LoginSign Up
← Back to all sparks
O

OpenProject

PM
Velocity5.0

Open source web-based project management software supporting classical, agile and hybrid project management approaches.

www.openproject.org ↗

OpenProject patches five release lines at once with undisclosed security fixes

project-managementopen-sourcesecurity-fixesbackportsself-hosting
◆Current state
On 9 November OpenProject shipped 17.9.7, 17.8.2, 17.7.3, 17.6.1 and 17.5.2 together. 17.9.7 carries 12 security fixes and the older lines four each; details will be published later, and the notes ask everyone to update immediately. Bug fixes ride along: a slow project overview members widget on 17.9, copied projects inheriting the original's sprints on 17.6. This follows two earlier 17.9 patches that fixed a PDF-export file read and a budget disclosure.
◆Where it's heading
Security work is now the main output of the 17.x branch, and OpenProject is backporting it to lines as old as 17.5 rather than telling self-hosters to jump to 17.9. Feature work since the 17.9.0 release in September has not shown up in this feed.
◆Prediction
Security advisories describing the 9 November fixes are the next likely publication, followed by a 17.10 or 18.0 feature release; until then, more 17.9 patches.

◆Recent moves

  1. 5d ago

    17.7.3 backports four security fixes

    A backport release for the 17.7 line carrying the same four undisclosed security fixes as the other older lines. Only relevant to installs still on 17.7.

    View source ↗
  2. 5d ago

    17.6.1 backports four security fixes and sprint bugs

    The 17.6 line gets the four security fixes plus repairs for copied projects inheriting the original's sprints and users not seeing their own groups. Part of the 9 November coordinated release.

    View source ↗
  3. 5d ago

    17.5.2 backports four security fixes

    Even the 17.5 line gets the security patch, plus one custom-actions fix. Backporting this far shows OpenProject accepts that many self-hosters lag several versions.

    View source ↗
  4. 5d ago

    17.9.7 fixes 12 security issues, details to follow

    The current line gets 12 security fixes, the largest batch in this window, with details held back until users can update. It also fixes a slow project overview caused by the members widget.

    View source ↗
  5. 5d ago

    17.8.2 backports four security fixes

    The 17.8 line receives the four security fixes shared by the older branches. No other listed changes.

    View source ↗
  6. 14d ago

    17.9.6 fixes unsaved workflow changes

    Two bug fixes: workflow changes not saving and activity controls missing. Routine 17.9 maintenance.

    View source ↗