leantime

v3.9.3 Feature

This release adds 2 notable features for engineering teams evaluating rollout.

Published 1mo Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agile asana calendar clickup gantt jira

+13 more

kanban lean leantime notion php project-management projects retrospective scrum sql strategy timesheets trello

Affected surfaces

auth rbac

Summary

AI summary

Updates Bug Fixes, Other Changes, and auth across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Bugfix	Medium	Fixes Bearer token authentication error (-32001) that denied all permission‑gated API methods. Fixes Bearer token authentication error (-32001) that denied all permission‑gated API methods. Source: llm_adapter@2026-06-14 Confidence: low	—
Bugfix	Low	Corrects stale route cache and fixes BadMethodCallException import in routing. Corrects stale route cache and fixes BadMethodCallException import in routing. Source: llm_adapter@2026-06-14 Confidence: high	—
Refactor	Low	Unifies all authentication paths (web login, API key, Bearer token) through a single session factory. Unifies all authentication paths (web login, API key, Bearer token) through a single session factory. Source: llm_adapter@2026-06-14 Confidence: high	—

Full changelog

Version: 3.9.3

Bug Fixes

Bearer Authentication - Resolved a Bearer token error (-32001) that denied every permission-gated API method for mobile and token-based integrations. The Sanctum-guard session stored the raw role integer instead of the role name the permission engine expects (#3525)

Improvements

Unified Session Handling - All authentication paths (web login, API key, and Bearer token) now build the user session through a single factory, so the role and two-factor state can no longer diverge between them. This also makes two-factor handling consistent for token-based authentication and adds clearer diagnostics when an unresolvable role is encountered (#3526)
API Auth Test Coverage - The Bearer JSON-RPC contract tests now run through the real server auth path and cover non-manager roles, catching authorization regressions for non-admin users that owner-only testing missed (#3526)

What's Changed

Other Changes

fix(auth): authenticate Bearer/PAT via core token store (real Bearer fix) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3522
fix(routing): self-heal stale route cache + correct BadMethodCallException import by @marcelfolaron in https://github.com/Leantime/leantime/pull/3523
Release v3.9.2 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3524
fix(auth): Sanctum-guard session stores role name not raw int (fixes Bearer -32001 on all gated methods) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3525
Release v3.9.3 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3526

Full Changelog: https://github.com/Leantime/leantime/compare/v3.9.1...v3.9.3

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track leantime

Get notified when new releases ship.

About leantime

Leantime is a goals focused project management system for non-project managers. Building with ADHD, Autism, and dyslexia in mind.