v1.58.2

New:

• Dashboards. Every project has a Dashboard tab: progress, overdue, due today and this week, deadlines for the next 7 days, tasks that need attention, workload per person, breakdown by status and priority, the current sprint, and tasks completed per week for the last 12 weeks. The main screen has the same dashboard across all your projects, with a per-project table and completion pace. Click a column in "Deadlines" or "Completed per week" to see its tasks. The dashboard can be set as the default project view.

• Calendar. Month, Week, Hours and List views for a project. Drag a task to another day, stretch it over several days, or place it at a time of day and resize it in the Hours view. Click a day or select a range to create a task. Filter by assignee, tag and status, hide weekends; filters and the period are kept in the page address. The main screen has a calendar across all projects with a panel of undated tasks you can drag onto a day or a time. See the calendar docs.
  Thanks danieleblopez

• Automations. "When - then" rules inside a project: when a task is created, completed, reopened, moved to a column, added to a list, or gets a tag added or removed - complete it, reopen it, move it to a column or a list, or add a tag. A rule acts with the rights of the person who last saved it.

- File attachments. Attach files to tasks, stored on the server's local disk or in S3-compatible storage, with a per-file size limit and a per-organization quota. Attachments are off until storage is configured - see [environment variables](/docs/configuration/environment-variables).

• Import from Trello, Todoist, Jira Cloud and Jira Data Center. Lists, statuses, tasks, checklists, labels, members, comments and attached files become a new TaskView project. Available to organization owners and admins - see the import docs.

• Move a task to another project. Before you confirm, TaskView shows what moves with the task and which links to the old project are removed.
• Task context menu. Right-click a task in the list or on the kanban board to move or delete it without opening it.
• Keyboard shortcuts: C creates a task from anywhere, X completes or reopens the open task, ? shows the list. They work on any keyboard layout and can be turned off in settings. Desktop only.
• Theme builder. Ready-made themes, separate accent and neutral colors, your own themes for light and dark mode, and a personal theme per project.

• SCIM groups. Link identity-provider groups to projects, so people who join a group get project access with the role you choose - see the SCIM docs.
• Webhook events for files (file.uploaded, file.renamed, file.deleted, file.attached, file.detached) and task.moved.
• MCP: file tools (list, get a download link, attach, detach, rename, delete), start and end time of day in create_task and update_task, and a link to the task in the app when TASKVIEW_APP_URL is set.

Improvements:

• Tasks can have a start and end time, and a date range, set right in the date picker.
• Kanban columns can be reordered.
• A task with subtasks shows their count on its card.
• The task header stays at the top while you scroll a long note.
• A dependency added in the task panel appears on the open graph right away.
• A new task can be created right from the task's Dependencies section (#119).
• The task list remembers its sort order (#126).
• Option to show the task ID on cards and in the task view (#130).
• Recently used projects come first in the project list.
• Task changes made by other people appear without reloading the page (via WS).
• Webhooks can be delegated: two new project permissions, webhooks_can_view and webhooks_can_manage, let members other than the owner work with webhooks.
• LOG_LEVEL sets the minimum level written to the log files.
• SESSION_MAX_AGE_DAYS sets how long a sign-in session lasts (90 days by default).

Security:

• Self-service account deletion is off by default. A member of a company install can no longer delete their account together with the projects and organizations they own. Set ALLOW_ACCOUNT_DELETION=true to allow it, for example on a public instance. An account can never be deleted with an API token.
• Fixed a flaw in the refresh-token cookie and CORS origin checks that could let another site obtain a user's session.
• API tokens and OAuth apps restricted to some projects or permissions could still read certain data outside that scope (main screen data, collaborators, tags, roles, webhooks). They are now limited everywhere.
• Email sign-in codes stop working after 5 wrong attempts, can be requested at most once a minute, and at most LOGIN_CODE_HOURLY_LIMIT times per hour (5 by default).
• SSO metadata and discovery URLs may only target public addresses. On an instance whose identity provider lives on the same network, set SSO_ALLOW_PRIVATE_URLS=true.
• With SCIM provisioning on, only people the identity provider has provisioned (and existing members) can sign in through SSO.
• Docker images updated to a patched Node.js (#139).

Fixes:

• SAML: "Sync" of the IdP metadata URL always failed (#125).
• Deleting a list now takes you to all tasks instead of an empty page (#137).
• A task added from "Today" with tomorrow's deadline lands in "Upcoming", not in "Today".
• Assigning a person on the kanban board no longer sends the task to Backlog.
• A task whose deadline was removed now comes first in "Recently added".
• The date picker showed the wrong day and dropped the start date.

Upgrade notes:

• Run the database migration container.
• Everyone is signed out once after the upgrade and has to sign in again.
• To keep self-service account deletion, set ALLOW_ACCOUNT_DELETION=true.
• To enable attachments, set FILE_STORAGE_PROVIDER with that provider's variables and mount a volume for local storage.

Thanks:

• danieleblopez for the project calendar (#129, #133, #136).
• hectorteamsquad, sergioarojasm98 and mahfuz-rahman007 for the reports.