Version: 3.15.1

Security

• Calendar privacy - The calendar showed the personal events of every user with a higher user id; it now shows only your own events (#4034)
• Deactivated users - Deactivating a user now ends their open sessions on the next request, and their API keys and access tokens stop working. Setting an API key to "Deactivated" now actually disables it (#4042, #4075)
• Draft docs - A draft in Docs can only be opened by its author until it is published, also through its link, the activity feed and the API (#4056, #4072)

New Features

• Bulk project card data - A new getProjectsCardData API call returns card data for many projects in one request (#4026)

Bug Fixes

• Calendar iCal feed - Subscribing to the iCal feed from a calendar app works again, and the feed includes your To-Dos (#4018, #4077)
• To-do dialog headline - The to-do dialog shows the To-Do's title in its header again (#4008, #4071)
• Saving descriptions on PostgreSQL - Saving a To-Do with a long description no longer fails with a server error on PostgreSQL (#4005, #4069)
• Goal dates - Goal start and end dates no longer move by a day each time a goal is saved (#4046, #4073)
• Project duplication - Duplicating a project links the copied To-Dos to the copied milestones and parents, and no longer changes the original project (#4067)
• Client deletion - The delete dialog lists the projects that will be deleted with the client, and they are cleaned up like a normal project delete (#4040, #4076)
• Show Closed Projects - The "Show Closed Projects" toggle on All Projects works again (#4039, #4070)
• Canvas field labels - The Project Value Canvas and Strategy Message dialogs show their field labels instead of translation keys (#4049, #4074)
• Subfolder installs - Old /download.php attachment links and the mobile app's SSO login keep the subfolder Leantime runs in, and the nginx examples work for root and subfolder installs (#4062, #4068, #4065, #4061)
• MCP priority labels - MCP tools label ticket priorities correctly (1 = Critical) (#4030)

Improvements

• LDAP - Email and group attributes are matched case-insensitively (Active Directory userPrincipalName/memberOf work), a partial LEAN_LDAP_KEYS mapping no longer causes a login error, and sample.env shows valid JSON (#4028)
• Cache clearing - php bin/leantime cache:clearAll also empties the per-domain data caches (#4027)

Upgrade Notes

• No database changes.
• API keys and users whose status is not active can no longer authenticate with existing sessions, API keys or access tokens.
• Deleting a client that has projects now also requires permission to delete projects (default roles: manager and above). Over the API, clients.delete refuses a client whose projects have To-Dos, as the screen already did.
• The project pickers when adding a user or adding time no longer list closed projects.

What's Changed

Other Changes

• docs(claude-md): personal access tokens are core, not AdvancedAuth by @gloriafolaron in #4036
• fix(config): working nginx subfolder example by @gloriafolaron in #4061
• fix(status): keep the subfolder in the mobile OIDC login URL by @gloriafolaron in #4065
• fix(calendar): show only the user's own events by @gloriafolaron in #4034
• fix(cli): cache:clearAll also empties the per-domain data caches by @gloriafolaron in #4027
• fix(ldap): case-insensitive email/group attributes, partial LEAN_LDAP_KEYS, sample.env JSON by @gloriafolaron in #4028
• feat(projects): getProjectsCardData — card data for many projects in one call by @gloriafolaron in #4026
• fix: label ticket priorities on the ticket scale (1 = Critical) in MCP formatters by @alexxxxey in #4030
• fix(projects): duplicating a project links the copies, not the originals by @marcelfolaron in #4067
• fix(tickets): cut ticket history values to the changeValue column length by @marcelfolaron in #4069
• fix(docs): only the author can open a draft until it is published by @marcelfolaron in #4072
• fix(goals): store goal start/end dates in UTC so they stop drifting on save by @marcelfolaron in #4073
• fix(auth): deactivating a user ends their sessions and tokens (#4042) by @marcelfolaron in #4075
• fix(files): keep the subfolder in old /download.php links; nginx example sends them to index.php by @marcelfolaron in #4068
• fix(projects): "Show Closed Projects" on All Projects has an effect again by @marcelfolaron in #4070
• fix(tickets): to-do dialog shows the headline again, also in the browser tab by @marcelfolaron in #4071
• fix(blueprints): Project Value Canvas and Strategy Message dialogs show real field labels by @marcelfolaron in #4074
• fix(calendar): iCal feed works without a session again (#4018) by @marcelfolaron in #4077
• fix(clients): deleting a client names its projects and cleans them up like a project delete by @marcelfolaron in #4076
• Release v3.15.1 by @marcelfolaron in #4078

New Contributors

• @alexxxxey made their first contribution in #4030

Full Changelog: v3.15.0...v3.15.1