Added

• CVE-Radar findings export and ad-hoc check: single vulnerabilities can be left out of the report and the AI prompt ("Select vulnerabilities"), e.g. to handle an update with big changes in a branch of its own. The prompt now asks first for a newer release of the direct dependency that brings in the fixed version, and forcing the version only if there is none.
• App Addresses: the star in the view of an address marks it as a favorite or removes the mark at once.
• CVE-Radar findings export and ad-hoc check: "Report by package" downloads the vulnerabilities per package (library and version) as PDF, Excel or JSON: tiles per severity, an overview with the highest score and the version that fixes all of them, then per package its vulnerabilities with score, description, affected versions and a link to the NVD or the advisory. For an ad-hoc check as for an area, a system, an instance or a component of the inventory; the selection of vulnerabilities and the replaced names apply.
• CVE-Radar
  • Bulk import of SBOMs into an area: a zip with the SBOMs of many repositories and container images (e.g. the output of a scan of a whole project) becomes a system per repository and a component per image. A preview shows what is created or updated, codes and names can be changed; logs, raw reports and an SBOM of everything are skipped. The largest zip is set per area by the security officer.
  • SBOMs are read as a stream, so big ones need little memory.
• CVE-Radar: the file of a vulnerability shows the ratings of its sources side by side (NVD, the CNA, the OSV advisories with GitHub's own rating, the EUVD, kept also once the NVD rated the vulnerability), so a differing severity can be traced.

Improved

• App Pages menu: on a tablet the categories of the main menu are open, opened or closed ones stay so; the main menu tab comes second.
• Notifications
  • App Push messages show the title and the beginning of the notification, as in the web version (for a chat message the message itself). Each user can switch the content off in "My account" (Apps) or in the settings of the app; projectforge.push.content=false keeps it out of every push.
  • The text of chat notifications no longer repeats their title: it shows the message, with its author where the title doesn't name them.
• App Booking: opening "Location, reference, tag" scrolls its fields into view.
• Invoices: the contact person of the customer (BT-56) is no longer printed in the invoice address of the invoice document, below the company name; the e-invoice still states it, and an invoice template may print it via the variable Ansprechpartner (with the condition isAnsprechpartner).
• Invoices: in the customer reference of the invoice document, the text after the colon of each line (e.g. "Supplier number: 1140300") is no longer printed bold; the label stays bold, as for the order number.
• CVE-Radar: the progress bar of an SBOM import (also of a zip with many SBOMs), of an uploaded library list and of matching again also runs while the components are matched against the vulnerabilities, with the OSV advisories checked and the findings stored.

Changed

• Backup: the data of the CVE-Radar sources (details of the vulnerabilities, OSV advisories, indexes) isn't backed up any more, the separate dump projectforge_cveradar_… is gone. After restoring, the imports fill it again by themselves: the NVD import reads the NVD since 1999 once more for the stored vulnerabilities without details, and their findings stay as they are until then.
• CVE-Radar inventory: the findings of a node are shown as CVEs by severity (critical, high, medium/low) and those only possibly affected, each CVE counted once, matching the key figures of its tooltip.
• CVE-Radar: the technologies and libraries of a component and the imported vulnerabilities are no longer kept in the history; existing entries are removed.
• CVE-Radar: an area, a system, an instance or a component of the inventory can be deleted with everything below it, its libraries and all its findings, for good. Before, a list shows what goes with the numbers of findings, libraries and technologies of every entry.

Fixed

• App Behind an SSO proxy, the pages no longer open in Safari after the proxy's session ended: after the new login the page asked for is loaded in the app again, and the pages tab no longer starts with the proxy's login.
• CVE-Radar: a Maven version with a qualifier other than a pre-release (Guava's 33.7.2-jre or 33.7.2-android, 1.0-jdk8, 5.3.18.RELEASE) is the release itself, no longer a pre-release of it that is still affected.
• CVE-Radar library upload: a file above the limit (5 MB, a zip 10 MB) is refused at once with its message instead of failing in the browser, and the progress bar stays visible above the buttons.
• CVE-Radar: the severity of a vulnerability known from OSV only (not yet from the NVD) belongs to its CVSS score, no longer to the rating of GitHub (e.g. critical with a score of 6.1); stored entries are corrected.
• App Booking: the keyboard no longer covers the text field being edited; the form scrolls it into view.
• Chat: in the full size view of several images, the arrow keys keep paging after the first or last image was reached. Changelog: a link of the table of contents opened as a drawer (narrow screens, app) scrolls to its entry again instead of back to the top.
• Sipgate: a permanently deleted address no longer comes back through the contact sync; its Sipgate contact is deleted instead.