Version: 3.9.6

Security

Security Hardening - Addressed authorization, SSRF, reset-token, LDAP, and stored-XSS vulnerabilities (#3584)
Plugin Management - Plugin management now requires the proper permission and install input is validated more strictly (#3583)
Avatar Rendering - User IDs are now encoded in avatar image sources to prevent DOM-based XSS (#3582)
API Responses - Credentials are now stripped from getUser API responses (#3556, #3576)

New Features

Content Templates - Introduced a generic content templates domain (#3493)
My Day Schedule API - Added a getMyDaySchedule API endpoint that respects work hours and timezone (#3579)
Personal Access Tokens - Added shared AI/MCP support classes and personal access token management (#3560)
Domain Events - Added class-based domain events and filters with a legacy-string plugin bridge (#3503)

Bug Fixes

Project Roles - Fixed user role inheritance when adding a user to a project (#3580)
Kanban View - Fixed a rendering error caused by an undefined variable in the kanban view (#3554)
General Fixes - Resolved a batch of recently reported bugs (#3555, #3575, #3571, #3568, #3569, #3570, #3577, #3535, #3539, #3536, #3542, #3547)

Improvements

API Routing - Internal API calls now use canonical domain routes (#3557)
Form Components - Migrated buttons, text inputs, and textareas to reusable form component primitives (#3564, #3563, #3562, #3558, #3531)

What’s Changed

Other Changes

feat(api): session-scoped mobile endpoints (notifications inbox + calendar) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3529
fix(editor): position @mention dropdown beneath the caret by @marcelfolaron in https://github.com/Leantime/leantime/pull/3530
fix: resolve recent reported bugs (#3488, #3480, #3467, #3463) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3532
fix(deps): promote symfony/yaml to a production dependency by @marcelfolaron in https://github.com/Leantime/leantime/pull/3543
fix(blueprints): canvas add/edit item returns 404 (canvasSlug bound to $id) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3544
Release v3.9.5 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3545
fix: resolve recent reported bugs (#3535, #3539, #3536, #3542) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3547
fix: define $groupId variable before Blade component render in kanban view by @GautamKumarOffical in https://github.com/Leantime/leantime/pull/3554
feat(components): forms.button — migrate all buttons + establish the role model by @marcelfolaron in https://github.com/Leantime/leantime/pull/3531
feat(events): class-based domain events + filters with legacy-string plugin bridge (Tickets pilot) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3503
chore(phpstan): raise static analysis to level 2 (429→0, fix-forward) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3559
feat(components): forms.text-input no-op primitive + migrate 146 inputs (56 files) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3558
feat(core): extract shared AI/MCP support classes and add PAT management by @marcelfolaron in https://github.com/Leantime/leantime/pull/3560
chore(phpstan): raise static analysis to level 3 (46→0, fix-forward) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3561
chore(phpstan): raise static analysis to level 4 (227→0, dead-code removal) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3565
feat(components): forms.textarea no-op primitive + migrate 10 plain textareas by @marcelfolaron in https://github.com/Leantime/leantime/pull/3562
feat(components): migrate 44 class=button submit inputs to forms.button by @marcelfolaron in https://github.com/Leantime/leantime/pull/3563
chore(phpstan): climb to level 5 (argument types) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3566
feat(components): button + text-input completion round 2 (53 missed elements) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3564
fix: batch of open bug fixes (#3555, #3575, #3571, #3568, #3569, #3570) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3577
fix(users): strip credentials from getUser API responses (#3556) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3576
feat(users): getMyDaySchedule @api (work hours + timezone) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3579
feat(content-templates): generic templates domain (Phases 1, 3, 3b, 3c, 3d, 4) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3493
fix(projects): resolve user role inheritance when adding user to project (supersedes #3572) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3580
refactor(js): update internal /api/* calls to canonical domain routes by @ellitedom03 in https://github.com/Leantime/leantime/pull/3557
fix(js): encode avatar-src user id to clear CodeQL xss-through-dom alerts by @marcelfolaron in https://github.com/Leantime/leantime/pull/3582
harden(plugins): require permission for plugin management + tighten install input by @marcelfolaron in https://github.com/Leantime/leantime/pull/3583
harden(security): authz, SSRF, reset-token, LDAP, and stored-XSS fixes by @marcelfolaron in https://github.com/Leantime/leantime/pull/3584
Release v3.9.6 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3585

New Contributors

@GautamKumarOffical made their first contribution in https://github.com/Leantime/leantime/pull/3554
@ellitedom03 made their first contribution in https://github.com/Leantime/leantime/pull/3557

Full Changelog: https://github.com/Leantime/leantime/compare/v3.9.4…v3.9.6