Worklenz 3.0.0 is the first release of the open-core edition. The open-source and Enterprise editions now share a version scheme — the Enterprise line is at 3.x, and future open-source releases continue from 3.x. The jump from v2.1.7 reflects this alignment, not a break in the 2.x line.
This release consolidates roughly six months of work from the development branch onto main.
Highlights
Open-core restructuring
- Enterprise/Business features moved behind a dedicated
src/ee/seam (backend and frontend) with their ownLICENSE.md - Exposed Business Plan source removed from the public tree
- Docker / Nginx management scripts and self-hosting setup restored and documented
Features folded in from development
- Client portal — clients, invoices, services, requests, chat, portal settings
- Project finance — rate cards, finance drawer/table, expenses, per-team currency
- Slack integration — project + settings integration, channel management
- Home dashboard rework, planner/schedule views, recurring tasks, time entries
- Guest access level, phase assignees, task-comment soft delete, project links
Security
- CodeQL pass on the merged tree: fixed SSRF in JIRA import, regex injection in comment mentions, ReDoS in the URL extractor, parameter type-confusion, tainted format strings, DOM XSS in entity decoding, and replaced hand-rolled HTML sanitizers with
sanitize-html/ DOMPurify (#410, #412) - Earlier SQL-injection hardening across controllers (#369)
Database
- ~40 new migrations (client portal, rate cards, notifications, holidays, indexes) — see
worklenz-backend/database/migrations
Upgrade notes
- Run pending database migrations before starting the new backend
- Docker images are published as
ghcr.io/worklenz/worklenz_backendandworklenz_frontend, tagged3.0.0,3.0,3, andlatest - Users pinned to
:2should review the migration set and thesrc/ee/licensing split before moving to:3
Full diff: v2.1.7...v3.0.0