Router, Wicket

Separation of db table user and passwords.

Multi upload with progress bars in data transfer areas.

Password reset for users with a configured second factor.

2FA (use SMS, mail, Authenticator app or Webauthn/Fido2 as 2nd factor for much more security.)

Password reset for users implemented (it’s only usable for users with configured 2FA / mail isn’t supported for password reset due to security reasons).

Scripts may be executed by users/groups without special rights (sudo functionality is supported). You may configure reports e. g. for project managers including financial data.

mass update and selection of invoices for e. g. bank transfers etc.

Datatransfer:

CSRF-Handling: if session token was changed, the user is able to simply reload the page for continuing.

mass update functionality refactored and improved.

pagination for result lists of new UI introduced.

Several minor bugfixes

Password reset for users: Admins may enter cell numbers of users to enable password for users without any configured 2FA.

2FA is now fully supported. You may configure:

Data transfer and Merlin: serial PDFs/Word documents are generated automatically and sent to the personal boxes of users/employees.

Scripting: example scripts, include support and a new source editor for Groovy and Kotlin.

Security: two-factor authentication (2FA) introduced.

Privacy: data protection improvements.

Administration: the SSH public key is also visible for non-admins.

Several minor bug fixes.

Combination of DataTransfer and Merlin: Serial PDFs/Words may be automatically generated and sent to the personal boxes of the users/employees.

Scripting: example-scripts, include supported, new source editor supporting Groovy and Kotlin.

Scripting functionalities improved.

Data protections improvements.

Several minor bugfixes

Ssh public key is also visible for non-admins.

2FA introduced (will be improved soon).

Merlin: Word templating for letters, contracts etc. with variables and if-else expressions; serial execution delivers Word/PDF files to personal boxes; gender for users added for personalized letters.

Log viewer for admins and for users to track their own activity (mass updates, Merlin, DATEV imports).

Data transfer: encryption added.

SEPA export: special characters unsupported by banking software are replaced or removed.

Privacy: deletion of addresses, employee and vacation data etc. including history entries (EU privacy rules).

Administration: no restart after first installation; temporary directories are deleted on shutdown.

Security: passwords handled as char[] instead of String.

Fixes: search for deleted entries and search in history entries.

Word-Templating (Merlin): Word templating for letters, information, contracts etc. with serial execution including variables, if-else-expressions etc. inside docx (like Velocity-Scripting-engine). All users/emloyees may receive letters/contracts etc. (as Word and/or PDF-files) in their personal boxes via serial execution. Example template files included for a quick start.

Log viewer added (for admins as well as for users for tracking own activity for mass updates of time-sheets, usage of Merlin or Datev-imports)

Gender for users added: Used by Merlin (word templating) for creation of personalized letters, contracts etc.

DataTransfer-Plugin: encryption added

Exporting SEPA-cash transfers improved: special characters unsupported by banking software will be replaced/removed.

Features for deleting data such as addresses, employee, vacataion data etc. implemented due to privacy restrictions in the EU. The deletion includes also history entries.

Several minor bugfixes

Search for deleted entries (addresses etc.) fixed.

Search in history entries (keywords, users) fixed.

No restart after first installation required anymore.

During Shutdown some temporarily created directories (tomcat.* and projectforge-application*) will be deleted automatically.

using char[] instead of String for passwords.

Security: fixes from a penetration test.

Data transfer: download of an area in one zip, more options for external users.

Several minor improvements (order book etc.) and bug fixes.

Docker: binaries available on Docker Hub.

The DataTransfer tool is improved: download area in one zip, more options for external users

Security fixes from a penetration test.

Several minor bugfixes

Several minor improvements (order book etc.)

You can download the binaries from Docker hub

Data transfer: personal box of every user for fast one-to-one exchange of large files.

Docker improved.

Technology: update of all JavaScript libraries (React etc.).

Data transfer: Personal box of every user for fast exchange of large files one to one.

Docker improved.

Update of all JavaScript libs (React etc.)

Data transfer: checksums for all files and a nightly sanity job.

CardDAV support improved (cell phone numbers).

Test systems: no more unique constraint violations with test data on new test systems.

Technology: support of Java 13+, major updates of nearly all libraries, multi tenancy removed.

checksums for all files in data transfer as well as nightly run of sanity job.

CardDAV support improved (cell phone numbers)

Test data in test systems: no more unique constraint violations anymore on new test systems.

Support of Java 13+.

Major updates of nearly all libraries.

Multi tenancy removed.

New frontend built with React, with full REST support for most functions, e.g. for other clients such as a smartphone app.

Data transfer tool: sharing files with other users and external customers.

Skill matrix: new plugin for sharing knowledge.

Installation: Docker images and a setup wizard.

Technology: over 20% of the code is now developed with Kotlin.

New front-end

Data transfer tool for sharing files with other user’s and external customers

New plugin: skill matrix for sharing knowledge.

Tons of new functionalities and improvements.

Available as Docker images for fastest installation ever.

Setup wizard for easy setup.

New front-end works with React.

Over 20% of the code is now developed with Kotlin.

Full Rest support for most functionality for other clients (such as a smartphone app).

Technology: update to Spring Boot 2.0.

Start: the ProjectForge Launcher no longer works; only the projectforge-application.jar command-line starter is available.

Invoices: BIC optional for German IBANs; round-off error in invoices fixed.

Security: session fixation and an access management bug fixed.

Fixes: team event invitation mails, call function in the address list, employee status in the employee list export.

BIC for german IBANs optional

Update Spring Boot version to 2.0

Fix round-off error in invoice

Fix session fixation

Fix access management bug

Fix team event invitation mail send

Fix call function from address list page

Fix employee status in employee list export