JTrac 3.0.4

Security hardening release. JTrac 3.0.4 stops shipping source maps with the web UI, so browser developer tools no longer show the original frontend source. No database migrations; settings, secrets and data carry over unchanged.

Important

Not an official JTrac release: an independent reimagining, not affiliated with or endorsed by the original JTrac project or its authors.

Fixed

• No source maps in the web UI. Up to 3.0.2 the server served *.js.map files, so a browser's developer tools showed the original src/ tree and dependency sources. They contained no credentials or local paths, but there was no reason to publish them. Production builds now have none, and the release gate rejects any package whose web UI contains a .map file or a sourceMappingURL reference. Packages are about 1.2 MB smaller.

Download

Pick your platform, verify the checksum, unpack, and run setup.bat (Windows) or ./setup.sh (Linux, macOS).

Package	Platform	Status	SHA-256
jtrac-3.0.4-windows-x64.zip	Windows 10/11 x64	Smoke-tested natively (36/36 checks, Windows Server 2025)	720feb4f2306dce349f538418cd2e2091c13864612fb9e63af72d5a9b227d84c
jtrac-3.0.4-linux-x64.tar.gz	Linux x64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 x64)	b3bfdb2a18da267da928d1ea53b3eee4daee88190eb449e2e36afb033e74a37f
jtrac-3.0.4-linux-arm64.tar.gz	Linux ARM64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 ARM64)	00d7398185fb96ab51ed6a10bb47ac733ca571b643f2036a222cfa82b926104f
jtrac-3.0.4-macos-x64.tar.gz	macOS 13+ Intel	Smoke-tested natively (36/36 checks, macOS 15 Intel)	3340660ab26f14292e7bc7bc28e9f50a0149a985a64888d26ac3f4a330729989
jtrac-3.0.4-macos-arm64.tar.gz	macOS 13+ Apple Silicon	Smoke-tested natively (36/36 checks, macOS 15 Apple Silicon)	a4c5779fa808d0b05076ac7b20eb27689369e806aed882498fa9daae659e7cfc

All checksums are also in SHA256SUMS (sha256sum -c SHA256SUMS). Every archive here is the exact file built and installer-tested on its own OS by the release workflow; each test report is attached. Windows ARM64: no package (external PostgreSQL only; build from source).

macOS packages are not notarized: after unpacking run xattr -dr com.apple.quarantine jtrac-3.0.4-macos-*. Windows packages are not code-signed: verify the checksum, then confirm the SmartScreen prompt.

Upgrading from 3.0.0 or 3.0.2

Unpack 3.0.4 next to your current folder, then from the new folder run:

jtrac update --from <old folder>

It stops the old version, makes a verified backup, finds no pending migrations, moves the data directory pointer and starts 3.0.4. If you use automatic start, run jtrac service install from the new folder afterwards. See docs/upgrades.md.

Verified for this release

• CI green on the release commit: backend tests against PostgreSQL 18, frontend tests (64), typecheck and lint.
• All five packages built and installer smoke-tested (36/36) on their native OS, with the release gate (allowlist, denylist, secret and local-path scan, and now source maps) on every archive.
• Each published package's server jar was inspected: no .map files and no sourceMappingURL references. The new gate rule was tested both ways (rejects a build with source maps, passes one without).

Also includes the 3.0.2 fix: organization branding applies to the whole interface.

Full changelog: v3.0.2...v3.0.4

JTrac 3.0.2

Maintenance release. JTrac 3.0.2 fixes organization branding in the packaged server: the brand color now themes the whole interface, not only part of it. No database migrations; settings, secrets and data carry over unchanged.

Important

Not an official JTrac release: an independent reimagining, not affiliated with or endorsed by the original JTrac project or its authors.

Fixed

• Organization branding applies everywhere. The brand color was applied through an injected <style> element, which the server's Content-Security-Policy (style-src 'self') blocks, so navigation highlights, badges, tinted surfaces and borders kept the default orange. The theme is now derived in the stylesheet from one color set through the DOM, which the policy allows. The policy itself is unchanged.
• A color taken from an organization's uploaded logo now themes the whole interface too.
• The logo and favicon stay readable when the browser uses a dark color scheme.

Download

Pick your platform, verify the checksum, unpack, and run setup.bat (Windows) or ./setup.sh (Linux, macOS).

Package	Platform	Status	SHA-256
jtrac-3.0.2-windows-x64.zip	Windows 10/11 x64	Smoke-tested natively (36/36 checks, Windows Server 2025)	9912202bdec2bd0b17bfdc8cb04c76f2abadfc9a9401a5e1a2be607fd7c96a33
jtrac-3.0.2-linux-x64.tar.gz	Linux x64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 x64)	37a3fe29f6e87e4e4a4068d9168936fdee75b59f488b43d689127d2301ceb546
jtrac-3.0.2-linux-arm64.tar.gz	Linux ARM64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 ARM64)	3494e5a0496d208fc35afb359dabb6304dcc9c885e718c26c86d2a644326b753
jtrac-3.0.2-macos-x64.tar.gz	macOS 13+ Intel	Smoke-tested natively (36/36 checks, macOS 15 Intel)	c775c63a3abe1cf78729e415087a6553b88382282c18e4459c099d7fdbc0adc4
jtrac-3.0.2-macos-arm64.tar.gz	macOS 13+ Apple Silicon	Smoke-tested natively (36/36 checks, macOS 15 Apple Silicon)	87aa4ca3c90fad5ca32939259e3660e3204a1ef23eeb9b498fe1ddfe533d5005

All checksums are also in SHA256SUMS (sha256sum -c SHA256SUMS). Every archive here is the exact file built and installer-tested on its own OS by the release workflow; each test report is attached. Windows ARM64: no package (external PostgreSQL only; build from source).

macOS packages are not notarized: after unpacking run xattr -dr com.apple.quarantine jtrac-3.0.2-macos-*. Windows packages are not code-signed: verify the checksum, then confirm the SmartScreen prompt.

Upgrading from 3.0.0

Unpack 3.0.2 next to your 3.0.0 folder, then from the new folder run:

jtrac update --from <old 3.0.0 folder>

It stops the old version, makes a verified backup, finds no pending migrations, moves the data directory pointer and starts 3.0.2. If you use automatic start, run jtrac service install from the new folder afterwards. See docs/upgrades.md.

Verified for this release

• CI green on the release commit: backend tests against PostgreSQL 18, frontend tests (64), typecheck and lint.
• All five packages built and installer smoke-tested (36/36) on their native OS, with the release gate (allowlist, denylist, secret and local-path scan) on every archive.
• The packaged web UI was inspected for the fix (new theme rules present, old <style> injection gone), and the theming mechanism was verified in a browser under the production Content-Security-Policy.

Full changelog: v3.0.0...v3.0.2

JTrac 3.0.0

Your issue tracker, on your server, in five minutes. JTrac 3.0.0 is the first release of an unofficial reimagining of how JTrac could look in the modern era: the classic JTrac 2.3.3 was studied with REA MCP, and the idea was rebuilt on Java 25, Spring Boot 4, React 19 and PostgreSQL 18. Each package bundles its own Java runtime and (except Windows ARM64) PostgreSQL. No JDK, Node.js or database server needed.

Important

Not an official JTrac release: an independent reimagining, not affiliated with or endorsed by the original JTrac project or its authors.

Download

Pick your platform, verify the checksum, unpack, and run setup.bat (Windows) or ./setup.sh (Linux, macOS).

Package	Platform	Status	SHA-256
jtrac-3.0.0-windows-x64.zip	Windows 10/11 x64	Smoke-tested natively (36/36 checks, Windows Server 2025)	ad80a5719265e66309fc691fb6104a2a601840cf452b07444e2aaf27eb6a0cf4
jtrac-3.0.0-linux-x64.tar.gz	Linux x64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 x64)	8d33c507c4621b0c061cd1f1e5dea267b57a287fb299b15fc275c915506463aa
jtrac-3.0.0-linux-arm64.tar.gz	Linux ARM64, glibc 2.27+	Smoke-tested natively (36/36 checks, Ubuntu 24.04 ARM64)	2f7e947f09305acdb4757312e1d25edb4d40ba77df1abb0890b2abba8a9302f3
jtrac-3.0.0-macos-x64.tar.gz	macOS 13+ Intel	Smoke-tested natively (36/36 checks, macOS 15.7 Intel)	10586efb1c10e35385ea8bdb02dc6fa7c33f903f6b90ac31544106ae8098f9f4
jtrac-3.0.0-macos-arm64.tar.gz	macOS 13+ Apple Silicon	Smoke-tested natively (36/36 checks, macOS 15.7 Apple Silicon)	99def9a42afb5d2c47bb561515a56d219883b1705c65c4251ad060cb37fdcd69

All checksums are also in SHA256SUMS (sha256sum -c SHA256SUMS). Every archive here is the exact file built and installer-tested on its own OS by the release workflow; each test report is attached. Windows ARM64: no package in this release (external PostgreSQL only; build from source).

macOS packages are not notarized: after unpacking run xattr -dr com.apple.quarantine jtrac-3.0.0-macos-*. Windows packages are not code-signed: verify the checksum, then confirm the SmartScreen prompt.

What's in 3.0.0

• Track work: organizations, teams, invitations, projects, issues with KEY-42 identifiers, custom fields, sub-tasks, links, watchers, comments with @mentions, attachments, optimistic locking and full history.
• Make the process yours: a visual workflow editor, role-based transitions, and per-status field rules (hidden, read-only, optional, required) enforced on the server.
• See everything: boards, lists, timelines, saved views, global search, dashboards and real-time notifications.
• Integrate: a REST API with an OpenAPI 3 contract (140 operations), API tokens, HMAC-signed webhooks, and CSV import/export.
• Operate: a 13-stage setup wizard (interactive or unattended), SMTP with step-by-step test diagnostics, start/stop/status/logs, verified backups and restore, updates, autostart and uninstall that keeps your data.
• Respect people: Terms, Privacy and Grievance pages aligned with India's DPDP Act, recorded consent, a data download, WCAG 2.1 AA, and no telemetry.

Verified for this release

• Backend: unit, modularity, API-contract and integration tests against PostgreSQL 18 (green in CI). Frontend: 64 tests, typecheck and lint.
• Browser end-to-end tests (desktop and mobile, axe accessibility checks in light and dark) against an installed package.
• OSV scan of all 295 shipped Maven and npm components: no known vulnerabilities.
• A release gate on every archive (allowlist, denylist, secret and local-path scan).

Known limitations: see the README: unsigned packages, managed backups stop the server briefly, single-server deployments, and no Windows ARM64 package yet.

Ready? Download, run setup, and track your first issue today. Found a problem? Open an issue; security issues go privately.

Licensed under the Apache License 2.0.