Added

• App The time grid and the theme (light, dark, system) can be chosen in the settings; both are shared with the web pages.
• Custom logo: the height of the logo in the header can be set with projectforge.logoHeight (in px).
• Time sheets: a time grid (default 15 minutes) in "My account". The timer rounds the start down and the end up to it; the times can still be set to 5 minutes.
• Time sheets: a timer in the top bar of the web pages, shared with the app. Started on one, it can be stopped on the other; stopping opens a new time sheet.
• CVE-Radar findings export and ad-hoc check: single vulnerabilities can be left out of the report and the AI prompt ("Select vulnerabilities"), e.g. to handle an update with big changes in a branch of its own. The prompt now asks first for a newer release of the direct dependency that brings in the fixed version, and forcing the version only if there is none.
• App Addresses: the star in the view of an address marks it as a favorite or removes the mark at once.
• CVE-Radar findings export and ad-hoc check: "Report by package" downloads the vulnerabilities per package (library and version) as PDF, Excel or JSON: tiles per severity, an overview with the highest score and the version that fixes all of them, then per package its vulnerabilities with score, description, affected versions and a link to the NVD or the advisory. For an ad-hoc check as for an area, a system, an instance or a component of the inventory; the selection of vulnerabilities and the replaced names apply.
• CVE-Radar
  • Bulk import of SBOMs into an area: a zip with the SBOMs of many repositories and container images (e.g. the output of a scan of a whole project) becomes a system per repository and a component per image. A preview shows what is created or updated, codes and names can be changed; logs, raw reports and an SBOM of everything are skipped. The largest zip is set per area by the security officer.
  • SBOMs are read as a stream, so big ones need little memory.
• CVE-Radar: the file of a vulnerability shows the ratings of its sources side by side (NVD, the CNA, the OSV advisories with GitHub's own rating, the EUVD, kept also once the NVD rated the vulnerability), so a differing severity can be traced.
• App The changelog opens from the "more" menu (the entry with the version).
• App On a wide screen (landscape, iPad) the menu of the pages shows its entries in several columns.
• App In the settings, the navigation in landscape (the column of icons) can be placed at the right side instead of the left, e.g. for the right thumb.
• Chat: a link in a message shows a preview of the linked page (title, description, image), as in other chats, already while writing. The server fetches it, so the browser loads nothing from the linked site; the author can remove the preview (before or after sending), administrators can switch the previews off (projectforge.chat.linkPreview.enabled=false).
• CVE-Radar: optional connection to Dependency-Track, as a second detection of the findings in parallel to the own matching; for now the connection is tested and shown on the system dashboard.
• CVE-Radar: the dialog of an area, system, instance or component has a tab "Findings" with its open findings (key figures of the CVEs by severity, also as filters, counts, filter by certainty, a click opens the CVE); a click on the counts of the tree opens it directly, hovering over them shows the key figures, and the export of the findings stays visible on every row with findings.
• CVE-Radar: the answers of the members to a team check show their counts (answered, not answered yet, affected, per answer) and can be filtered by answer with pinned pills.
• CVE-Radar: import of the vulnerabilities of the European Union Vulnerability Database (EUVD) as a supplement to the NVD. It adds the EUVD id, the EPSS and the day of exploitation, and brings vulnerabilities the NVD doesn't have yet, also ones without a CVE id. The EUVD names products only, so these match as possible. Off by default.
• CVE-Radar: the list and the file of a vulnerability show where its data comes from (NVD, OSV, EUVD) as badges, and the list has a pinned filter to select by source.
• App The system message of the administrators (e.g. maintenance work) is shown above the pages, as in the web version.
• Address campaign values: new filter "Edited by" to list the entries a chosen user has created or changed.
• App The web tabs have a browser menu with back, forward, reload, find in the page, share link, open in the browser and restart; pull to refresh now also works on the pages with the menu, and a lost connection shows an error with a retry instead of an empty page.
• New column "Edited by" with a pill for everybody who created or changed an entry, in the lists of address campaign values, outgoing and incoming invoices, orders, leave corrections, liquidity entries, incoming and outgoing mail, contracts, the visitor book, notification rules, customers and projects.
• CVE-Radar, notification rules: new rule type "Unanswered team checks of a case". The rule names a case and reminds the members who haven't answered one of its team checks asking every member yet, at most once a day, by schedule or triggered by hand. The reminder is done as soon as they answered.
• App All servers the app is logged in at send pushes, not only the one shown. The push names its server, a tap on one of another server offers to switch there and opens it; their open notifications are shown at the menu, in the server list and in the notification center, the icon counts all of them. Older servers push only while shown, as before.
• App A contact of the address book can be added to the own contacts of the device or shared as vCard (messages, mail, messengers), also without a connection to the server.
• App The ProjectForge tab (globe) opens with a menu that is easy to reach on a phone: tabs for the favorites, the pages opened last, the main menu with expandable areas and the user menu with the appearance (light, dark, system; the tab chosen last opens again), and a search across all entries (or in all data). Tapping the globe again closes the menu and shows the page as it was; tapped once more, it opens the menu again.
• Setting projectforge.2fa.exemptUsers: login names that need no second factor, e.g. for the account of an app store review.
• Chat: messages of others can be reported to the administrators, and users can be blocked (no direct messages, no notifications, mentions or search hits of them).
• CVE-Radar: the libraries of the inventory are matched by package and version against the advisories of OSV.dev (Maven, npm, PyPI, NuGet, Packagist, Go, crates.io), also when the NVD names them late or not at all; a matching advisory becomes a vulnerability whatever its score.
• Passwords: the number of character classes a password must contain (uppercase letters, lowercase letters, digits, special characters, e.g. 3 of 4) is configurable next to the minimum length.
• App A warning if the app is too old for the server or the server too old for the app; "My account" marks outdated apps.
• App The logins of several servers are kept, and the server can be switched in the account menu without logging in again; another server is added there too.
• E-invoice: new fields order number (BT-13), department of the orderer (BT-56) and cost center (BT-19) on the invoice and the account (department, cost center); the labels of the invoice and account forms name the e-invoice term (BT-x) the field is sent in. The invoice template gets the variables Bestellnummer and Kostenstelle (with isBestellnummer/isKostenstelle), the department is part of the address.
• Chat: code blocks in messages and room descriptions have a copy button.
• Invoices: the cost 1 and cost 2 units of a cost assignment can be copied without dots, e.g. for entering them in another accounting system.
• Mobile app: notifications and push (iPhone)
  • App The notifications of the web version (rules, chat) are shown in the app as well: a bell with the count, the list with the archive, and confirming or finishing them; a link opens the page in the app.
  • App A new notification wakes the app with a push message (APNs, projectforge.push.apns.*), without its content in the message. Without a configured key nothing is sent and the app polls as before.
• Mobile app (in preparation): time sheets
  • App The app books time sheets on the phone: a week strip with the daily totals, the bookings of the day with the gaps between them (a tap books a gap), recent bookings and templates to start from, a task search, and the cost unit chosen automatically where the task has only one. The server's checks (overlap, closed tasks, protected periods) apply as in the web version.
  • App A timer in the app starts and stops a booking on the device; stopping opens the form with the time rounded to 5 minutes.
  • App The time sheet list of the web pages switches to the app's tab; the form of a single booking stays in the web pages when opened from a link.
• CVE-Radar: notification without details and about outdated lists of libraries
  • A new notification rule "New findings of the CVE radar" starts with a text that names no details ("there may be updates") and a link to the list; the new variable cvrListLink always links to the list.
  • New rule type "Outdated lists of libraries of the CVE radar": the responsible team of a component whose list of libraries was applied more than a number of days ago (30 by default) is told, at most once a week, and the notification is resolved by an update of the list. The day of the last list is now recorded per component.
• Mobile app (in preparation)
  • App Behind an SSO proxy (e.g. Authentik as forward auth) the app gets the proxy's session from the browser login (projectforge.app.proxyCookies); when it expires, the app logs in again in the browser.
  • App The login of the app offers the recently used servers, and the logout works even if the server can't be reached.
  • App Business cards are stored in the app and shown offline too; they are reloaded silently when the tab is opened and by a button, and can be added to the Apple Wallet if the server is configured for it (iPhone), also by the link of the web page in the app.
  • App The app gives more room to the pages: no title bar above the web pages and the chat, a slim navigation bar with icons only, and in landscape a narrow navigation at the side.
  • App In the app, the menu entries "Chat" and "My business cards" and the bell of the web pages switch to the app's own tab; the new settings of the app can keep each of them in the web version.
  • App The app has an address book like the Contacts app: a search field, sections with an index at the side, and tapping a number offers a call or a message, a mail address opens the mail app. All addresses are stored on the device (also offline) and updated silently; editing opens the form of the web pages, and the address list of the web pages switches to the app's tab.
  • App The app's own screens follow the light or dark appearance chosen in the web pages (also offline), and the web pages no longer flash white while loading.
• Digital business cards: add a card to the Apple Wallet (needs a Pass Type ID certificate, see the admin guide).
• CVE-Radar: ad-hoc check of uploaded files against all vulnerabilities
  • The new page Ad-hoc check takes lockfiles, SBOMs, build tool output or a zip with such lists and checks every package against the imported vulnerabilities, with a progress bar per file. Nothing is stored; every reader may check, and only the person who started a check sees its result.
  • The result lists the vulnerabilities with package, version, file and the case of the security team, can be downloaded as JSON, and comes with a prompt asking an approved AI system how to fix them. The names of the files are replaced by default.
• CVE-Radar: research a new case with an AI system
  • Research with AI (security team) builds a prompt for an approved AI system from the CVE id or a description of the incident, sources and notes, with the NVD data of an imported CVE. There is no direct connection: the prompt is copied there, its answer pasted back. The dialog has three steps (details, prompt, answer), each with the way back; the prompt can be copied or downloaded as a file.
  • The answer (one JSON block) is checked and shown as a preview with a copy button per value; Create case creates the case with title, description, priority and reason, fix version, workaround, measures and references, marked as created with the help of an AI system.
• CVE-Radar: download a case as JSON and import it again
  • Download as JSON in the file of a case saves its values as stored (without status, assignee, ratings, team checks and discussion).
  • Import case (security team) creates a new case from such a file after a preview, e.g. to copy a case into another instance of ProjectForge.
  • Import case also takes the answer of an AI system to the prompt of Research with AI, e.g. saved as a file; quotes made typographic by copying are straightened.
• CVE-Radar: export the findings of a project, with a prompt for advice on the fix
  • The open findings of a node of the inventory and below as one JSON file: per vulnerability the NVD data, the case of the security team and the matched technologies with versions and package URLs. Only what the user may see; internal names are replaced by neutral ones by default.
  • A prompt with the report asks an approved AI system how to fix every vulnerability in the project: whether it is really affected, the target version and how to force it for a transitive dependency, a workaround, and how to verify the fix.
• CVE-Radar: more ways to upload the libraries of a component
  • All lists of a component can be uploaded in one zip, collected by a script of the project (the user guide has an example): lockfiles, SBOMs, output of the build tools and package lists of the images. Only the files of such lists are read; files that may hold tokens (.npmrc, .env, gradle.properties, settings.xml) are skipped unread. The preview shows every file of the zip with its format.
  • The lockfile of pnpm (pnpm-lock.yaml, versions 5, 6 and 9) is read, without the development dependencies.
  • The upload dialog shows how to list the packages of a container image (e.g. eclipse-temurin: dpkg-query, apk, rpm or an SBOM from syft), where native libraries such as brotli, zlib or OpenSSL show up, and links to the chapter of the user guide.
• Mobile app (in preparation)
  • App The ProjectForge app for iOS and Android logs in via the browser, with password and second factor (WebAuthn or code) as usual; the browser asks once more before an app is connected. The first version shows the own digital business cards, also without network.
  • App All other pages of ProjectForge open inside the app, without a second login. Logging out the app ends them as well.
  • App My account: the connected apps with their last usage, each can be logged out. A password change logs out all apps; an app unused for 90 days is logged out automatically.

Improved

• App The timer is kept on the server: it is shared with the web pages and other devices, and its start is taken from the server's clock (needs a current server; otherwise it stays on the device).
• Lists: the head takes less height. Title, search and actions share one line, the filters and the totals stay on one line, and on narrow screens the actions are collected behind a "more" button. On tablets and phones the head scrolls away with the rows. The invoice and liquidity lists switch to their charts or forecast with a button in the head instead of tabs, and the structure tree and the notification log use the same compact head.
• App Pages menu: on a tablet the categories of the main menu are open, opened or closed ones stay so; the main menu tab comes second.
• Notifications
  • App Push messages show the title and the beginning of the notification, as in the web version (for a chat message the message itself). Each user can switch the content off in "My account" (Apps) or in the settings of the app; projectforge.push.content=false keeps it out of every push.
  • The text of chat notifications no longer repeats their title: it shows the message, with its author where the title doesn't name them.
• App Booking: opening "Location, reference, tag" scrolls its fields into view.
• Invoices: the contact person of the customer (BT-56) is no longer printed in the invoice address of the invoice document, below the company name; the e-invoice still states it, and an invoice template may print it via the variable Ansprechpartner (with the condition isAnsprechpartner).
• Invoices: in the customer reference of the invoice document, the text after the colon of each line (e.g. "Supplier number: 1140300") is no longer printed bold; the label stays bold, as for the order number.
• CVE-Radar: the progress bar of an SBOM import (also of a zip with many SBOMs), of an uploaded library list and of matching again also runs while the components are matched against the vulnerabilities, with the OSV advisories checked and the findings stored.
• Security: the CSRF token of a session is renewed after an hour at the latest; the task tree and the choice of a personal data transfer box are only changed by POST requests; for browsers without fetch metadata, requests whose Origin or Referer names a foreign host are refused.
• The lists of orders, invoices, projects, cost units and time sheets and the order statistics show the empty filters business unit, customer and project as one pill; a filter gets its own pill once something is selected in it.
• Chat messages and all rich texts (descriptions, notes, alerts) show their urls (with http(s):// or www.) as clickable links, also older texts and a url typed as the last word.
• Changelog: a table of contents of the major versions and their releases beside the text (on narrow screens and in the app behind a button), as on the website; the entry in view is highlighted and the column can be hidden.
• Chat: opening a conversation puts the cursor into the message field (not on touch devices, where the keyboard would cover the messages).
• CVE-Radar
  • Packages of Debian and Ubuntu (SBOMs of containers and servers) are matched against the advisories of their release from OSV.dev: fixes backported by the distribution no longer show as possibly affected, open CVEs of the release as affected, CVEs without impact (unimportant, negligible) not at all. New OSV ecosystems Debian and Ubuntu, on by default.
  • Binary packages of a distribution (libssl3) are matched by their source package (openssl), as the advisories name it (upstream qualifier of an SBOM). A dpkg-query list with the lines of /etc/os-release and the source packages is matched like an SBOM; the command in the user guide writes them.
  • Fewer false positives by the name of a CPE: an entry for a runtime (node.js, Rust, Python, …) only meets libraries of that ecosystem, and for libraries known to OSV the vendor has to fit the package (Adobe Connect is no longer the npm package connect).
• CVE-Radar
  • Findings per library: the tab "Findings" switches to one row per library with the number of its CVEs, the highest severity and the update that fixes them at once; the export has the same summary.
  • The findings of a node can be checked again by hand ("Check again" in the dialog of its findings); the message tells how many are new, changed or removed.
  • Every library uploaded for a component shows where it was found: the file of the upload and, in the SBOM of an image, the place inside it.
  • The findings of a node can be filtered by the uploaded file they were found in; the key figures and counts then show that file only.
  • Advisories for other operating systems only (e.g. Windows) no longer match a component running on Linux.
  • Uploading the libraries runs in the background with a progress bar, so a large upload no longer runs into a timeout.
• CVE-Radar, tab "Statistics": optionally look back 1, 2, 5 or 10 years.
• CVE-Radar, My CVE-Radar: "Done" and "Not affected" ask before saving and explain that they answer for yourself only and don't close the case. The case card also shows the checks of your own groups with their answer button. If such a check asks every member, its answer is your answer to the case as well, so there is only one answer per person. In the table of these checks the identifying columns and the actions stay pinned.
• Chat: on touch devices and in the app, a long press on a reaction shows who reacted.
• Chat: the search lists all matching people, each with buttons to start a direct message or an encrypted chat.
• E-invoice: the customer's invoice recipient email (BT-49) and the email of its contact person (BT-58) are separate fields now, on invoice and account. The seller's contact email (BT-43) is prefilled from the configuration and editable on the invoice.
• App Below the QR code of a business card a small list shows every field the card contains, including the photo, also without a connection to the server.
• Digital business card: below the QR code a small list shows every field the card contains, including the photo.
• The QR code of a business card is rendered at a higher resolution, so it stays sharp when shown large (e.g. in the app).
• Address images: larger preview images, so they look sharp in the app's address list (existing previews are renewed when the images are shrunk again in the administration).
• App The chat tab shows no menu of the web version; tapping the chat button again leads back to the chat start page.
• App Time sheets: the structure element can be chosen in the task tree (level by level, starting at the current one, with a search in the level and everything below it), the search finds words of the whole path, the path is shown above the title, cost units are chosen in a scrollable selection box with number and text, the time sheet tab is no longer marked as under construction, and the templates open in a list instead of a row of chips.
• Order mails: clearer layout with the buttons at the top, and a button to the order notification settings.

Changed

• The CVE-Radar is now called CVE-Clinic. Old links to its pages are redirected; the plugin id, settings (projectforge.plugin.cveradar.*) and database tables keep their names.
• Backup: the data of the CVE-Radar sources (details of the vulnerabilities, OSV advisories, indexes) isn't backed up any more, the separate dump projectforge_cveradar_… is gone. After restoring, the imports fill it again by themselves: the NVD import reads the NVD since 1999 once more for the stored vulnerabilities without details, and their findings stay as they are until then.
• CVE-Radar inventory: the findings of a node are shown as CVEs by severity (critical, high, medium/low) and those only possibly affected, each CVE counted once, matching the key figures of its tooltip.
• CVE-Radar: the technologies and libraries of a component and the imported vulnerabilities are no longer kept in the history; existing entries are removed.
• CVE-Radar: an area, a system, an instance or a component of the inventory can be deleted with everything below it, its libraries and all its findings, for good. Before, a list shows what goes with the numbers of findings, libraries and technologies of every entry.
• App The app starts with the tab used last on the device instead of always with the business cards, and the pages tab (globe) with the page shown last.
• App The server switch and the settings of the "more" menu slide up over the tabs like the notifications, the tab bar stays visible below them (adding a server and the log open within them, with an arrow back); the "more" menu grows as high as its entries need.
• App New app icon with the new ProjectForge logo.
• App The progress of a day in the time sheets is measured against a fifth of the own weekly working hours valid on that day instead of 8 hours.
• CVE-Radar: the imported data of the vulnerabilities is stored in a table of its own; the backup script writes it with the OSV advisories and the state of the imports into a dump of its own (projectforge_cveradar_…), restorable from the sources. Cases, team checks, answers and findings stay in the main dump, which is complete without it. Adapt an existing backup script (adminguide, “Backup script”).
• New ProjectForge logo: in the web interface (light and dark theme), on the website, as favicon and icon of the browser and the home screen, and on the Wallet pass of the business card.
• Docker: the image is based on Ubuntu 24.04 (Eclipse Temurin 21 JRE, formerly Ubuntu 22.04) and installs the security updates of the base image when it is built; the compose example uses PostgreSQL 17 instead of 13, which is out of support (an existing database has to be dumped and restored, see docker/README.adoc).
• Digital business cards: the photo is linked by a public url with a random token (no login, not guessable), also without a gateway; the url stays the same when the image is replaced or deleted, and can be revoked with "Renew photo link" on the card. The base url can be set with projectforge.businessCard.photoBaseUrl. Update the gateway together with the server; photo links of earlier QR codes stop working.
• Creating an e-invoice (XRechnung, ZUGFeRD) now runs the e-invoice checker over the generated file and shows the result (valid, warnings or errors) in a dialog.
• Notification rules: the rule types come from the modules and plugins that provide them. The rule types of a deactivated plugin (e.g. the CVE-Radar) aren't offered any more, and its rules wait until the plugin is active again.
• App The week strip of the time sheets follows the finger when swiped and snaps to a whole week; the week starts on the first day of the week set in "My account".
• The notifications of chat messages show the beginning of the message (in rooms with its author) instead of repeating their title, in the app and in the notification center of the web pages. Only for the recipient while they may read the conversation; mails and pushes keep their generic text.
• App The notifications (bell) and the "more" menu slide up over the tabs like the menu of the pages, the tab bar stays visible below them; pulling them down, a tap above them or their button again closes them.
• Error digest: the regular digest is sent once a day at 07:00 instead of every hour, only urgent problems (security, data, immediate events) send it early, at most once an hour. Configurable by projectforge.support.errorDigest.interval, sendAt and urgentMinGap.
• Faster first page of big lists: the CVE-Radar start page no longer loads every vulnerability to build the list
• More room for content on mobile devices
  • On narrow or low screens (e.g. a phone in landscape) the logo row and the status bar are hidden, and the paddings of edit pages, tabs, action bar and list footer are smaller; changelog, version and copyright are in the user menu there.
  • The list footer shows only the range and the page buttons around the current page; the tabs of an edit page scroll horizontally.
  • The menu of an area at the top right of its pages (e.g. CVE-Radar) is a single menu button on narrow screens; on the file of a CVE-Radar case the header scrolls with the content on narrow or low screens.

Fixed

• App Behind an SSO proxy, the pages no longer open in Safari after the proxy's session ended: after the new login the page asked for is loaded in the app again, and the pages tab no longer starts with the proxy's login.
• CVE-Radar: a Maven version with a qualifier other than a pre-release (Guava's 33.7.2-jre or 33.7.2-android, 1.0-jdk8, 5.3.18.RELEASE) is the release itself, no longer a pre-release of it that is still affected.
• CVE-Radar library upload: a file above the limit (5 MB, a zip 10 MB) is refused at once with its message instead of failing in the browser, and the progress bar stays visible above the buttons.
• CVE-Radar: the severity of a vulnerability known from OSV only (not yet from the NVD) belongs to its CVSS score, no longer to the rating of GitHub (e.g. critical with a score of 6.1); stored entries are corrected.
• App Booking: the keyboard no longer covers the text field being edited; the form scrolls it into view.
• Chat: in the full size view of several images, the arrow keys keep paging after the first or last image was reached. Changelog: a link of the table of contents opened as a drawer (narrow screens, app) scrolls to its entry again instead of back to the top.
• Sipgate: a permanently deleted address no longer comes back through the contact sync; its Sipgate contact is deleted instead.
• App The + of the addresses opens the form of a new address instead of an error page (not found).
• App The search of the pages menu shows its results while typing, above the keyboard (not only after the search key).
• Chat messages and rich texts: a link whose url is edited afterwards leads to the edited url, not to the one typed first.
• Security updates of the libraries freemarker (2.3.35) and jsoup (1.23.2).
• CVE-Radar: a team check can ask every member of the group (e.g. everyone checks the own client); each answer is stored and the check stays open until all members answered who logged in within the last 90 days (configurable). Before, every answer replaced the one before.
• Calendar: the start time of an entry can now be changed by dragging its top edge, not only the end time.
• Notification mails (e.g. about new chat messages) now contain a link to the chat or the concerned entry.
• Notification rules: the menu entries of plugins (e.g. the CVE-Radar) can be chosen as menu counter and as link of the notifications.
• App The badges of the chat and the notifications follow at once: a push sets the bell's count when it arrives, and a chat read or a notification done in the pages removes them right away, no longer only with the next update a minute later.
• Calendar: a time sheet opened from a break keeps its end time when the start time is changed.
• Invoices: the invoice document and the e-invoice use the same formulas
  • The gross sum is the net sum plus the vat sum. It was the sum of the positions' gross amounts, whose vat is rounded per position, and could differ by a cent from the e-invoice, so the recipient could reject the invoice.
  • The export of an e-invoice (XRechnung, ZUGFeRD) compares its sums with those of the invoice and refuses the export if they differ.
  • The invoice document shows quantity and unit price with all their decimals, as the e-invoice does, instead of rounded to two.
• App Connecting the app behind an SSO proxy works at the first attempt, also when the proxy brings the browser back from its login without the parameters of the link.
• Scripting: Kotlin scripts failed with "Unresolved reference 'cveradar'", the classes of the CVE radar and IHK plugins were missing in the script classpath.
• Calendar on small screens: the calendar chooser has a line of its own under the title and the buttons instead of being covered by them.
• CVE-Radar: the file of an incident opens again and has a tab for its description
  • The file of a case without a CVE showed an empty page. It now opens on the new first tab "Description", which shows the description of the case and lets the security team edit it with a rich text editor.
• Kost2 sometimes missing in overviews such as the structure tree, the project list or the cost unit selection of a time sheet, although it existed: for instance after a project was reactivated, or for a cost unit created while the caches were being reloaded in the background.
• Order book: a payment schedule dated in a following month now also defers the invoice of a finished position (filter "to be invoiced", next invoice date)
• Outgoing invoices: planned invoices no longer count in the statistics of the invoice list (gross, net, open, overdue).
• Small screens: on a very low display (e.g. a phone in landscape) the page now scrolls, so the content below the header is reachable.