Skip to content

2.0.0

Choose a tag to compare

View all tags
@horilla-opensource horilla-opensource released this 30 Aug 16:48
· 199 commits to 2.0 since this release
2.0.0
edf0a1d

First generally available 2.0 release, and the first Horilla HR release with an official Docker image.

Docker

Images are now published as horilla/horilla-hr for linux/amd64 and linux/arm64:

docker pull horilla/horilla-hr:2.0.0

This replaces horilla/horilla, which had not been rebuilt since January 2026 and had no working latest tag. The old name still receives the same images for a deprecation period, so existing pulls keep working, but new deployments should move to horilla/horilla-hr. The repository overview documents the required environment variables, volumes and a working Compose file.

Images are built and published by CI on every release tag. Nothing is pushed until the built image has been booted against a real PostgreSQL and served /health/ and /ready/, and the release fails on any CRITICAL vulnerability found by Trivy — so an image that builds but does not run cannot reach Docker Hub.

Security fixes

  • [FIX] SECURITY: patched Django SQL injection CVE-2025-64459. The dependency was pinned as Django==5.2, which resolves to 5.2.0 exactly and can never pick up a patch release, so the unpatched vulnerability would have shipped. Now pinned as Django~=5.2.17, which keeps future 5.2.x security fixes.
  • [FIX] BASE: fixed a request thread-local leak. ThreadLocalMiddleware never cleared the stored request, and worker threads are reused, so created_by and modified_by could be stamped with whoever last used that thread rather than the acting user — cross-user attribution on records in an HR system.

Also in this release

2.0 is a large release; the notes above cover what changed at the release boundary rather than the full 2.0 development history. Recent work on this branch includes a rebuilt standard-reports catalog with export hardening, helpdesk dashboard redirect and filter fixes, attendance dashboard count corrections, and a fix for a holiday-export test that failed on roughly 2% of calendar dates.

Upgrading

2.0.0 is now the default pull for both horilla/horilla-hr and horilla/horilla. If you pull the old name without a tag you will move from 1.4 to 2.0 — pin an exact version in production if that is not what you want.

First boot applies the full migration set before the web server binds, which takes a few minutes on an empty database. Back up your database and media volume before upgrading.

Assets 2
Loading