markrai/scrumboy

v3.22.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 7d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agile ai-integration collaboration docker go i18n

+9 more

kanban mcp mcp-server oidc project-management pwa scrum self-hosted sqlite

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 7d

MCP OAuth now exclusively routes through `/mcp/rpc`; all legacy `/mcp` endpoints have been removed.

Why it matters: If your application calls any legacy `/mcp` paths, they will fail after upgrading to v3.22.0; migrate endpoint usage immediately.

Summary

AI summary

MCP OAuth now uses /mcp/rpc as the sole protected resource, requiring migration steps.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	MCP OAuth now uses `/mcp/rpc` as the sole protected resource; legacy `/mcp` endpoints are removed. MCP OAuth now uses `/mcp/rpc` as the sole protected resource; legacy `/mcp` endpoints are removed. Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Medium	Adds optional SMTP outbound email for “Forgot password” self‑service reset when configured. Adds optional SMTP outbound email for “Forgot password” self‑service reset when configured. Source: llm_adapter@2026-07-19 Confidence: high	—
Feature	Medium	Adds explicit SSO account linking and host‑side owner recovery via `recover-owner` command. Adds explicit SSO account linking and host‑side owner recovery via `recover-owner` command. Source: llm_adapter@2026-07-19 Confidence: high	—

Full changelog

Highlights

MCP OAuth for native clients — Claude Code, Cursor, and similar Streamable HTTP clients use /mcp/rpc as the sole OAuth protected resource (discovered via RFC 9728 metadata). See the 3.22 upgrade notes below if you used MCP OAuth on 3.20/3.21.
SMTP + self-service password reset — optional outbound email for “Forgot password” when SMTP, encryption key, and public base URL are configured.
SSO account linking & owner recovery — explicit Connect SSO / Set Scrumboy password, plus host-side recover-owner when the IdP is unavailable.
Stability, security, and documentation updates across OAuth consent, TrustProxy, and OIDC issuer matching.

3.22 upgrade (MCP / Claude / Cursor)

If you connected an MCP client before 3.22:

Point the client at https://YOUR_HOST/mcp/rpc (not /mcp).
Clear stale OAuth credentials and authorize again (migration 057 invalidates old codes/tokens; DCR clients remain).
OAuth access tokens work only on /mcp/rpc, not legacy /mcp or Agora.

Details: CHANGELOG.md (3.22.0 → Breaking / upgrade impact) and FAQ.md.

Downloads

Windows

Download:

scrumboy-v3.22.0-windows-amd64.exe
scrumboy-v3.22.0-windows-amd64.exe.sha256

The executable is self-contained. Place it in a writable folder and run it. By default Scrumboy stores its SQLite database and runtime files under ./data.

Docker images remain available for users who prefer containerized deployments.

Breaking Changes

MCP OAuth protected resource changed from `/mcp` to `/mcp/rpc`; legacy endpoints no longer accept access tokens; migration step 057 invalidates old codes/tokens.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track markrai/scrumboy

Get notified when new releases ship.

About markrai/scrumboy

All releases →