Version: 3.9.1

Bug Fixes

• Bearer API Authentication - Restored user context for Sanctum Bearer API requests, fixing a 3.9.0 regression (#3514)

Improvements

• API Contract Tests - Added a Bearer-auth JSON-RPC contract test suite with a CI gate (#3513)

What's Changed

Other Changes

• Security: comprehensive remediation across 7 vulnerability families by @marcelfolaron in https://github.com/Leantime/leantime/pull/3399
• Modernize all controllers from run() to get()/post() by @marcelfolaron in https://github.com/Leantime/leantime/pull/3408
• fix: Value Proposition Canvas 500 (Undefined variable $currentCanvas) (#3402) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3422
• Refactor: thin controllers / fat services across all non-canvas domains by @marcelfolaron in https://github.com/Leantime/leantime/pull/3420
• refactor: consolidate canvas domains into a unified Blueprints domain (YAML-driven) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3421
• feat(api): JSON-RPC migration foundation + Tickets pilot by @marcelfolaron in https://github.com/Leantime/leantime/pull/3424
• feat(api): JSON-RPC migration batch 2 — Submenu, Sessions, Reactions, Notifications by @marcelfolaron in https://github.com/Leantime/leantime/pull/3425
• Fix 500 on client detail page: undefined constant generalComment by @Roark1138 in https://github.com/Leantime/leantime/pull/3423
• fix(clients): show accurate discussion count on client detail page by @marcelfolaron in https://github.com/Leantime/leantime/pull/3428
• feat(api): JSON-RPC migration batch 3 — Calendar (+ delete dead Ideation) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3426
• feat(api): JSON-RPC migration — Ideas (with project-access authorization) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3427
• feat(api): JSON-RPC migration — Users JSON endpoints by @marcelfolaron in https://github.com/Leantime/leantime/pull/3429
• Retire the legacy Api REST controllers (binary/upload → domains, Projects sort → JSON-RPC, delete dead Tags/Timer) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3430
• refactor(blueprints): native Laravel controllers, drop the dispatch bridge by @marcelfolaron in https://github.com/Leantime/leantime/pull/3432
• feat(core): typed exception hierarchy + JSON-RPC response types by @marcelfolaron in https://github.com/Leantime/leantime/pull/3431
• fix(tickets): guard undefined $groupBy/$newField in list views by @marcelfolaron in https://github.com/Leantime/leantime/pull/3433
• cleanup: remove dead $x = $x; Blade self-assign artifacts by @marcelfolaron in https://github.com/Leantime/leantime/pull/3434
• refactor: merge Strategy domain into Blueprints by @marcelfolaron in https://github.com/Leantime/leantime/pull/3435
• feature: RPC-only service methods throw typed exceptions on denial by @marcelfolaron in https://github.com/Leantime/leantime/pull/3436
• Fix #1099 by @duongynhi000005-oss in https://github.com/Leantime/leantime/pull/3405
• feat(tickets): finish collaborators feature — notifications, persistence & hardening (#1099) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3437
• build(deps): bump @fullcalendar/luxon3 from 6.1.17 to 6.1.20 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3409
• build(deps): bump fullcalendar from 6.1.17 to 6.1.20 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3417
• build(deps): bump katex from 0.16.21 to 0.17.0 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3410
• build(deps-dev): bump webpack-cli from 5.1.4 to 7.0.3 by @dependabot[bot] in https://github.com/Leantime/leantime/pull/3413
• chore(deps): bump icalendar + dotlottie-wc, remove Dependabot by @marcelfolaron in https://github.com/Leantime/leantime/pull/3438
• perf: speed up dashboard & hot paths (session locking, query dedupe, event patterns) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3439
• ci(phpstan): raise static analysis to level 1 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3440
• fix(mobile): responsive stabilization sweep for phones & tablets by @marcelfolaron in https://github.com/Leantime/leantime/pull/3442
• perf(dashboard): stop full-page repaints & cross-widget loading-indicator churn by @marcelfolaron in https://github.com/Leantime/leantime/pull/3443
• feat(components): Blade component tiers + central HTMX event convention by @marcelfolaron in https://github.com/Leantime/leantime/pull/3441
• fix: restore data binding in milestone & wiki dialogs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3444
• fix: repair #3441 regressions blocking acceptance (app.js bundle syntax + stale install step) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3453
• fix(tickets): enforce editor role on save + honor milestone project change by @marcelfolaron in https://github.com/Leantime/leantime/pull/3445
• fix(plugins): stop marketplace 500s by coercing API data to typed model props by @marcelfolaron in https://github.com/Leantime/leantime/pull/3446
• fix(db): PostgreSQL compatibility (write limits, sequences, pdo_pgsql, JS escaping) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3447
• fix(ldap): return a normal auth error instead of a 500 on bad credentials by @marcelfolaron in https://github.com/Leantime/leantime/pull/3448
• fix(comments): open the edit/reply box above the replies thread by @marcelfolaron in https://github.com/Leantime/leantime/pull/3450
• feat(tickets): add "Not assigned" milestone filter option (#3252) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3452
• feat(core): WorkStructure meta-model infrastructure by @marcelfolaron in https://github.com/Leantime/leantime/pull/3454
• fix(timesheets): skip blank cells when saving the weekly grid by @marcelfolaron in https://github.com/Leantime/leantime/pull/3449
• fix(wiki): save notes from the All Notes grid into a default notebook by @marcelfolaron in https://github.com/Leantime/leantime/pull/3451
• feat(notifications): mobile push device tokens (Expo + FCM) + getUnreadCount RPC (#3398) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3401
• feat(logicmodelcanvas): Logic Model board + WorkStructure orchestration by @marcelfolaron in https://github.com/Leantime/leantime/pull/3455
• feat(notifications): mobile push tokens on access_tokens + FCM/Expo dispatcher by @gloriafolaron in https://github.com/Leantime/leantime/pull/3457
• fix(comments): stop shadowing controller $comments array in Discussion template by @gloriafolaron in https://github.com/Leantime/leantime/pull/3459
• feat(core): native permission engine foundation (Phase 0) + console addCommand fix by @marcelfolaron in https://github.com/Leantime/leantime/pull/3461
• feat(permissions): enforce Tickets + Comments via the engine — full @api coverage by @marcelfolaron in https://github.com/Leantime/leantime/pull/3469
• feat(permissions): roll the engine across the Users domain (company-scope) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3471
• feat(permissions): roll the engine across the Clients domain (company-scope) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3472
• feat(permissions): roll the engine across the Setting domain (company + project scopes) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3473
• feat(permissions): roll the engine across the Sprints domain (first content domain) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3474
• feat(api): plugin gate attribute + capability discovery endpoint by @gloriafolaron in https://github.com/Leantime/leantime/pull/3460
• fix(tickets): ticket modal crashes on milestone type by @gloriafolaron in https://github.com/Leantime/leantime/pull/3468
• security(comments): scope comment authz to the host entity's real project by @marcelfolaron in https://github.com/Leantime/leantime/pull/3476
• security(ideas): gate Ideas domain on the native permission engine by @marcelfolaron in https://github.com/Leantime/leantime/pull/3478
• security(wiki+ideas): gate the Wiki and Ideas domains on the native permission engine by @marcelfolaron in https://github.com/Leantime/leantime/pull/3479
• security(blueprints): gate the consolidated canvas domain + close by-id IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3483
• security(goalcanvas): gate the Goals domain + close by-id IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3485
• security(canvas): gate the legacy Canvas-base controllers (Logicmodelcanvas) + Api\Canvas by @marcelfolaron in https://github.com/Leantime/leantime/pull/3486
• fix(helm): correct session expiration units in Helm chart (fixes #3378) by @dashitongzhi in https://github.com/Leantime/leantime/pull/3487
• fix(logicmodelcanvas): left-align status filter dropdown menu by @gloriafolaron in https://github.com/Leantime/leantime/pull/3484
• feat(stageflow): spotlight non-hovered stages on row hover by @gloriafolaron in https://github.com/Leantime/leantime/pull/3481
• feat(libs): npm-manage html2canvas + jsPDF by @gloriafolaron in https://github.com/Leantime/leantime/pull/3482
• security(timesheets): gate the Timesheets domain (own-time vs manage) + matrix edit by @marcelfolaron in https://github.com/Leantime/leantime/pull/3490
• security(files): gate the Files domain + close RPC IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3492
• chore(logicmodelcanvas): drop unused snapshot mount div by @gloriafolaron in https://github.com/Leantime/leantime/pull/3491
• security(reports): gate the Reports domain + de-expose system/telemetry RPC surface by @marcelfolaron in https://github.com/Leantime/leantime/pull/3501
• fix(deps): bump shell-quote 1.8.2 → 1.8.4 (clear critical advisory) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3502
• security(calendar): gate the Calendar domain + close cross-user IDORs by @marcelfolaron in https://github.com/Leantime/leantime/pull/3504
• security(projects): gate the Projects god-service (recursion-safe, manager+ management) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3505
• refactor(install): consolidate the 14 permission-engine migrations into one by @marcelfolaron in https://github.com/Leantime/leantime/pull/3506
• security(permissions): fail closed when a mandatory projectIdParam can't be resolved by @marcelfolaron in https://github.com/Leantime/leantime/pull/3507
• ci(release): one-dispatch release pipeline (version bump, AI changelog, PR gate, auto-publish) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3508
• security(permissions): validate projectIdParam is a real positive integer by @marcelfolaron in https://github.com/Leantime/leantime/pull/3509
• ci(release): swap changelog generation from GitHub Models to the Claude API by @marcelfolaron in https://github.com/Leantime/leantime/pull/3510
• Release v3.9.0 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3511
• ci(release): set up PHP before make package (fixes v3.9.0 release build) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3512
• fix(auth): establish user context for Sanctum Bearer API requests (3.9.0 regression) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3514
• test(api): Bearer-auth JSON-RPC contract suite + CI gate by @gloriafolaron in https://github.com/Leantime/leantime/pull/3513
• Release v3.9.1 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3515

New Contributors

• @Roark1138 made their first contribution in https://github.com/Leantime/leantime/pull/3423
• @duongynhi000005-oss made their first contribution in https://github.com/Leantime/leantime/pull/3405
• @dashitongzhi made their first contribution in https://github.com/Leantime/leantime/pull/3487

Full Changelog: https://github.com/Leantime/leantime/compare/v3.8.0...v3.9.1