Version: 3.9.1

Bug Fixes

Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514)

Improvements

API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513)

What’s Changed

Other Changes

Security: comprehensive remediation across 7 vulnerability families by @marcelfolaron in https://github.com/Leantime/leantime/pull/3399
Modernize all controllers from run() to get()/post() by @marcelfolaron in https://github.com/Leantime/leantime/pull/3408
fix: Value Proposition Canvas 500 (Undefined variable $currentCanvas) (#3402) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3422
Refactor: thin controllers / fat services across all non-canvas domains by @marcelfolaron in https://github.com/Leantime/leantime/pull/3420
refactor: consolidate canvas domains into a unified Blueprints domain (YAML-driven) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3421
feat(api): JSON-RPC migration foundation + Tickets pilot by @marcelfolaron in https://github.com/Leantime/leantime/pull/3424
feat(api): JSON-RPC migration batch 2 — Submenu, Sessions, Reactions, Notifications by @marcelfolaron in https://github.com/Leantime/leantime/pull/3425
Fix 500 on client detail page: undefined constant generalComment by @Roark1138 in https://github.com/Leantime/leantime/pull/3423
fix(clients): show accurate discussion count on client detail page by @marcelfolaron in https://github.com/Leantime/leantime/pull/3428
feat(api): JSON-RPC migration batch 3 — Calendar (+ delete dead Ideation) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3426
feat(api): JSON-RPC migration — Ideas (with project-access authorization) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3427
feat(api): JSON-RPC migration — Users JSON endpoints by @marcelfolaron in https://github.com/Leantime/leantime/pull/3429
Retire the legacy Api REST controllers (binary/upload → domains, Projects sort → JSON-RPC, delete dead Tags/Timer) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3430
refactor(blueprints): native Laravel controllers, drop the dispatch bridge by @marcelfolaron in https://github.com/Leantime/leantime/pull/3432
feat(core): typed exception hierarchy + JSON-RPC response types by @marcelfolaron in https://github.com/Leantime/leantime/pull/3431
fix(tickets): guard undefined $groupBy/$newField in list views by @marcelfolaron in https://github.com/Leantime/leantime/pull/3433
cleanup: remove dead $x = $x; Blade self-assign artifacts by @marcelfolaron in https://github.com/Leantime/leantime/pull/3434
refactor: merge Strategy domain into Blueprints by @marcelfolaron in https://github.com/Leantime/leantime/pull/3435
feature: RPC-only service methods throw typed exceptions on denial by @marcelfolaron in https://github.com/Leantime/leantime/pull/3436
Fix #1099 by @duongynhi000005-oss in https://github.com/Leantime/leantime/pull/3405
feat(tickets): finish collaborators feature — notifications, persistence & hardening (#1099) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3437
build(deps): bump @fullcalendar/luxon3 from 6.1.17 to 6.1.20 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3409
build(deps): bump fullcalendar from 6.1.17 to 6.1.20 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3417
build(deps): bump katex from 0.16.21 to 0.17.0 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3410
build(deps-dev): bump webpack-cli from 5.1.4 to 7.0.3 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3413
chore(deps): bump icalendar + dotlottie-wc, remove Dependabot by @marcelfolaron in https://github.com/Leantime/leantime/pull/3438
perf: speed up dashboard & hot paths (session locking, query dedupe, event patterns) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3439
ci(phpstan): raise static analysis to level 1 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3440
fix(mobile): responsive stabilization sweep for phones & tablets by @marcelfolaron in https://github.com/Leantime/leantime/pull/3442
perf(dashboard): stop full-page repaints & cross-widget loading-indicator churn by @marcelfolaron in https://github.com/Leantime/leantime/pull/3443
feat(components): Blade component tiers + central HTMX event convention by @marcelfolaron in https://github.com/Leantime/leantime/pull/3441
fix: restore data binding in milestone & wiki dialogs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3444
fix: repair #3441 regressions blocking acceptance (app.js bundle syntax + stale install step) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3453
fix(tickets): enforce editor role on save + honor milestone project change by @marcelfolaron in https://github.com/Leantime/leantime/pull/3445
fix(plugins): stop marketplace 500s by coercing API data to typed model props by @marcelfolaron in https://github.com/Leantime/leantime/pull/3446
fix(db): PostgreSQL compatibility (write limits, sequences, pdo_pgsql, JS escaping) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3447
fix(ldap): return a normal auth error instead of a 500 on bad credentials by @marcelfolaron in https://github.com/Leantime/leantime/pull/3448
fix(comments): open the edit/reply box above the replies thread by @marcelfolaron in https://github.com/Leantime/leantime/pull/3450
feat(tickets): add “Not assigned” milestone filter option (#3252) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3452
feat(core): WorkStructure meta-model infrastructure by @marcelfolaron in https://github.com/Leantime/leantime/pull/3454
fix(timesheets): skip blank cells when saving the weekly grid by @marcelfolaron in https://github.com/Leantime/leantime/pull/3449
fix(wiki): save notes from the All Notes grid into a default notebook by @marcelfolaron in https://github.com/Leantime/leantime/pull/3451
feat(notifications): mobile push device tokens (Expo + FCM) + getUnreadCount RPC (#3398) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3401
feat(logicmodelcanvas): Logic Model board + WorkStructure orchestration by @marcelfolaron in https://github.com/Leantime/leantime/pull/3455
feat(notifications): mobile push tokens on access_tokens + FCM/Expo dispatcher by @gloriafolaron in https://github.com/Leantime/leantime/pull/3457
fix(comments): stop shadowing controller $comments array in Discussion template by @gloriafolaron in https://github.com/Leantime/leantime/pull/3459
feat(core): native permission engine foundation (Phase 0) + console addCommand fix by @marcelfolaron in https://github.com/Leantime/leantime/pull/3461
feat(permissions): enforce Tickets + Comments via the engine — full @api coverage by @marcelfolaron in https://github.com/Leantime/leantime/pull/3469
feat(permissions): roll the engine across the Users domain (company-scope) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3471
feat(permissions): roll the engine across the Clients domain (company-scope) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3472
feat(permissions): roll the engine across the Setting domain (company + project scopes) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3473
feat(permissions): roll the engine across the Sprints domain (first content domain) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3474
feat(api): plugin gate attribute + capability discovery endpoint by @gloriafolaron in https://github.com/Leantime/leantime/pull/3460
fix(tickets): ticket modal crashes on milestone type by @gloriafolaron in https://github.com/Leantime/leantime/pull/3468
security(comments): scope comment authz to the host entity’s real project by @marcelfolaron in https://github.com/Leantime/leantime/pull/3476
security(ideas): gate Ideas domain on the native permission engine by @marcelfolaron in https://github.com/Leantime/leantime/pull/3478
security(wiki+ideas): gate the Wiki and Ideas domains on the native permission engine by @marcelfolaron in https://github.com/Leantime/leantime/pull/3479
security(blueprints): gate the consolidated canvas domain + close by-id IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3483
security(goalcanvas): gate the Goals domain + close by-id IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3485
security(canvas): gate the legacy Canvas-base controllers (Logicmodelcanvas) + Api\Canvas by @marcelfolaron in https://github.com/Leantime/leantime/pull/3486
fix(helm): correct session expiration units in Helm chart (fixes #3378) by @dashitongzhi in https://github.com/Leantime/leantime/pull/3487
fix(logicmodelcanvas): left-align status filter dropdown menu by @gloriafolaron in https://github.com/Leantime/leantime/pull/3484
feat(stageflow): spotlight non-hovered stages on row hover by @gloriafolaron in https://github.com/Leantime/leantime/pull/3481
feat(libs): npm-manage html2canvas + jsPDF by @gloriafolaron in https://github.com/Leantime/leantime/pull/3482
security(timesheets): gate the Timesheets domain (own-time vs manage) + matrix edit by @marcelfolaron in https://github.com/Leantime/leantime/pull/3490
security(files): gate the Files domain + close RPC IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3492
chore(logicmodelcanvas): drop unused snapshot mount div by @gloriafolaron in https://github.com/Leantime/leantime/pull/3491
security(reports): gate the Reports domain + de-expose system/telemetry RPC surface by @marcelfolaron in https://github.com/Leantime/leantime/pull/3501
fix(deps): bump shell-quote 1.8.2 → 1.8.4 (clear critical advisory) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3502
security(calendar): gate the Calendar domain + close cross-user IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3504
security(projects): gate the Projects god-service (recursion-safe, manager+ management) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3505
refactor(install): consolidate the 14 permission-engine migrations into one by @marcelfolaron in https://github.com/Leantime/leantime/pull/3506
security(permissions): fail closed when a mandatory projectIdParam can’t be resolved by @marcelfolaron in https://github.com/Leantime/leantime/pull/3507
ci(release): one-dispatch release pipeline (version bump, AI changelog, PR gate, auto-publish) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3508
security(permissions): validate projectIdParam is a real positive integer by @marcelfolaron in https://github.com/Leantime/leantime/pull/3509
ci(release): swap changelog generation from GitHub Models to the Claude API by @marcelfolaron in https://github.com/Leantime/leantime/pull/3510
Release v3.9.0 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3511
ci(release): set up PHP before make package (fixes v3.9.0 release build) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3512
fix(auth): establish user context for Sanctum Bearer API requests (3.9.0 regression) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3514
test(api): Bearer-auth JSON-RPC contract suite + CI gate by @gloriafolaron in https://github.com/Leantime/leantime/pull/3513
Release v3.9.1 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3515

New Contributors

@Roark1138 made their first contribution in https://github.com/Leantime/leantime/pull/3423
@duongynhi000005-oss made their first contribution in https://github.com/Leantime/leantime/pull/3405
@dashitongzhi made their first contribution in https://github.com/Leantime/leantime/pull/3487

Full Changelog: https://github.com/Leantime/leantime/compare/v3.8.0…v3.9.1