Added

• App The changelog opens from the "more" menu (the entry with the version).
• App On a wide screen (landscape, iPad) the menu of the pages shows its entries in several columns.
• App In the settings, the navigation in landscape (the column of icons) can be placed at the right side instead of the left, e.g. for the right thumb.
• Chat: a link in a message shows a preview of the linked page (title, description, image), as in other chats, already while writing. The server fetches it, so the browser loads nothing from the linked site; the author can remove the preview (before or after sending), administrators can switch the previews off (projectforge.chat.linkPreview.enabled=false).
• CVE-Radar: optional connection to Dependency-Track, as a second detection of the findings in parallel to the own matching; for now the connection is tested and shown on the system dashboard.
• CVE-Radar: the dialog of an area, system, instance or component has a tab "Findings" with its open findings (key figures of the CVEs by severity, also as filters, counts, filter by certainty, a click opens the CVE); a click on the counts of the tree opens it directly, hovering over them shows the key figures, and the export of the findings stays visible on every row with findings.
• CVE-Radar: the answers of the members to a team check show their counts (answered, not answered yet, affected, per answer) and can be filtered by answer with pinned pills.

Improved

• Security: the CSRF token of a session is renewed after an hour at the latest; the task tree and the choice of a personal data transfer box are only changed by POST requests; for browsers without fetch metadata, requests whose Origin or Referer names a foreign host are refused.
• The lists of orders, invoices, projects, cost units and time sheets and the order statistics show the empty filters business unit, customer and project as one pill; a filter gets its own pill once something is selected in it.
• Chat messages and all rich texts (descriptions, notes, alerts) show their urls (with http(s):// or www.) as clickable links, also older texts and a url typed as the last word.
• Changelog: a table of contents of the major versions and their releases beside the text (on narrow screens and in the app behind a button), as on the website; the entry in view is highlighted and the column can be hidden.
• Chat: opening a conversation puts the cursor into the message field (not on touch devices, where the keyboard would cover the messages).
• CVE-Radar
  • Packages of Debian and Ubuntu (SBOMs of containers and servers) are matched against the advisories of their release from OSV.dev: fixes backported by the distribution no longer show as possibly affected, open CVEs of the release as affected, CVEs without impact (unimportant, negligible) not at all. New OSV ecosystems Debian and Ubuntu, on by default.
  • Binary packages of a distribution (libssl3) are matched by their source package (openssl), as the advisories name it (upstream qualifier of an SBOM). A dpkg-query list with the lines of /etc/os-release and the source packages is matched like an SBOM; the command in the user guide writes them.
  • Fewer false positives by the name of a CPE: an entry for a runtime (node.js, Rust, Python, …) only meets libraries of that ecosystem, and for libraries known to OSV the vendor has to fit the package (Adobe Connect is no longer the npm package connect).
• CVE-Radar
  • Findings per library: the tab "Findings" switches to one row per library with the number of its CVEs, the highest severity and the update that fixes them at once; the export has the same summary.
  • The findings of a node can be checked again by hand ("Check again" in the dialog of its findings); the message tells how many are new, changed or removed.
  • Every library uploaded for a component shows where it was found: the file of the upload and, in the SBOM of an image, the place inside it.
  • The findings of a node can be filtered by the uploaded file they were found in; the key figures and counts then show that file only.
  • Advisories for other operating systems only (e.g. Windows) no longer match a component running on Linux.
  • Uploading the libraries runs in the background with a progress bar, so a large upload no longer runs into a timeout.

Changed

• App The app starts with the tab used last on the device instead of always with the business cards, and the pages tab (globe) with the page shown last.
• App The server switch and the settings of the "more" menu slide up over the tabs like the notifications, the tab bar stays visible below them (adding a server and the log open within them, with an arrow back); the "more" menu grows as high as its entries need.
• App New app icon with the new ProjectForge logo.
• App The progress of a day in the time sheets is measured against a fifth of the own weekly working hours valid on that day instead of 8 hours.
• CVE-Radar: the imported data of the vulnerabilities is stored in a table of its own; the backup script writes it with the OSV advisories and the state of the imports into a dump of its own (projectforge_cveradar_…), restorable from the sources. Cases, team checks, answers and findings stay in the main dump, which is complete without it. Adapt an existing backup script (adminguide, “Backup script”).
• New ProjectForge logo: in the web interface (light and dark theme), on the website, as favicon and icon of the browser and the home screen, and on the Wallet pass of the business card.
• Docker: the image is based on Ubuntu 24.04 (Eclipse Temurin 21 JRE, formerly Ubuntu 22.04) and installs the security updates of the base image when it is built; the compose example uses PostgreSQL 17 instead of 13, which is out of support (an existing database has to be dumped and restored, see docker/README.adoc).

Fixed

• App The + of the addresses opens the form of a new address instead of an error page (not found).
• App The search of the pages menu shows its results while typing, above the keyboard (not only after the search key).
• Chat messages and rich texts: a link whose url is edited afterwards leads to the edited url, not to the one typed first.
• Security updates of the libraries freemarker (2.3.35) and jsoup (1.23.2).