v1.0.15

Highlights

• #16 Backend internationalization — backend-generated text is now localized in German and English, completing the i18n effort the v1.0.13 frontend rollout began. API error messages, email subjects & bodies, and in-app notification titles & bodies are rendered in the recipient's language (per-user preference, English fallback) via Spring MessageSource. Delivered across three phases (foundation + full API-error sweep, then emails + notifications); three CI gates keep coverage from regressing.

Security

• jackson-databind 2.21.4 → 2.21.5 (#93) — fixes two @JsonView bypass advisories, GHSA-mhm7-754m-9p8w and GHSA-5gvw-p9qm-jgwh / CVE-2026-59889 (both medium), via a Spring Boot BOM jackson-bom override.

Maintenance

• Backend dependencies (#89), incl. postgresql 42.7.12 (CVE-2026-54291); grouped GitHub Actions bumps (#88).

Docker images: kwolfgang/taskowolf-backend:1.0.15 and kwolfgang/taskowolf-frontend:1.0.15.

v1.0.14

Dependency & base-image maintenance release — no functional changes. Batches the merged Dependabot updates.

• Frontend libraries (#81): TipTap 3.27.3, lucide-react 1.24.0, Recharts 3.9.2, Vite 8.1.4, plus axios/i18next/other minor & patch bumps. TypeScript is intentionally held at 6.x — the 7.0 native rewrite moves the compiler API to unstable entrypoints and breaks our i18n scanner + typecheck, so it is deferred to a dedicated migration (Dependabot now ignores the TypeScript major).
• Base-image security (#59, #82): frontend node build image and nginx:alpine runtime image bumped to current digests; the nginx digest picks up libexpat, c-ares and curl/libcurl CVE fixes.
• Backend (#60): commons-compress 1.26.0 → 1.28.0.
• CI actions (#62): harden-runner 2.20.0, setup-java 5.5.0, setup-node 7.0.0, codeql-action 4.37.0.

Docker images: kwolfgang/taskowolf-backend:1.0.14 and kwolfgang/taskowolf-frontend:1.0.14.

v1.0.13

#13 + #15 Internationalization — full rollout

The entire TaskWolf React frontend is now available in German and English.

Highlights

• Localized UI everywhere: every user-facing string runs through react-i18next. Switch languages via Settings → Profile; the choice persists per user (backend PATCH /me/language, migration V30) and in the browser, with English as the fallback.
• Locale-aware dates & times via Intl, including relative times ("2 hours ago" / "vor 2 Stunden") in comments and activity feeds.
• Complete, enforced coverage across all app areas (issues, board, backlog, sprints, dashboards & charts, reports, notifications, projects, settings, workflow, automation, admin, service desk, organizations). A dependency-free hardcoded-string scanner + en/de key-parity check runs as a CI gate; the string allowlist is now empty.
• Brand chrome (🐺 TaskWolf) and technical identifiers stay untranslated by design.

Backend-generated text (Spring MessageSource) is intentionally out of scope, tracked separately as backlog #16.

Docker images: kwolfgang/taskowolf-backend:1.0.13 and kwolfgang/taskowolf-frontend:1.0.13.

v1.0.12

#14 Organizations umbrella — permission inheritance

Organizations become an umbrella over projects with permission inheritance (backend #55, frontend #56).

Highlights

• Permission inheritance: a project can optionally be assigned to an organization. Org Owners/Admins then inherit project Admin and org Members inherit Viewer (read-only). Inheritance is additive — an explicit project role can only raise someone's effective role, never lower it. Projects without an organization are unchanged (no DB migration).
• Org self-service: Organization Owners/Admins manage their own org (member add via user search, per-row role editor, owner/self guards, read-only for plain members) — no longer System-Admin-only. "My Organizations" is visible to every user; System Admins additionally see all orgs and the create form.
• Project ↔ organization assignment: a new project Settings → Organization page (project admins) assigns or removes a project's organization. The project Members page shows a banner explaining inherited access.

Verified end-to-end against the backend (38/38 authorization + inheritance checks).

v1.0.11

Highlights

• #10 Collapsible sidebar groups (#54): each left-sidebar section (Admin, Account, Project, Settings) has its own chevron to collapse/expand just that group; per-group state persists in localStorage (default all open). Icon-rail mode unchanged.

Fixes

• B3 (#54): the sidebar nav scrolls internally so the Logout button stays reachable when the menu is taller than the viewport (no double scrollbar).
• B1 (#53): users can no longer change their own project role — a role change must come from another admin. Enforced server-side (403); the own-row role selector is disabled in the Members UI.

---

Docker images: kwolfgang/taskowolf-backend:1.0.11 and kwolfgang/taskowolf-frontend:1.0.11.

v1.0.10

Highlights

• #9 Project permissions (PR #52): per-project roles (Read-only / Read & Write / Admin), a project Members management UI (add/change-role/remove with user search), and read-only enforcement server- and client-side. Owner is protected as implicit admin. No DB migration.

Hardening & fixes

• H1 (PR #51): nginx serves index.html with Cache-Control: no-cache so deploys pick up fresh asset hashes without a manual hard-reload.
• H2 / H3 (PR #50): notification-prefs no longer leaks enum names on an unknown type (400); changePassword/register reject all-whitespace passwords.
• #12 (PR #49): Dependabot alerts cleared (logback-core 1.5.35, commons-compress 1.26.0).
• #11 (PR #48): sidebar pinned to viewport height so Logout stays reachable on long pages.