v5.3.0

v5.3.0 (2026-08-03)

Bug Fixes

• admin: Restrict group role assignment to application administrators (12f3d01)

• admin: Restrict remaining user management actions to application admins (2fc994e)

• admin: Restrict user and group CSV export to application admins (e15fabd)

• admin: Restrict user creation to application administrators (fe65f2a)

• admin: Restrict user deletion to application administrators (0f7e90a)

• admin: Restrict user editing to application administrators (0a34834)

• admin: Restrict user password changes to application administrators (eb54acb)

• admin: Validate user reservation colors (72fbeca)

• apache: Use Apache 2.4 authorization directives (5461ae4)

• auth: Limit and classify Microsoft OAuth callback logging (c95630c)

• auth: Preserve redirect target through Microsoft OAuth login (2911ee3)

• auth: Refactor microsoft-auth to make it testable (105a051)

• config: Correct suggested script URL ports (9b9fd8a)

• config: Warn all users when script.url is empty (97c43ad)

• dashboard: Handle schedule availability windows (dcf1f99)

• email: Render resource description/notes as rich text in confirmation email (191545f)

• iCalendar: Log error if private organizer email is not configured (bf7a42c)

• language: Fix missing French strings (507da30)

• language: Fix numerous French typos and formatting errors (2b38301)

• reservations: Pass start/end dates to Reservation.init() (eba0de8)

• reservations: Stop browser freeze from unbounded date-advance loop (4b079de)

Code Style

• Update schedule links and individualDates spacing (6ba60b1)

Continuous Integration

• Added manual triggers for some CI jobs. (88530f7)

• Stop running CI on push to develop/master for two CI checks (a124720)

• commitlint: Validate pull request commit messages (13098d0)

• composer: Validate optimized PSR autoloading (e076411)

Documentation

• Add administration guide ported from project wiki (4feb9e0)

• Correct documentation about some of the upload directories (add7ebf)

• Describe each background job in the installation guide (ca63799)

• Group the documentation table of contents by audience (e7adb1a)

• Replace dead GitHub wiki links with ReadTheDocs (496621d)

• admin: Backtick config section names and boolean values (3ccb7d6)

• admin: Fix grammar and typos in ADMINISTRATION.rst (ec52a1f)

• admin: Nest related sections under their parent heading (8c3294e)

• admin: Normalize quote style and config-key formatting (c59d4c7)

• admin: Replace en dashes with ASCII characters (755ed61)

• config: Document required script URL setting (bd3710c)

Features

• calendar: Migrate iCalendar export to sabre/vobject (9c8bf6b)

• clipboard: Add copy URL to clipboard functionality and toast notifications for ics and atom links (f2d0496)

• config: Warn when script.url is missing the required /Web suffix (a829297)

• demo: Add demo landing page with cold-start spinner (85288a0)

Refactoring

• autoload: Add initial PSR-4 support (125c9ea)

• config: Build suggested script URLs with URI library (57a6a85)

• reservations: Initialize reservation with rendered $StartDate and $EndDate (2c79e5f)

---

Detailed Changes: v5.2.0...v5.3.0

v5.2.0

v5.2.0 (2026-07-03)

Bug Fixes

• Allow custom plugin class names in plugin configuration (61e34d9)

• calendar: Apply resource event colors and fix create reservation button display (2ed1348)

• deps: Improve Dependabot rebase workflow reliability (85e9ba5)

• ics: Escape calendar text fields for RFC 5545 (6b26ed3)

• ics: Use reservation notes as description (b1ee07f)

• pages: Delegate RedirectResume in page decorators to fix TypeError (8766086)

• payments: Require php-intl extension for currency formatting (ccd9023)

• reservations: Prevent false success for no-op updates (e00354b)

• x-editable: Prevent invalid JSON in data-source for custom attributes (99ce7dd)

Continuous Integration

• deps: Add hourly workflow to rebase out-of-date Dependabot PRs (1c74e0a)

• deps: Remove the dependabot rebase workflow (d5341fb)

Documentation

• Add custom plugin development guide (3a9ef5e)

• config: Enhance privacy settings descriptions and comments for clarity (cdfc3fd)

Features

• Move custom logo & favicon to configurable upload directory (e715182)

• config: Add ConfigKey readonly class for typed config definitions (2b0c560)

• ics: Add global config switch to enable/disable ICS/Atom feeds (6be95ef)

Refactoring

• config: Add ConfigKey::fromArray() and accept it in registries (8c28d0d)

• config: Drop dead array branches from the typed boundary (b26019b)

• config: Emit typed ConfigKey from the read boundary (b6ff323)

• config: Support ConfigKey instances in AbstractConfigKeys (1273993)

• custom-attributes: Replace ID column with name and prefixed identifier (3520a03)

• ics: Extract shared subscription page base (a22c30b)

---

Detailed Changes: v5.1.0...v5.2.0

v5.1.0

v5.1.0 (2026-06-07)

Bug Fixes

• harden-email-templates: Reject path traversal in template name (cb9b7ad)

• harden-rich-text: Sanitize announcement and resource output (7ed2b9c)

• harden-rich-text: Sanitize announcement email rich text (cc30b15)

• harden-rich-text: Sanitize rich text in admin views (688e6aa)

• harden-url2link: Only linkify safe http(s) URLs and valid emails (fa75dba)

• reservations: Prevent attachment filename stored XSS (51a9ffc)

Build System

• composer: Add Symfony HTML sanitizer dependency (ee27dd0)

Documentation

• agents: Document rich text sanitization guidance (6d7b554)

• agents: Update guidance from recent project patterns (e48f2f5)

• security: Clarify trust boundary for admin-authored content (437e3c8)

Features

• security: Add rich text HTML sanitizer (c1a59b5)

• security: Add sanitize_rich_text Smarty modifier (b510537)

---

Detailed Changes: v5.0.3...v5.1.0

v5.0.3

v5.0.3 (2026-06-03)

Bug Fixes

• 404 on plus icon in condensed week schedule display (c02df1a)

• Changes to the date formats for the german translation (1486841)

• Grammar and spelling errors fixes for german localization (5a5d5a1)

• Updated and added german translation for E-Mail-Templates (cc9bcc6)

• auth: Block unsafe external redirect targets (813c232)

• DeprecatedPHP8.5: Transforming null values ​​to an empty string (d4e2d44)

• reservation.label: Avoid null replacement in attribute label formatting (6ff0ecc)

• reservations: Validate reservation owner on create (bd087cd)

• schedule: Centralize render completion and auto-scroll (2c58149)

• schedule: Improved accessibility in schedule labels (adcc7a9)

Code Style

• Add missing block data-bs-theme for cake_blue theme (65e50c9)

• Remove an accidental trailing Z in the last line (47acb61)

Documentation

• security: Clarify vulnerability reporting policy (4e2467b)

• security: Document administrator trust model (0c84051)

Refactoring

• reservation: UI improvements (6ce75dc)

---

Detailed Changes: v5.0.2...v5.0.3

v5.0.2

v5.0.2 (2026-05-04)

Bug Fixes

• theme: Enhance color contrast for better accessibility (5cf0301)

---

Detailed Changes: v5.0.1...v5.0.2

v5.0.1

v5.0.1 (2026-05-03)

Bug Fixes

• accessibility: Enhance UI elements with improved ARIA labels and visual hierarchy (da4f60e)

---

Detailed Changes: v5.0.0...v5.0.1

v5.0.0

v5.0.0 (2026-05-03)

Bug Fixes

• Improve 'Info' string for en_us (6773f92)

• config: Fix the default 'x-xss' value in config.dist.php (a3a9414)

• config: Update default config.dist.php (3e5b0aa)

• config: Use section-qualified env names for plugin config (54bcd2c)

• datatables: Add data-order attributes for date in various templates (b77a9d7)

• datepicker: Fix Flatpickr 1px calendar width on hidden date pickers (259bc36)

• ldap: Suppress net_ldap2 deprecations during connect (70e3b12)

• reservation-extensions: Update default list of allowed extensions (03731ea)

• resource-types: Load custom attribute values without entity join (f211492)

• schedule: Replace html2canvas with html2canvas-pro to support color-mix() (740bee0)

• security: Remove obsolete X-XSS-Protection header support (f594942)

• ui: Align schedule toolbar icons and update icon images (6ea3ff1)

Documentation

• Add AI attribution policy and fix target branch (ec377c4)

• Document maintenance mode (ae583d8)

• Update README images for new icons and reports page (59eaf32)

• config: Document language string overrides (678202e)

• lang-overrides: Add an example config file and update docs (3077dcd)

Features

• api: Add groupId filter to GET Resources endpoint (37273ad)

• api: Return 404 for non-existent scheduleId in GET Resources endpoint (ccb5d3d)

• config: Add .env.example generator from ConfigKeys metadata (3375f28)

• config: Add config.dist.php generator from ConfigKeys metadata (d4805e6)

• config: Add DeprecatedConfigKeys registry for removed config keys (909f7f0)

• DatePickerSetupControl: Improved resolution of the alternative format and documentation. (e9e6a3f)

• i18n: Add per-language string overrides (67a22b8)

• schedule: Improve default schedule notification and highlight current calendar (a3cc88c)

Refactoring

• api: Extract helper to parse comma-separated positive integer IDs (1e58e1d)

• availability: Simplify template using section config loop (82f14da)

• config: Extract ConfigKeysMeta into its own file (26c7219)

• config: Remove app version from ConfigKeys (1c1f63e)

• date-helper: Use dateHelper.formatDate for date formatting in reservation.js (4088480)

• FullCalendar: Update FullCalendar to v6.1 (661db3d)

• inlineAttributeEdit: Simplify inline DATETIME editing with native Flatpickr (14c3c95)

• ldap: Switch LDAP server config from host/port to uri (bd01c04)

• reservation: Build PDF config in PHP (5d74666)

• reservation: Migrate PDF generation to pdfmake (10a2db0)

• schedule: Use of color-mix, legacy cleanup, and visual improvements (ffebae5)

---

Detailed Changes: v4.3.0...v5.0.0

v4.3.0

v4.3.0 (2026-04-03)

Bug Fixes

• Allow special characters in passwords for user creation (a903be1)

• Correct check-in status display in resource details popup (ed3dcbc)

• Improve tooltip rendering and fix Smarty issues (3eb0179)

• Show the Custom Attribute label name when deleting (b1b06e5)

• Update the reservation email templates for various languages (667ddc3)

• Update the reservation email templates for various languages (e94ad11)

• admin: Prevent permission loss when DataTables paginates resources (cec8823)

• auth: Use per-user database language when no language cookie is set (b2437db)

• blackouts: Require repeat-until in recurrence UI (8840ec0)

• blackouts: Require termination date for recurring blackouts (4cda32d)

• calendar: Generate correct reservation detail URLs server-side for guest views (25e2391)

• calendar: Pass correct groupSeriesByResource boolean instead of privacyFilter object (5a7d9ee)

• config: Avoid empty buckets when rewriting legacy keys (e091b3f)

• config: Make config key lookup case-insensitive (822ccfe)

• config: Preserve existing config values when merging new keys from config.dist.php (e2006d1)

• config: Reject case-insensitive key collisions (eeea6f9)

• config: Restore legacy config key mappings (74db95a)

• config: Rewrite legacy section keys into canonical sections (64964cb)

• config: Treat empty-string section as unsectioned in GetKey (7241c59)

• database: Make 2.9+ upgrades idempotent and raise DB minimums (3f632d4)

• dataTable: Add default page size configuration and update DataTable length menu (a959247)

• email: Correctly render reservation attributes in created emails (0d2bce9)

• email: Honor secondary category in reservation email attributes (42c98d5)

• email: Populate resource custom attribute values when loading reservation from DB (5a9756e)

• email: Restore submitter language after sending approval notification emails (e33a6ab)

• en_gb: Show only time in popup (5999309)

• i18n: Add English fallback for 3 languages missing parent translation calls (e202d44)

• i18n: Add English fallback for 8 languages missing parent translation calls (4ee1ab8)

• i18n: Add missing embedded_datetime date format to en_gb locale (a4e45d6)

• i18n: Replace HTML entities with UTF-8 characters in Italian locale (a0c0f46)

• js: Add no-unused-vars rule, remove dead code, and fix bugs (f009211)

• lang/es.php: Spanish translations (1b91ad3)

• ldap: Install the 'pear/net_ldap2' library by default (f3d225e)

• ldap: Require 'ext-ldap' (e55e63a)

• registration: Resolve a server error when more than one attributes in the register page (71a3f73)

• reports: Prevent chart modal from hanging on render errors (e81f465)

• reservation: Correct guest reservation URI validation from calendar and schedule view (9aca6a1)

• reservation: Correct guest reservation URI validation from calendar and schedule view (1f9a739)

• reservation: Resolve a crash when the email field is not an array (618a2f4)

• resource-display: Update date input handling in resource display (fbee303)

• schedule: Avoid recursive buffer item ids (b139461)

• schedule: Correct tall view rendering for reservations with hidden blocked periods (7e80933)

• schedule: Use correct StartDate field in reservation sort (a83246c)

• spanish-translations: Update Spanish terms for consistency and clarity (698cbec)

• time: Make Time parsing/formatting DST-safe for time-only values (6bef7db)

• translation: Fix date formats for italian (44ceb2b)

• UI: Standardized the size of remaining form inputs and buttons to sm across the interface. (cab32b6)

• validators: Allow empty schedule filter params (9aca6a1)

• validators: Remove redundant EXISTS from combined route validators (9aca6a1)

• validators: Remove redundant EXISTS from combined route validators (47860f1)

• view-reservation: Correctly display the duration of the reservation (af1e2ce)

• webservice: Respect configured inactivity timeout per session (3da795d)

Build System

• assets: Vendor Hind font for local frontend usage (22b283a)

Chores

• Correct the location of jquery-migrate (6e828e8)

• Remove bootstrapValidator CSS includes (7079d8e)

• Remove unused wysihtml5 assets (ccaf27b)

• Upgrade jQuery UI assets to 1.14.2 ([4a0818e](https://github.com/LibreBooking/librebooking/...

v4.2.0

v4.2.0 (2026-03-03)

Bug Fixes

• Add composer.lock to the repository (febdc12)

• Add null-safety for PHP 8.1+ string function deprecations (b817269)

• Issue with GetHeader called with non-existing header (0f387cc)

• Null parameter error in debug mode (f1719d8)

• Pdf generation for on the reservation page (4d84247)

• When an unknown error happens use HTTP 500 (20521ac)

• admin: Correct bulk checkbox handling in blackouts and clean up user script (a1fa73d)

• admin: Fetch reservation deletion checkboxes when needed instead of from a cache (0224527)

• admin: Make delete button visible on all user table pages (e285c95)

• auth: Repair MoodleAdv config access and add regression coverage (109ac86)

• authentication: Preserve guest sessions during cookie login (a0b96e4)

• config: Time constraint 'same_day' config not working (772ad0e)

• db: Give a more helpful error if can't connect to database (48f5818)

• documentation: Start and end reminders can only be minutes, hours and days (e8105b0)

• documentation: Update reservation start time constraint documentation (0d15ca3)

• htaccess: Correct possible redirect loop (411e787)

• htaccess: Infinite redirect to base URL (e42cb4a)

• preflight: Resolve phpstan issue with PHP 8.5 (93fef16)

• shibboleth: Use correct config key names (937cfb2)

Chores

• Add some agents files (8933f86)

• Add the .github/copilot-instructions.md symbolic link (14541f9)

• Fix malformed test file (a707a92)

• Have 'php-cs-fixer' be composer installed (13e26c9)

• Remove dev dependency 'kint' as unused (c27d335)

• Run php-cs-fixer on the code base (1c7e576)

• Update flatpickr.min.js version 4.6.13 (06654c5)

• dependabot: Increase version in composer.json (94bfb2a)

• dependabot: Run updates each day for composer (aebf8d8)

• monolog: Change use of deprecated variables (0d0692e)

• phpstan: Add comments to phpstan.neon (b053d4c)

• phpstan: Enable level 2 on tests with phpstan-phpunit extension (b30b1ab)

• phpstan: Enable level 2 without a baseline (excluding tests) (051f21c)

• stripe: Handle non-existing invoice attribute (d54cb07)

• translations: Updates to French translation (e34fdda)

Code Style

• data-cleanup: Enhance admin interface with responsive card design (60c0e73)

Continuous Integration

• Remove duplicate 'setup-php' in GitHub CI (9540596)

• Run the phpstan and phpcsfixer job on push (0221450)

• Start testing with PHP 8.5 (bbdd167)

• dependabot: Initial setup of dependabot (537620c)

• php-cs-fixer: Enforce php-cs-fixer in CI (59e8b9b)

• phplint: Parallelize the phplint run (aa0739a)

• phpstan: Add an initial 'phpstan_next' check (55b9cb1)

• phpstan: Add caching to speed up the CI (daf5166)

• phpstan: If phpstan fails, run again with verbose/debug (bcb3fdc)

• phpstan: Use a matrix for phpstan jobs (c15bd82)

• refactor: Move phpunit to its own YAML file (cd5e596)

Documentation

• Create comprehensive copilot-instructions.md file (098b48f)

• Repository renamed to 'Librebooking/librebooking' (b8e7751)

• api: Add note to API web page about slash characters (032fea7)

• API: Add warning about trailing slash characters (d5bda61)

• changelog: Add the CHANGELOG to the documentation site (d083950)

• changelog: Update CHANGELOG.md to use PSR formatting style (84e8038)

• ci: Use 'doc8' to check ReStructuredText files (4efd995)

• config: Clarify prevent.participation setting description (93b2f02)

• config: Correct the app.debug help text (96d0ea6)

• cron: Add documentation on how to setup cron jobs (75d7539)

• logging: Correct LB_LOGGING_* names (88551cf)

• README: Update the demo site link to have the /Web/ path (e005a61)

• saml: Minor cleanup of SAML docs (3952a26)

• translation: Add missing Finnish lang strings (4468d76)

• translation: Add missing Finnish language email templates ([2b928db](2b928db...

v4.1.0

v4.1.0 (2026-02-05)

Bug Fixes

• Add command-line usage instructions for CombineDbFilesTask and UpgradeDbTask causing phpstan issue (bea840d)

• Add default value handling in ConfigurationFile::GetKey method (0f785cb)

• Add null check in EnsureNull method (1bda603)

• Api group update will create a new group rather than updating the group (b939389)

• Availability edit button disappears after editing schedule (f12d65f)

• Cannot access offset type on ShibbolethConfigKeys (a853e09)

• Changed wrong auth details response code to 401 (da4d633)

• Database migration for 4.0 (0b6c844)

• Display current reservation on tablet view and refine layout (#803, 570b889)

• Edited plugin config example to use nested layout (1b14b35)

• Error in keycloak/oauth url generation (eb548ff)

• Error in reservation.start.time.constraint (98b72b4)

• Exporter page broken after config validation (f7c6c3d)

• Flatpickr week start day ignored for Starts Today schedules (a46c31a)

• GetConfigGroup and ConfiKeys in API (12fc5dc)

• Ignore invalid configs in ManageConfiguration (711e01e)

• Include conditionally displaying title and description (#941, 46d3069)

• Informational log message changed to more appropriate level (DEBUG instead of ERROR) (dadca6b)

• Null error on unknown key (a8363f1)

• Reorder PSR12 rule (7c3473a)

• Show option key rather than values on config wrong choice (e35a030)

• Standardize log messages and improve error handling in configuration tests (0214c6d)

• Trumbowyg fails to load when use.local.js.libs is set to true (ccaba0b)

• Update environment variable keys and add resource options in config files (5cbd1a1)

• Update manual database setup documentation (9c175bf)

• Use BooleanConverter for TABLET_VIEW_ALLOW_RESERVATIONS (d941886)

• Use ConfigKey instead of hard-coded name (62a1e9b)

• Use default logging level of 'error' (0e850d3)

• Use lower-case log_level (44ca668)

• Wrong section for slack token (f407878)

• auth: Prevent auto-registration when self-registration is disabled (9f24a5a)

• auth: Updated plugin configuration keys into nested structures (1cfe196)

• AutocompleteUser: Handle potential null values (d90b7ab)

• chore: Resolve many html escape issues (c8a6396)

• config: Preserve unknown subkeys in original structure for validation and improve error logging for invalid config values (723f238)

• config: Update configurator to new plugin config (3fe962b)

• htaccess: Prevent redirect loop for /Web path without trailing slash (ad8bde2)

• image-upload: Use correct directory for uploading image (88cb94a)

• ldap: Rename debug configuration key for consistency (f8efae3)

• ldap: Update default search filter to be optional with improved description (7c17c7c)

• pdf: Enhance PDF generation error handling and improve table formatting (b165000)

• pdf: Handle default values for repeat options and reservation details in PDF generation (fda8a76)

• profile: Resolve loading the profile page when multiple attributes (e5e423f)

• profile: Resolve saving of unchecked checkbox in the profile (2672584)

• reservation: Resolve html rendering in announcement emails (1fad3be)

• reservation: Resolve weekly series checkbox status on load (d7a62b4)

• Resources: Improve string retrieval logic (7e27ac5)

• schedule: Correct date display and layout issues (d684695)

• templates: Replace regex check with empty check in Italian email templates (1e71f81)

• test: Update configuration key test (3444e6c)

• tests: Update symbolic link creation and improve PHPUnit error handling (ae628bc)

Chores

• Update phpstan-baseline.neon (200517a)

• git: Enforce LF line endings (85a929f)

• git: Normalize all line endings to LF (b211a9a)

• phpstan: Update for 2.1.25 release (86594c1)

• phpstan: Update phpstan-baseline.neon (79ac102)

• scripts: Remove jQuery Timepicker plugin files (1632653)

• templates: Remove unused Timepicker includes (9d25543)

Code Style

• Enhance PHP-CS-Fixer rules with Symfony standards (a42d5f8)

• Redesign API help page with Bootstrap and improved UI (3f13add)

• vscode: Add initial .vscode/settings.json (afae984)

Continuous Integration

• Mark the 'develop' branch as a release branch (02c4e20)

• Prevent merge-commits in a PR ([ebe5589](https://github.co...