ProjectForge 9.0.17

ProjectForge 9.0.17

Update of ProjectForge 9.0.0, what's new in ProjectForge 9: https://github.com/micromata/projectforge/releases/tag/9.0.0-RELEASE

Also includes the changes of 9.0.16, 9.0.15, 9.0.14, 9.0.13, 9.0.12, 9.0.11, 9.0.10, 9.0.9, 9.0.8, 9.0.7 and 9.0.6, released without downloads.

• Chat in the data transfer: every area is a chat room, direct messages from personal boxes
• Avatars in the chat and the user menu
• Chat: members list, quotes and search
• Project list: Excel export, customer shown in the project selection
• Unreachable mail server no longer slows down saving orders
• Chat: rooms, direct messages, files, threads, mentions and confidential messages
• Search ignores accents and umlaut spellings
• Project selection finds projects by number and customer
• Order and invoice caches no longer refresh each other endlessly
• Ad hoc bookings: grant or propose time sheet bookings without group membership
• Notifications: SMS delivery, creditor invoices due, variables with examples
• Time sheet form: recently used entries with consumption, sortable and filterable
• Customer wizard reuses existing structure elements
• Structure tree: lost and incomplete elements after a background reload fixed
• Password forgotten: reset mail limited against mail bombing
• Contribution margin per order and structure element, bubble chart
• Former React interface removed
• Security: CSRF check for every session, changing requests as POST only
• Fields with several entries: copy, paste and drag entries
• Import of incoming invoices: currencies and header-only exports corrected
• Banking migrated: bank accounts, transactions and their import
• Visitor book, memos, Merlin templates and job monitor migrated
• Project groups for project filters, forecast and exports
• Import of incoming invoices: many corrections, faster
• Old links are only forwarded where they were sent by mail or shared
• Security hardening: stricter access checks, Content Security Policy, second factor on more pages
• config.xml replaced by configuration parameters
• Polls reworked; contracts, currency pairs, skill matrix and 2FA setup migrated
• Order access for project managers per customer, customer group or business unit
• New user right Customers, to be granted by admins
• Forecast: current month and deleted orders corrected
• Customer wizard: customer, project, structure element and groups in one go
• Project contacts replace project manager, head of business and sales manager
• Data transfer: external access in the new interface, areas administered internally
• Properties editor, functions can be switched off
• Saving no longer empties the creation date
• Employees and cost search migrated
• German website
• Separate "Create" and "Save" in edit forms
• Availability: "Reachable if needed" only, public comment for the team
• Hotfix release
• Fix: saving an address campaign or an account no longer creates a copy
• Fix: orders and invoices whose positions are all deleted are refused
• Addresses and address campaign values in the new interface
• New availability entries with substitutes and a quick view
• Customers and projects independent of cost units, with number ranges
• Selection boxes without inactive entries, name matches first
• Fix: managers can approve vacations again
• Fix: team calendars on the gateway show only the user's own visible absences
• Users and team calendars in the new interface
• Team vacation calendar on the page, printable
• Hint and notification for time sheets without Kost2
• Fix: rights changed together with groups are stored correctly
• Fix: stricter access checks of vacations
• Leave applications and leave account in the new interface
• Lanes & Planes interface for employees and cost centers
• Data transfer files encrypted at rest
• Password change: brute force protection, other sessions ended
• Fix: contribution margin counts by booking period

Overview

• Chat in the data transfer: every data transfer area is a chat room for everybody with access to it (its admins moderate), files sent in the chat go into the area; external users see only the files. The personal box of another user opens the direct message with them. The buttons Chat and Direct message and the chat page show the unread messages.
• Chat: every conversation lists its members with their avatars; messages can quote another message; a search box narrows the direct messages and the rooms; the room page shows the formatted description of the room and is edited there.
• Avatars: users upload their own picture under My account, cut square in a new image editor (also used for the images of addresses); it is shown in the chat and in the user menu to all users sharing a group. Administrators can change or remove any avatar.
• Projects: Excel export of the project list; the project selection and the project filters show the customer of each project; the first proposed local project number can be set per number range.
• Notifications: the bell lists the archived entries of the last 90 days, so a notification confirmed by mistake can still be opened.
• Usability: group fields show the members of a group on hover, customer and project groups in list filters show what they comprise; deleted or deactivated users, groups and employees are struck through in more places; users are found by their nickname; a selected structure element is removed with its own (x); in a list with more than 100 entries a button selects the first 100 for a mass update.
• Fixed: with the mail server unreachable, saving an order waited once per recipient of its notification and every notification mail waited for the timeout; the gateway serves the subscriptions of team calendars and of the weeks of the year; the project wizard offered no cost 2 types after "Configure another element".
• Chat (menu Common → Chat): rooms with chosen users and groups, and direct messages to any user, readable by their participants only, administrators neither. Messages with formatting, files of any type (stored in the data transfer), emoji reactions, threads that can be followed and marked unread, and @ mentions notified in the app and by mail. Confidential messages in direct messages are end-to-end encrypted and never stored by the server. Behind a reverse proxy, the chat needs an unbuffered connection, see the administration guide.
• Search: search and selection boxes ignore accents and German umlaut spellings ("Mueller" finds "Müller", "Strasse" finds "Straße"), completely after the next nightly re-index; deactivated users are no longer found in the search of the main menu.
• Administration: the backup script of the administration guide compresses the dump of the files to about half the size.
• Fixed: the order and invoice caches refreshed each other endlessly when an invoice referred to a deleted order position; projects are found by their number and the name of their customer; outgoing invoices saved in the new interface are found by their customer at once; the time sheet filter for sub structure elements can be switched off; postal codes like "D-34286" are no longer linked as JIRA issues; the log of a running script is shown again.
• Ad hoc bookings: who may edit the time sheets of others on a structure element grants colleagues the booking of own time sheets for a period, optionally restricted to some cost units; the colleagues see only the granted structure elements. Employees without this right may propose such a booking, the project management accepts the time sheets afterwards (reminded by a new notification rule).
• Notifications: delivery steps by SMS; new rule "Creditor invoices due"; the rule editor lists the variables for subject and text with example values and a copy button, the preview shows the texts with example values.
• Creditor invoices: marked as overdue already 2 working days before the due date.
• Time sheet form: the recently used entries show the consumption of their budget and can be sorted, filtered and arranged per column (remembered per user); the consumption bar tooltip shows budget, booked and remaining person days.
• Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree or found by the same title.
• Order statistics: the bubble size of the contribution margin chart shows the contribution margin; titles can be switched on.
• Fixed: structure elements created or moved during a background reload could vanish from the structure tree, the responsible person was missing after a change; an invalid search syntax shows a hint instead of an empty list; the info of a structure element is only answered to users who may see it; the password reset mail is limited per user, per client and in total, so it can no longer be requested over and over.
• Contribution margin: the order statistics break it down by orders and structure elements (a tree with a monthly chart per row) and show a bubble chart of revenue, contribution margin % and costs per project, project group, customer or customer group, in the colors of the business units.
• Former React interface removed: all its pages are part of the new interface, old links (/react/...) lead there.
• Security: the CSRF token is checked for every changing request of a logged-in session; changing requests (filters, templates, search index, logout, cancelling a login) are accepted as POST only; history comments need update access; npm dependencies updated.
• Fields with several entries: entries can be selected, copied, cut, pasted and dragged into another field of the same kind; Ctrl/Cmd+Z undoes a change.
• Administration: structure tree and list show the groups with access rights on an element; the time sheet mass update remaps the cost unit by type, keeping the structure element.
• Polls: templates have the state "Template" and no deadline.
• Fixed: import of incoming invoices (currencies, periods, header-only exports); cancellation invoices listed with the positions they cancel; the order edit page no longer jumps; the mass update log shows the updated entries again.
• New interface: bank accounts, transactions and their import (a page of its own with a preview of the differences), visitor book (offers visitors already recorded, filter of incomplete visits), memos, Merlin Word® templates and the job monitor migrated; the Sipgate actions are a menu of the System page.
• Project groups: projects of a common parent project are combined into a group on the customer groups page; the project filters offer the group like a single project, forecast, contribution margin and the Excel exports show a project group column.
• Import of incoming invoices: no longer overwrites other invoices of the same creditor, keeps invoices with surplus positions, takes paid date and amount paid from the position import, reads German tax rates of DATEV files correctly and shows what changed in a modified row; the comparison and the preview of large files are much faster, and the page stays open after committing.
• Configuration: parameters with JSON values can be edited as text and compared with every former version.
• Old links: links to pages of the former interfaces are only forwarded if they were sent by mail or shared (orders, to-dos, vacation, data transfer, polls, password change); other bookmarks should be renewed. The 2FA dialog of the old interface is removed.
• Improved: list filters with a checklist offer "choose from all"; project wizard with tabs and a summary of what will be set up; mass updates link their log again; deactivated users struck through.
• Fixed: calls from an external phone via sipgate; project and cost unit numbers of number ranges without configured segments; structure element fields show a renamed or moved element right away; amounts with two decimal places and currency.
• Security: changing, deleting and restoring an entry is decided by the stored entry, not only by the posted one; stricter Content Security Policy and new security headers; requests that change something are sent as POST; more pages require the second factor of their area; QR codes are no longer delivered as image links.
• Customers: creating, changing and deleting customers needs the new user right "Customers" (finance); being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard also works with only one of the rights for customers and projects.
• Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including invoices, forecast and contribution margins.
• Configuration: config.xml is replaced by configuration parameters with their own editors (holidays, JIRA servers, contract types, accounting settings) and taken over automatically on the first start; projectforge.properties can be compared with its backups.
• New interface: polls (reworked, with templates and a results tab), contracts, currency pairs, skill matrix, inbox and outbox, two-factor setup, customizing the menu, e-invoice checker and birthday butler migrated.
• Removed: the d.velop interface.
• Fixed: the forecast of the current month adds the invoiced figures and the remaining forecast, the plan is the order book of the planning date (deleted orders corrected); sorting customers by number; a damaged JCR repository no longer prevents the start when files are stored in the database.
• Customer wizard: sets up customer, project with cost 2 types, structure element and groups with access rights in one step, with a preview; group names follow a configurable naming convention.
• Projects: a contact person and any number of further ones, as in orders, replace the project manager, the head of business manager and the sales manager (migrated).
• Data transfer: the external access of an area has moved to the new interface; areas with external access are administered on the internal instance and synced to the gateway.
• Administration: editor for projectforge.properties with descriptions, defaults and a backup before every save; functions can be switched off by configuration (menu entries gone, pages and REST services 404).
• Vacation: leave account entries migrated to the new interface; vacation and absence entries can be edited as the other kind.
• DATEV import: one upload fills both accounting records and chart of accounts.
• Fixed: saving a changed entry in the new interface no longer empties its creation date (lost dates restored from the history); menu visibility with a list of several groups works.
• Employees: list and form in the new interface; status, weekly hours and leave days edited in dialogs.
• Cost search: in the new interface, also as a movable panel on every page (Alt+K) or a small window of its own.
• Edit forms: "Create" for a new entry, "Save" for an existing one; saving never creates a copy.
• Availability: "Reachable if urgent" merged into "Reachable if needed"; the public comment, shown in red in the form, is visible to the team, also in the tooltips of the absence charts.
• Website: German version of the pages, FAQ, changelog and guides at projectforge.org/de.
• Invoices: an invoice with deleted positions only can be deleted and restored again.
• Address campaigns and accounts: saving an existing entry in the new interface no longer adds a copy of it (e.g. setting a campaign inactive); campaign titles are unique.
• Orders and invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.
• Further fixes: search term of multiple choice selection boxes, column headings of the availability entries in the leave account, build date in the footer.
• Addresses: list, view and form migrated to the new interface, with vCard import, takeover from pasted text, exports, mass update and the favorite star in the list; the address books are migrated as well.
• Address campaign values: migrated to the new interface, with a comparison campaign (e.g. last year's) whose values can be adopted in the mass update or the form; campaigns can be set inactive.
• Availability: new entries for periods of reduced availability (e.g. parental leave, workation) with substitutes and conflicts, shown in the calendar, team calendars, the team vacation calendar and a quick view of the next weeks.
• Vacations of others: visible to the members of the person's groups from 1 January of the current year; the team vacation calendar picks users, freelancers included.
• Customers and projects: system-wide unique project numbers, usable without cost units, configurable number ranges with the next free number offered.
• Selection boxes and lists: inactive entries only on request, name matches first and found by parts of the name, long lists ask for a search term; inactive entries struck through thin and grey in lists.
• Further: notification rules end their pending notifications when deactivated and choose the target of "Open", script editor compares versions, exchange rate API tested on the system dashboard, new test data for the setup.
• Fixes: approval of vacations by managers, absences in team calendars on the gateway, banners of manual notification rules, consumption bar of the time sheet form, events converted into time sheets, outdated list requests.
• Users: list and form migrated to the new interface, with rights adapting to the assigned groups at once, tokens renewed and devices logged out from the form and passwords changed in a dialog; alternative e-mail addresses of other users are rejected.
• Team calendars: list and form migrated to the new interface, with the subscription link in the form and the subscriptions of time sheets, weeks of year and holidays in the export menu.
• Team vacation calendar: the vacations of the chosen employees and groups shown per quarter or year with adjustable day width, printable in page width, choices saved as favorites; users without HR or finance rights choose from their own groups only.
• Vacations: days bar in the vacation account, long vacations squeezed into the bar; the vacation list of users without HR or finance rights shows only the vacations relevant to them.
• Time sheets without Kost2: optional hint on saving and a daily notification rule, switched on by a new configuration parameter; the configuration list can be filtered by category.
• System dashboard: muted, ignored and resolved problems can be listed from the counts of key figures and subsystem tiles.
• Fixes: rights changed together with groups, stricter access checks, carry-over and mails of vacations, Excel export and automatic booking of vacations, contribution margin for contacts of orders, width of the calendar edit dialog.
• Leave applications: list and form migrated to the new interface, with bars over the calendar days showing the days without any substitute, a year filter paging back and forth and the days left updated while editing.
• Leave account: migrated to the new interface, with the next year in the statistics and leave applications without any substitute marked red.
• Lanes & Planes: the active employees are pushed with their cost centers, cost units and creditor account, safeguarded against suspiciously small user lists and email changes; employees have a new field creditor account.
• Users: new fields alternative and former e-mail addresses, searchable and in the Excel export.
• Data transfer: files in the file system are compressed and can be encrypted at rest (AES-256).
• Passwords: change password and change WLAN password in the new interface; a wrong old password counts as failed login attempt, and a password change ends the user's other sessions.
• System administration: system statistics load at once, copy & paste samples for the alert message; the Docker image is based on Java 21.
• Fixes: contribution margin by booking period, year filter of leave applications and contracts, lists returning with an outdated filter, sorting of the vacation list, rejected leave applications in the vacation export, cost unit cache refresh in the time sheet form, phone lookup key and CSRF check of force delete.

All changes

Added

• Addresses: a small image editor cuts a square out of a chosen image, or the one already shown, before it is uploaded (drag and zoom).
• Chat in the data transfer
  • Every data transfer area is a chat room for everybody with access to it (its admins moderate): the button Chat on the area opens it, files sent in the chat go into the area. External users don't see the chat, only the files with their descriptions; the chat of an area with external access says so. Hiding a message doesn't hide its file in the area, deleting the message deletes it.
  • The personal box of another user has the button Direct message, which opens the direct message with them; the files go into their personal box.
  • The chat page lists the chats of the data transfer areas with messages, with unread counts.
  • The buttons Chat and Direct message show the number of unread messages. In a chat, a badge at the top right shows the unread messages not seen yet; a click jumps to the next one, also into a thread.
• Chat: every conversation, also of a data transfer area, lists its members with their avatars (icon at the top right).
• Number ranges: the first proposed local project number can be set per range in the accounting configuration, e.g. 5.###.01 instead of 5.###.00; lower numbers can still be entered.
• Group fields (e.g. the access lists of calendars, address books and polls): hovering a group shows its members, for whoever may see the group.
• Project list: Excel export of the filtered projects with all their fields.
• Avatars: users upload their own picture under My account (cut square in the image editor); it is shown in the chat and in the user menu to all users sharing at least one group. Administrators can change or remove the avatar of any user. A click on the own avatar in the user menu opens it under My account.
• Chat: confidential messages in direct messages (e.g. for a password), end-to-end encrypted in both browsers, relayed live and never stored by the server, shown to the recipient only once.
• Chat
  • Chat rooms (menu Common → Chat): anybody creates a room and chooses its participants, users and groups; members who join a group later take part at once. The creator and the moderators edit and delete the room. Rooms are visible to their participants only, administrators included.
  • Direct messages: anybody can write privately to any user shown in the user selection, from the chat page, from a user found in the menu search (start chat / send file; for everybody, with the users of the user selection) or by clicking an author in any conversation; whoever got a message can answer. Only the two read the conversation, administrators neither.
  • Messages with formatting (text colours, lists, links, inline code and code blocks of several lines), files of any type (paste, drag & drop or file dialog; images as thumbnails), emoji reactions and replies as threads of their own, which can be followed. The files are stored in the data transfer: in an area per room, whose participants see it in the data transfer and where the files are kept as long as chosen in the room; files of direct messages go into the personal box of the recipient. Without the data transfer plugin, no files are exchanged. Own messages can be edited and deleted, moderators hide messages with a reason and see the history of a message.
  • Typing @ suggests the participants of the room; a mentioned person is notified at once, in the app and by mail. New messages are notified once per room until read, by mail only if not seen in the app within an hour; rooms can be muted.
  • New messages appear without reload (server-sent events, with polling as fallback). Behind a reverse proxy, the chat needs an unbuffered connection, see the administration guide.
• Chat: a file of a message can also be opened in its data transfer area, besides downloading it.
• Chat: a message can be marked unread, threads with unread replies are marked, and in a thread a line shows the first unread reply.
• Ad hoc bookings
  • Who may edit the time sheets of others on a structure element (e.g. project management, finance) may grant colleagues the booking of own time sheets for a period, without group membership: several colleagues at once, on the structure element and any of its sub elements, each optionally restricted to some of its cost units. The grant is active right away, each colleague gets a mail with the links to book on.
  • The colleagues see only the granted structure elements and the titles of their ancestors in the structure tree: no other structure elements, consumption, time sheets of others or statistics. After the period or a revocation the own time sheets stay readable.
  • In the structure tree, a badge marks the structure elements with ad hoc bookings; its tooltip names the colleagues and their periods. Shown only to who may grant on the structure element.
  • Employees without this right may propose such a booking on the structure elements they book on themselves, for 31 days at most: the colleague books right away, the project management accepts the time sheets afterwards, unchanged or moved to another structure element or cost unit (time sheet form or mass update; list filter "Only to be accepted"). Until then they count like any other time sheet. The project management may confirm a proposal, so later bookings don't have to be accepted anymore.
  • New notification rule "Time sheets to be accepted": reminds the project managers of the time sheets still to be accepted (in the app, and by mail if not acknowledged, as configured in the rule). The structure tree shows their number next to the badge.
• Consumption bar (structure tree, task list, time sheet form): the tooltip shows the budget, the booked and the remaining person days as a calculation, an overbooked budget in red.
• Time sheet form: the recently used entries show the consumption of their budget, and the search also matches it.
• Creditor invoices
  • Marked as overdue (red) already 2 working days before the due date, so they are paid in time.
  • New notification rule "Creditor invoices due": reports unpaid creditor invoices due within a configurable number of working days (overdue ones of the last 90 days included) to the recipients of the rule.
• Notifications
  • The rule editor lists the variables available for subject and text (general ones and those of the rule type), each with a button to copy it.
  • The variables come with an example value each, so it is visible how e.g. a list of invoices looks; the preview also shows the texts with example values.
• Time sheet form: the table of recently used entries can be sorted and filtered per column, its columns can be reordered, resized, pinned and hidden; the layout is remembered per user.
• Notifications: delivery steps by SMS to the mobile phone number of the recipients (if SMS is configured), with an own SMS text of the rule or otherwise the subject and the link.
• Order statistics, contribution margin: bubble chart of revenue, contribution margin % and costs (size) per project, project group, customer or customer group. On request, the other projects of the selection (e.g. of the whole business unit) are shown for comparison, anonymously. The bubbles take the colors of the business units, set with the business units (customer groups page). A switch labels all bubbles with their short title instead (the group name, for a single project its short name).
• Fields with several entries (users, groups, employees, …): entries can be selected by sweeping over them with the mouse or by clicking, then copied (Ctrl/Cmd+C) or cut (Ctrl/Cmd+X) and pasted into another field of the same kind with Ctrl/Cmd+V, or dragged there. Ctrl/Cmd+Z undoes a change of the field.
• Structure tree and structure element list: column with the groups having access rights on an element (administrators only). Hovering shows the rights of each group, a click opens the access rights of this element.
• Time sheet mass update: remap the cost unit by type while every time sheet keeps its structure element, e.g. after a project was linked to it.
• Order statistics: the contribution margin broken down by orders and by structure elements, as a tree with a monthly chart per row. The values are calculated from the invoice positions and the time sheets × hourly rate; what can't be assigned stays with the project as residual.
• Configuration parameters with JSON values
  • Switch between the form and the JSON text, which can be edited directly as well.
  • Compare versions: the stored, the edited and every former value from the history, line by line.
  • Customer groups and business units: compare versions as well (the stored format, with ids).
  • JSON values are stored compact; values of up to 100,000 characters no longer make the save fail at the history.
• Project groups: projects belonging together under a common parent project can be combined into a group on the customer groups page. The project filters of the order book, invoices, projects, cost 2, timesheets and order statistics offer the group like a single project; forecast, contribution margin and the Excel exports of the forecast, order book and invoice list show a project group column as soon as one of their projects belongs to a group.
• Visitor book: while a new visitor is entered, the name offers the visitors already recorded with it; picking one adds the visit to that visitor instead of creating a duplicate. The company names in use are completed, and the dialog of the first visit opens right after a new visitor is saved.
• Visitor book: a pinned filter shows the visitors with incomplete times of visit, e.g. a departure not entered yet. After a visit is saved, the list is shown again.
• Order access: finance and controlling grant project managers and project assistants read access to all orders of a customer, a customer group or a business unit, including their invoices, forecast and contribution margins (new tab in the customer groups editor).
• System page: projectforge.properties can be compared with its backups, or two backups with each other. Optionally the order is ignored, so only changed values and comments are shown; values of secrets stay hidden, only whether they changed is shown.
• Switching off functions
  • Functions can be switched off in the configuration (projectforge.features.enabled and .disabled, one per menu entry): their menu entries are gone, their pages and REST services answer with 404.
  • The REST services of plugins that aren't activated are no longer reachable.
  • The gateway offers only the data transfer: the entries of the user menu that led nowhere there (feedback, my account, menu, 2FA, personal box) are gone.
  • The menu visibility of the entry for customizing the menu is configured by projectforge.menu.visibility.myMenu (it followed myAccount).
• Groups: a configurable naming convention (configuration parameter "Group nomenclature": description, pattern of customer and project fields, suffixes per role, letter case). The project and structure wizards suggest the names of new groups following it, and its description is shown at the name of a group and in the wizards.
• Customer wizard: sets up a project in one go – the customer (an existing one or a new one), the project with its cost 2 types, its structure element below a chosen one, and the groups of team, managers and externals (existing ones or new ones with their members) with their access rights, shown in a preview before anything is saved. Available to users who may create customers, projects and structure elements, who may create groups and access rights through the wizard as an exception. Offered on the customer list, the project list, the structure tree and the task list.
• Vacation and availability: an entry can be edited as the other kind ("Edit as absence" / "Edit as vacation"), like time sheets and calendar events (now "Edit as event" / "Edit as time sheet", formerly "Switch to …"). Person, period, comment and substitutes are taken over into a new entry, created only when it is saved; an entry already saved stays as it is. The button's tooltip says so.
• Administration -> System: editor for projectforge.properties. All parameters grouped by topic with descriptions and defaults, search, secrets masked. Before every save a copy of the file with a timestamp is written; changes take effect after a restart.
• Website: German version of the pages, the FAQ, the changelog and the user, administration and quick start guides at projectforge.org/de, with a language switch; the help link of the search field opens the German user guide for German users.
• Availability
  • New entries for periods of reduced availability (e.g. parental leave, workation) of any user, freelancers included, with type, reachability, location, a comment for the team and an internal comment only visible to the person concerned and HR staff. Overlapping entries of the same person are rejected. Visible to the members of the person's groups from today on only (a running entry without its begin, which might tell the duration of e.g. a sickness), in full to HR staff and the substitutes; the type only to the person concerned and HR staff. Linked with the vacation list; the leave account lists the person's entries of its three years apart from the vacations, with a button to add one.
  • Substitutes of a vacation: a substitute who isn't available counts as absent, as on vacation, and makes a conflict; other entries (e.g. remotely reachable) are shown on the vacation form but make no conflict.
  • Optional substitutes of an availability entry (any user, freelancers included): if all of them are away on a day of it (on vacation or not available), the entry is a conflict – shown in its form with the substitutes' absences, red in the list with a conflicts filter, and counted at the menu entry.
  • Calendar: one shared view of absences – the chosen groups and persons show their vacations and availability entries, with a choice of what to show (vacations, not available, remotely reachable etc.), only of persons sharing at least one group with the viewer (HR staff: of everybody). The type of an entry is shown only to the person concerned and HR staff, the status to everybody else.
  • Team calendars including leave days and their subscriptions (ICS) also show the availability entries, in the subscription always by their status only. Each team calendar chooses which absences it includes (vacations, not available, remotely reachable etc.; all by default), in the calendar view and in its subscription alike.
  • Team vacation calendar: with the same choice of absences (vacations and the availability entries by their status) for the chosen employees, on screen and in the Excel export; not available ones as absences, their comments only for those who may see the entries themselves.
• System dashboard: the exchange rate API is tested daily and shown as an interface tile, so that a change of the API is noticed early. The test can be started at once in the scheduler tab.
• Address campaign values: a comparison campaign (e.g. last year's) shows its values and comments beside the selected campaign's, with filters on its values and on the differences. Its values can be adopted for a selection in the mass update or one by one in the form. Address campaigns can be set inactive: their values can't be changed any more.
• Availability at a glance
  • A quick view in the calendar, the vacation account and the vacation and availability lists shows whether colleagues are available: pick one or more persons and see their vacations and availability entries of the next 4, 8 or 12 weeks as bars, one row each, weekends and holidays shaded. Only colleagues of the own groups can be picked, everybody for HR and finance staff. A link leads on to the team vacation calendar for groups and longer periods.
• Script editing: a "Show changes" button in the code editor's toolbar compares two versions of the code side by side (inline on small screens): the code being edited, the stored version or any of the script's backups.
• Time sheets without Kost2
  • A time sheet saved without Kost2 (none assigned to the structure element yet) shows a hint: it is missing in the salary export, the project management or accounting has to assign a Kost2.
  • Notifications: new rule type for time sheets without Kost2 in the last months. Run daily, a notification marked as done comes back the next day and disappears by itself, once all of these time sheets have a Kost2.
  • New configuration parameter "Report time sheets without Kost2?" (default off, only shown with cost-unit accounting enabled): the hint on saving and the notification rule apply only if it is enabled. Booking without Kost2 stays possible.
  • Configuration: the list can be filtered by category (pills such as Finance or Time sheets).
• Employees: new field creditor account (the DATEV account of the employee, e.g. for travel expenses), also shown as a column in the list and in the Excel export.
• Lanes & Planes interface
  • The active employees are pushed with the general Kost1 as cost centers, the general Kost2 and the Kost2 they may book on (restricted by patterns like 5..02) as cost units, their Kost1 as reference cost center, their creditor account and their nickname as abbreviation. Numbers are sent without dots (as the DATEV export of Lanes & Planes requires). Finance maintains these settings in the configuration parameter "Lanes & Planes"; activation and API key are set in projectforge.lanesandplanes..
  • Additional users who aren't employees (e.g. an external accountant) can be entered in the configuration parameter. They are sent with name and email only, so they aren't deactivated and their role and managers are kept. The service admin and guest profiles of Lanes & Planes can't be entered: the import doesn't touch them.
  • Cost centers and cost units already existing in Lanes & Planes can be entered with their names in the configuration parameter (pasted from the user export). They are sent under that name, so Lanes & Planes reuses them instead of rejecting them as duplicates.
  • A changed email of an employee is held back (the old one is still sent, with a hint on the problem dashboard) until it was changed in Lanes & Planes and confirmed in the configuration parameter. Otherwise Lanes & Planes would deactivate the user and create a new one.
  • A suspiciously small user list isn't pushed (Lanes & Planes deactivates every user not sent): it's checked against a minimum number of users and against the last push, also after a restart of ProjectForge. A missing push state is reported on the problem dashboard.
• Data transfer: files stored in the file system are compressed and can be encrypted at rest (AES-256, key in projectforge.files.fileSystemEncryptionKey), so backups of the file system don't contain them in plain text.
• Users: new fields alternative and former e-mail addresses (comma separated, e.g. after a change of name), also searchable and in the Excel export.

Improved

• Chat
  • The room page shows the description of the room, now formatted text; the creator and the moderators edit the room from there.
  • A search box on the chat page narrows the direct messages and the rooms.
  • Messages can quote another message of the conversation: the quote shows its author and the beginning of its text, a click shows the message.
  • Menu search: the menu entries found come first again, the users found to chat with follow them.
• List filters: customer and project groups show the customers and projects they comprise as tooltip.
• Deleted or deactivated users, groups and employees are now struck through in more places: lists with several names (group members, access lists, contact persons, substitutes), the task tree, chat, history, attachments, the vacation account, booking grants, the HR view, absence charts and the notification log.
• Mass update
  • In the selection mode of a list with more than 100 entries, a button selects the first 100 of them, the most a mass update changes at once.
• Notifications: the bell has a button "Archived entries" listing the confirmed or finished notifications of the last 90 days, so a notification confirmed by mistake can still be read and opened.
• Project selection of the edit pages and project filter of the lists and statistics: each project shows its customer in brackets.
• Structure element selection: a selected structure element is removed with its own (x) (not for mandatory fields), the home icon opens the tree.
• User selection: users are also found by their nickname.
• Search and selection boxes ignore accents and German umlaut spellings: "Andre" finds "André", "Mueller" and "Muller" find "Müller", "Strasse" finds "Straße", and vice versa. Applies to entries indexed after the update, i.e. completely after the next nightly re-index.
• Admin guide: the backup script compresses the dump of the files (about half the size), because pg_dump writes their contents hex encoded.
• Customer wizard: existing structure elements of the customer and the project can be used instead of new ones, picked from the tree (the title may differ, e.g. "ACME" for "ACME Inc.") or found automatically by the same title.
• Polls
  • Templates have no deadline: none is required, and none is set when saving.
  • Templates have the state "Template" instead of "Running", are listed without a filter and marked with a badge; the state filter replaces the "Templates" filter.
• List filters with a checklist (customer, project, business unit): they say that they only narrow the current result, are narrowed by the list's search term as well, and offer "choose from all" to pick values the current result doesn't contain. In the time sheet list they offer values without a period, too.
• Sipgate: downloading the configuration, synchronizing and resetting the contacts are now a menu of the System page (shown if Sipgate is configured); the separate Sipgate page and its menu entry are gone. While an action of the System page runs, a progress bar shows; the contact sync no longer reloads all synchronized addresses.
• Structure element fields: a click on the selected structure element opens the tree, like the pencil button. Order positions show the consumption bar of their structure element, which leads to its time sheets.
• User list: deactivated users are shown struck through.
• Mass updates of time sheets, invoices, incoming invoices, projects, addresses, access rights and liquidity entries link their log again: the log viewer shows what the run changed.
• Customize my menu: migrated to the new interface. Entries are dragged or clicked into the own menu, groups can be added, renamed and removed; empty groups are no longer stored as broken entries.
• When arranging chart dashboards, the drag handle (top left of a tile) and the tile menu (top right) are shown in solid orange.
• E-invoice checker: migrated to the new interface. Validity, invoice data, seller, buyer and amounts are shown side by side, amounts in the invoice's currency; embedded attachments are downloaded with a click.
• Notifications to be confirmed: several of them are shown underneath each other in one toast instead of stacked behind each other, and the toast steps aside while the bell's list is open.
• Birthday butler: migrated to the new interface. The current month is preselected, and without a configured organization the page says so instead of offering a download that can only fail.
• Availability entries: the location of a new entry is no longer preset to remote, and an empty type or location is shown as "Not specified". New type "Mobile Tätigkeit" (mobile activity) for working remotely without a workation; installations with their own list of types (projectforge.availability.types) add it there.
• DATEV import: one upload of the tax office's file fills both tabs, accounting records and chart of accounts, so each can be reconciled without uploading the file again.
• Availability: "Reachable if urgent" is merged into "Reachable if needed". The comment of an entry is called "Public comment" and is shown in red in the form; every team member who sees the entry sees it, also in the tooltips of the absence charts (e.g. the chart of a vacation's substitutes).
• Cost search: migrated to the new interface. Its menu entry shows it as a movable panel over the current page, which stays open on every page (also via the button in the top bar or Alt+K; the position is remembered). It can also be opened in a small separate window.
• Edit forms: a new entry is saved with "Create", an existing one with "Save". Both are separate writes: saving an existing entry can no longer create a copy of it, and creating one never overwrites an existing entry.
• Selection boxes (groups, users, employees, addresses, address books, accounts, bank accounts): entries whose name matches the search term are listed first, before entries found only by other fields such as organization or email. Groups, user names, projects, customer identifiers, address books, calendars and bank accounts are also found by parts of their name, e.g. PF_Controlling by "controlling".
• Selection boxes of users and groups: deactivated or deleted users and groups are shown struck through, in the picked values as in the search results.
• Lists: ended projects and no longer active customers are struck through, as in the selection boxes. Entries that are no longer active but not deleted (ended projects, inactive customers, cancelled invoices, rejected or replaced orders, inactive notification rules, deactivated references) are now struck through thin and grey, distinct from deleted entries, each with its own legend entry.
• Monthly report: when the configuration parameter "Report time sheets without Kost2?" is enabled, entries booked without Kost2 are marked, in the view as in the PDF export.
• Selection boxes
  • A selection box with many entries (30 or more, e.g. users or cost 2 units) no longer lists its first entries in alphabetical order before anything is typed, but asks to type a search term. Short lists are still shown completely when opened.
• Team vacation calendar: people are picked as users, and the members of a chosen group are shown also without an employee record (e.g. freelancers), with their availability entries, in the chart and the Excel export. Choices and favorites stored before are taken over.
• Calendar: the edit dialog of time sheets and events is no longer stretched over the whole width of large screens.
• System dashboard: muted problems can be listed with their own status filter, a click on the muted, ignored or resolved count of a key figure or subsystem tile lists exactly these problems, and a problem leaving the list after a status change can be shown again from a notice.
• Users, alternative and former e-mail addresses: an address already used by another user is rejected, the primary address isn't stored twice.
• Vacation account: days bar
  • The vacations of the vacation account show their period as a bar beside the days, as the vacation list does: working days, weekends and holidays, and the days without any replacement on duty.
  • A vacation longer than four weeks is drawn with narrower days in the same width (up to 13 weeks) instead of being cut off after four weeks, in the vacation list as well.
• Team vacation calendar: the vacations of the chosen employees and groups are now also shown on the page, per quarter or calendar year, with an adjustable width of the days (up to fitting the whole period into the window); the Excel export starts with the period shown, and the calendar can be printed (or saved as PDF) in the width of the page. Choices of employees and groups can be saved as favorites. Users without HR or finance rights choose from their own groups only and no longer see previous years. Vacations beginning before a sheet of the Excel export are now shown on it, too.
• System administration: two copy & paste samples for the alert message (maintenance, new release), with the next full hour and the next release filled in.
• Change password and change WLAN password are pages of the new user interface and show when the password was last changed.
• System statistics
  • The database tile appears at once: the number of history entries and attributes is the estimate of the database (~) instead of a count taking minutes.
  • Tiles still loading show their title and a spinner.
  • CPU load and system load average as bars.
• Leave account
  • Moved to the new interface; the statistics now include the next year as well.
  • Leave applications with a day without any substitute are marked red.
  • A leave application or leave account entry opened from the leave account returns to it.
• Leave applications
  • List and form moved to the new interface; working days, days left and the vacations of the substitutes follow the form as it is edited.
  • The form charts the vacation and the overlapping vacations of the substitutes over the calendar days, with weekends, holidays and the days without any substitute.
  • The list shows each leave application as a bar over its days, with the days without any substitute in red.
  • Only the statuses that may be set are offered.
  • A leave application opened from the calendar returns to it on save.
• Leave applications
  • The period and the employee are always on the filter row of the list; the period finds every leave application overlapping it.
  • The period is a calendar year by default, the list starts with the current one: any date entered gives its year, and the arrows page a year back or forth. A month or a free range can be chosen instead.
  • The form shows the vacation days left once the application being edited is counted, too, in red where they are not enough.

Fixed

• Gateway: subscriptions of team calendars and of the weeks of the year are served, holidays in the language of the user; the token within the subscription url is checked as on the main instance.
• Notifications: if the mail server isn't reachable, a failed notification mail is logged only once with its stack trace and its cause is shown in the delivery state; the further mails of the run wait for the next run instead of each waiting for the timeout.
• Orders: if the mail server can't be reached, saving waits only once for it instead of once per recipient of the notification.
• Project wizard: after "Configure another element" the project step offered no cost 2 types any more, so the next project had to get them in its edit form afterwards.
• Outgoing invoices: invoices saved in the new interface were not found by the name of their customer until the next search index rebuild.
• JIRA links: an issue key needs at least two leading uppercase letters, so a postal code like "D-34286" in a text is no longer linked as an issue.
• Project selection: projects are also found by their number (e.g. 7.002) and by the name of their customer.
• Scripts: showing the log of a running script could fail with an error.
• Time sheet list: the filter including all sub structure elements could not be switched off. It is replaced by the filter "without structure sub elements", off by default.
• The order and invoice caches no longer refresh each other endlessly (e.g. during the daily order book snapshots) when an invoice refers to a deleted order position.
• Search in the main menu: deactivated users are no longer found (they still are in the user list).
• The info of a structure element (title, path, project, customer, consumption) was answered to every logged-in user; now only to users who may see the structure element.
• Structure tree: a structure element created or moved while the tree was being reloaded in the background could vanish from the tree until the next reload, so no sub-element could be created below it ("Parent structure element is required but not found").
• Structure tree: after a structure element was changed, its responsible person was missing in the tree until the next reload.
• Password forgotten: the reset mail is limited per user, per client and in total, so it can no longer be requested over and over (mail bombing, invalidating a pending reset link).
• Lists: a search term that isn't a valid search syntax (e.g. "Project: Alpha") now shows a hint instead of an empty list without explanation.
• Import of incoming invoices
  • Positions of one invoice in different currencies are converted to EUR by the rate of the invoice date instead of being taken as EUR; without a rate the invoice is marked as faulty.
  • Stored invoices between two periods of the export (e.g. March for an export of January and June) are no longer offered for deletion.
  • Header-only export: the rows of one invoice (one per booking line) are merged into one invoice with the total amount, instead of being offered as new invoices on every import.
  • Header-only export: the internal note (column "Interne Re.-Nr.") is no longer appended to the invoice number, which changed back and forth with every import of the two files.
• Mass updates: the log window shows the updated entries again.
• Cancellation invoices are listed with the order positions they cancel, right after the cancelled invoice (e.g. 17400 and 17400-S), also in the order and forecast exports. On the order page both are struck through; together they still count 0 as invoiced.
• Order book: the edit page no longer jumps while a field is changed.
• Import of incoming invoices
  • An imported invoice no longer overwrites another stored invoice of the same creditor (number, date and currency of an older invoice were replaced).
  • Credit-card payment offsets (credit note on a credit-card clearing account) are skipped; their date becomes the paid date of the invoice if it has none. Other credit notes are imported with a negative amount.
  • A header-only import no longer offers stored invoices for deletion; a position import only those within its periods.
  • Warnings for a paid date before the invoice date and for invoices with EUR and another currency (EUR is taken).
  • An import with fewer positions than the stored invoice removes only the surplus positions; it deleted the whole invoice before.
  • The position import takes the paid date (the latest one if the positions differ, with a warning) and sets the amount paid to the gross sum of the invoice, less discount; a missing paid date keeps the stored one, as does a stored amount paid. Before, only the header import set the paid date.
  • A position without cost units in the import keeps its stored cost assignment; it was shown as modified after every import.
  • The comparison with the stored invoices is much faster, and the preview of a large file shows without a long wait.
  • DATEV files: tax rates and payment amounts in German format (e.g. "5,50", "1.234,56") are read correctly; a tax rate of 5.5 % was taken as 5 %.
• Number ranges: a range with customers and without configured segments shows its project and cost unit numbers by its digits (e.g. 7.0001.0 for one project digit) instead of 7.000.10.
• Project wizard: tabs and a pinned action bar as on the edit pages; the action step lists what will be set up (new customer, new project, path of the new structure elements, access rights) and what is still missing; the finish button is always clickable, and a progress bar shows while the setup runs.
• Phone call: calls from an external phone without an assigned number were refused by sipgate.
• Structure element fields show the new name and path right after a task was renamed or moved, without a reload.
• Amounts
  • The amounts of bank transactions and of liquidity entries and series are shown with two decimal places and the currency in the forms.
• The import of incoming invoices shows what changed in a modified row: the old and new value in every compared column, the gross amount included, and the changed fields without a column of their own (e.g. the paid date of a position-based file) in the status cell.
• Groups and team events no longer offer a link to the old interface: its pages no longer worked.
• Job monitor: the cancel button of a job is only offered to users allowed to cancel it; others saw a button without effect.
• Customer list: sorting by the customer number works again.
• Forecast of the order statistics and its Excel export: in the current month, the invoiced figures and the remaining forecast are added (as well as the invoices and the forecast of the plan), instead of taking the greater value. The cumulated forecast and plan now match the sums of the project overview. The note on this in the Excel sheet 'Grafiken 1' is removed.
• Forecast plan: the plan is the order book of the planning date. The forecast charts of the order statistics now include the orders deleted since, as the Excel export does. Orders already deleted on the planning date are no longer part of it: daily (incremental) order book snapshots kept the orders deleted since the beginning of the month. This is corrected for existing snapshots as well.
• Files: with projectforge.files.store=db, a JCR repository that can't be opened (e.g. damaged) no longer prevents the start. ProjectForge starts without it and logs an error; files not yet migrated out of the JCR are missing then, and the migration, backup and sanity check of the JCR are skipped.
• Lists migrated to the new interface ignore columns and a sort order stored by the old list for columns it no longer has; columns missing from a stored order appear in their usual place instead of at the end.
• Properties editor: values of all parameters ending in "key" (e.g. projectforge.receiveSmsKey) are treated as secrets and no longer shown.
• Menu visibility (projectforge.menu.visibility.*): a list of several groups works, separated by comma or semicolon (only a single group was recognized, a list not at all).
• Saving a changed entry in the new interface no longer empties its creation date. The date of the last change is always set by the server. Creation dates lost this way are restored from the history.
• Invoices and incoming invoices: an invoice stored earlier with deleted positions only can be deleted and restored again; only saving it is refused.
• Address campaigns and accounts: saving an existing entry no longer creates a copy of it (e.g. when setting a campaign inactive). A campaign's title must not be taken by another campaign.
• Footer: the build date is shown without a zone suffix (2026-10-19 instead of 2026-10-19Z).
• Orders, invoices and creditor invoices: an entry whose positions were all deleted is refused on saving instead of being stored without positions.
• Selection boxes with multiple choice: after a pick the search term stays selected, so typing the next name replaces it instead of being appended to it.
• Leave account: the columns type, availability, location and comment of the availability entries show their headings instead of text keys.
• Time sheet form: the consumption bar of the task is up to date after booking and no longer counts deleted time sheets.
• Notification rules
  • A manual rule shown as "Banner until done" always lets its recipients mark the banner as done: nothing else finished it, so it stayed forever.
  • Deactivating or deleting a rule ends its pending notifications at once, not only with the next hourly run.
  • Editors of a rule can end pending notifications in the log of sent notifications, one by one or all of a rule.
• Order statistics: on a low screen (e.g. a phone in landscape) the page scrolls, so the charts can be reached.
• Vacations: managers can approve and reject vacations again; entries stored without half day information were refused with a missing HR right.
• Calendars pushed to the gateway: a team calendar including absences is generated for each user and shows exactly the absences this user may see; before, it could show those of another user with the same access to the calendar.
• Converting a calendar event into a time sheet: an event ending on another day no longer produces a time sheet spanning several days ("Maximum duration exceeded"); the end time is taken on the start day.
• Lists: after quickly paging back and forth (e.g. a year back and forth again), a list could come back from an entry with the filter paged past, when its outdated request was answered last.
• Contribution margin: contact persons and additional contacts of an order see the contribution margin of its project, as in the order book. The access check of orders no longer loads their positions and payment schedules one by one, e.g. for the forecast chart and the contribution margin.
• Users: rights changed in the same save as the groups are now stored correctly. A right set together with joining a group was lost, and a right of a group the user left stayed set.
• Vacations: stricter access checks (a manager can no longer be swapped in on running or past entries, deleting and restoring use the stored entry and restoring is validated again, the vacations of replacements always count as conflicts, shown with dates and status only where the user may not read them otherwise, leave account corrections need write access); the remaining leave of the previous year is credited correctly for vacations crossing the end of the carry-over period and recalculated after later changes; special leave counts in the collision check; rejected vacations no longer appear in calendars and subscriptions; the comment is no longer mailed to replacements, and removed managers and replacements are notified. Excel export: weekends and holidays inside a vacation, half days and half working days are shown correctly, approved vacations win over those in progress. Automatic vacation booking of time sheets: days no longer covered by a vacation are removed, an unbookable vacation task fails the run instead of skipping days, the next successful run books all days missed since, and days are booked by the user's time zone. The vacation account loads faster. Team vacation calendar: readable by screen readers, the stored choice is no longer overwritten by an outdated page state.
• Contribution margin (order book and scripts)
  • Accounting records count in the month of their record number (booking period), not in the month of their date: an invoice of September booked into August now counts as booked in August.
  • Scripts include the current month up to today as preliminary values (time sheets and unbooked invoices).
• Time sheet form: choosing a task could fail now and then with "Session/EntityManager is closed" while the cost unit cache was being refreshed.
• Lists
  • A list came back from an entry with an outdated filter when it had been paged back to a filter used shortly before (e.g. a year back and forth).
• Security
  • Phone lookup (/rsPublic/phoneLookup) is disabled until an own key is configured in projectforge.phoneLookupKey; the former default placeholder is no longer accepted.
  • Force delete checks the CSRF token like all other write actions.
• Vacation export
  • Rejected leave applications are no longer exported.
• Vacation list: sorting by the status or the days column had no effect.
• Year filter
  • The year filter of the leave applications and the contracts is applied again; it was ignored in the new interface.

Changed

• Order statistics, contribution margin bubble chart: the size of a bubble shows its contribution margin instead of its costs. The switch "Show titles" labels the own bubbles with their short title and contribution margin %; switched off, the names are in the tooltip only.
• Banking
  • Bank accounts, their transactions and the import of transactions migrated to the new interface. The import is a page of its own: choose the account, drop the csv file, check the preview with the differences to the stored transactions.
  • Transactions: the filter of bank accounts takes all selected accounts, not only the first one.
  • Bank accounts: the selection of an account shows its name.
  • The import of transactions is refused for an account without write access, and the account of a stored transaction can no longer be changed.
  • Import of transactions: a transaction without date, value date or amount is marked as faulty in the preview instead of being dropped silently (without date) or making the import fail, and the error of a transaction of another account is shown once.
• Import of incoming invoices
  • After committing, the import page stays open: the progress is shown there and the preview is reconciled again once the import is done.
• Creditor invoices: the old upload page of the CSV import has been removed; the import runs in the new interface.
• Job monitor migrated to the new interface: running and recently terminated background jobs with their progress, cancelling asks for confirmation first. After an import the page returns to the import once its job has finished, but only to a page of the same server. Old links are redirected.
• Memos migrated to the new interface: list and form. A memo stays visible to its owner only.
• Visitor book migrated to the new interface: list with the latest visit and the number of visits, form with the contact persons, visits entered in a dialog (preset with today and the current time). Deleting the last visit of a visitor no longer fails, and a visit can no longer be assigned to another visitor. Old links are redirected.
• The classic version of the address campaign values (list, mass update and the address form opened from it) has been removed; the new interface covers everything.
• Merlin Word® templates migrated to the new interface: list, admin form with the variables and the execution, single and serial.
• Links of former versions
  • Old links to pages of the former interfaces are only forwarded to the new pages if they were sent by mail or shared: orders, to-dos, vacation entries, data transfer, poll answers, the password change and the error overview of the system dashboard. The former start pages (login, calendar) and the direct call stay forwarded too. Bookmarks of other old pages no longer lead to the new ones and should be renewed.
  • The links of the reminder mails of polls ending soon (versions 8.0 and 8.1) lead to the answer page again.
• Two-factor authentication setup migrated to the new interface: mobile phone, authenticator app and WebAuthn tokens on one page, a token is renamed or deleted in a dialog. Deleting a WebAuthn token now also requires a recent second factor. Old links are redirected.
• config.xml replaced by configuration parameters
  • Holidays, JIRA servers, contract types and the accounting settings (account number ranges, business assessment) are maintained on the configuration page as parameters, each with an own editor (rows of the business assessment movable, formulas and scripts checked on saving, JIRA urls and project keys checked as well); changes of the holidays apply without restart.
  • An existing config.xml is taken over automatically on the first start (into the parameters still empty, its directories into projectforge.dir.* of projectforge.properties) and renamed to config.xml.migrated afterwards.
  • The export of config.xml in the system administration is removed.
• Contracts migrated to the new interface: list with a period filter on the date, form with suggestions from other contracts, the configured contract types, JIRA links, attachments and cloning. A year filter stored by the former list is still shown and can be removed. Old links are redirected.
• Customers: new user right "Customers" (finance), like the one for projects. Creating, changing and deleting customers needs it with read and write access; being a member of the finance group is no longer enough, so admins have to grant it. The customer wizard needs it for new customers.
• Polls migrated to the new interface and reworked: list, form and answer page, questions reordered or taken from templates (built-in ones or own polls marked as template), polls cloned, a results tab beside the Excel export. Attendees and full access also by group (later members included). Multiple choice questions accept several answers again, answers stay with their question when questions change. Only users with full access see the results; finished polls can no longer be answered or changed, and their end is mailed once. Old links are redirected.
• Inbox and outbox migrated to the new interface: list and form, with the autocompletion of the free texts. Old links are redirected.
• Customer wizard: also usable with only one of the rights for customers and projects. With the right for customers only, a new customer is created (and optionally its structure element); with the right for projects only, a project is set up for an existing customer. With both, "No project" creates the customer only. The groups and their access rights are optional, and no group is preselected any more.
• Skill matrix migrated to the new interface: list and form, ratings as stars, the Excel export of the statistics in the list, and a mass update of rating, interest and comment. Old links are redirected.
• Currency pairs migrated to the new interface: list with the rate valid today, form with the conversion rates of the pair, edited in a dialog directly in the form. For a new rate, the rates of both directions are proposed from the online source for its date; the rate valid today is marked, rates still ahead are shown muted. Old links are redirected.
• Data transfer with a gateway
  • Areas with external download or upload are administered on the internal instance again. Each sync transfers them to the gateway, where the external link points and where external users and the internal users with access find the files. No area is administered on the gateway any longer (created, changed or deleted; no personal boxes either), a note there points to the main instance, and the observers get the notification mails from there. Switching off the external access or deleting the area removes it from the gateway.
  • The external link of a deleted area no longer works.
• Data transfer: the external access of an area (login with the area's password, then its files) has moved to the new interface. The area's link now points there; links sent before lead there as well. As in the area itself, a click on a file opens its details (read-only for files of others), the files are sorted newest first, and the column layout is kept (in the browser). Own uploads can now also be encrypted. External users no longer see who uploaded the other files unless they are logged in to ProjectForge as well and have access to the area there (who also see its activities), and can no longer rename files of others. Logging in to or out of the external access no longer ends a login to ProjectForge in the same browser.
• Projects: a contact person plus any number of further contact persons, as orders have them, replace the project manager, the head of business manager and the sales manager (migrated: the project manager becomes the contact person, the others further contacts). All contacts have the same access to the project and its orders and invoices; the project list shows them in one column, the mass update sets the contact person, and picking a project in an order prefills its contacts.
• Leave account entries (corrections of the leave account) migrated to the new interface: list and form. HR staff can add a correction for the employee shown directly in the vacation account; a correction opened there returns to it. Old links are redirected.
• Employees: the list and the form of the employees are migrated to the new interface. Status, weekly working hours and annual leave days are edited in dialogs directly in the form; the entry valid today is marked, entries still ahead are shown muted.
• Addresses
  • List, view and form of the addresses are migrated to the new interface, including the import of vCards, the takeover of data from a pasted text or a vCard, the image, the exports (Excel, vCards, CardDAV access) and the mass update.
  • The favorite star of an address can be switched directly in the list and in the view.
  • Calling a phone number of an address and sending it a text message open in a dialog over the list or the view.
  • An uploaded image is no longer lost if the form is saved more than a minute after the upload.
• Addressbooks: the list and the form of the address books are migrated to the new interface. The list shows the users and groups with full and read-only access in columns of their own.
• Lists: for entities with fewer than 100,000 entries, the gear menu offers only the full re-index of the search index, for every user — it takes just seconds there. Larger entities keep the re-index of the newest entries, and the full one for administrators.
• Notification rules
  • Inactive rules are struck through in the list.
  • Deactivating a rule ends its pending notifications: their delayed steps (e.g. the e-mail) are no longer sent.
  • "Trigger now" is only available for active rules.
  • Delivery steps: removing a step no longer changes the delay of the following one (it could become 0, i.e. sent at once).
  • "Send test to me" states that the test goes out at once through all channels, e-mail too.
  • Each rule chooses where the "Open" button of its notifications leads: the page of the trigger, any menu entry, or no button at all.
  • "Open" is a button beside "Confirm" instead of a link below the text.
• Setup with test data: new, larger sample data (customers, projects, orders, invoices, half a year of time sheets, vacations, calendar, liquidity planning) with dates relative to the day of the setup. The sample users get the admin password. The setup page shows the progress. The default plugins are active right after the setup, without a restart.
• Vacations of others: the members of the person's groups see them from 1 January of the current year on (before: up to 31 days after their end), in the calendar, team calendars and their subscriptions alike. Manager and substitutes of a vacation, HR and finance staff see all of it, now also in the vacation list (HR staff with read-only access, finance and controlling included). The team vacation calendar shows the availability entries of others to finance staff as to anybody else: of the members of their groups, from today on.
• Customers and projects independent of cost units
  • Each project has a system-wide unique project number. Customers and projects can be used without cost units (Kost2), with free numbers.
  • Number ranges for customers and projects and their mapping to Kost2 are configured in application.properties (projectforge.fibu.number-ranges.*), including the number of project digits per customer and the segments of the Kost2 numbers, e.g. 1.####.#.##.
  • Without configured number ranges, installations that used the former ranges 4.###.##.## (internal) and 5.###.##.## (customers 0-999) for cost units of projects keep them; otherwise customer and project numbers are free, with or without cost units.
  • New customers and projects are offered the next free number of their number range.
  • Invoicing quota: optionally, the time booked on invoiced Kost2 types of customer projects counts as billed, independent of the Kost2 number (projectforge.invoicing-quota.billed-by-invoiced-kost2-types).
  • Contribution margin: Kost2 assignments accept the numbers as their number range segments them (e.g. 1.0007.3).
• Selection boxes for users, employees, projects, customers and cost units no longer offer inactive entries (deactivated users, employees who have left, ended projects and customers). A "Show inactive" checkbox in the selection box brings them back; for users and employees it is available to HR, finance, organisation and administrators only. An inactive entry already set stays selectable.
• Address campaign values: list, form and mass update migrated to the new interface. The address opens in a dialog from the organization and address columns; the previous page stays available as the classic version.
• Calendars: the list and the form of the team calendars are migrated to the new interface. A stored calendar shows its subscription link with a switch for the reminders, the list offers the subscription of time sheets, weeks of year and holidays in its export menu.
• Users: the list and the form of the user administration are migrated to the new interface. The rights offered adapt to the assigned groups at once, and tokens can be renewed and devices logged out directly from the form; passwords are changed in a dialog, here as on the own account page.
• Vacation list: users without HR or finance rights see their own vacations, the ones they approve or substitute for, and the vacations of their substitutes overlapping their own ones, no longer all current vacations of their group colleagues.
• Docker image: based on Java 21 (Eclipse Temurin 21 JRE) instead of Java 17. ProjectForge still runs on Java 17 or newer.

Removed

• The former React interface is removed: all its pages are part of the new interface, and old links (/react/...) lead there.
• The 2FA dialog of the old interface was removed: a second factor for protected actions is only asked for in the new interface. Pages of the old interface get an access denial instead, old links lead to the start page.
• The d.velop interface (synchronization of customers and vendors as trading partners) was removed.

Security

• The CSRF token is checked for every changing request of a logged-in browser session, no longer only for requests identifying themselves as the new interface; cancelling a login or password reset is accepted as POST only.
• Appending a comment to a history entry needs update access to the entry's object, and is only possible for objects supporting comments (users, groups).
• npm vulnerabilities in projectforge-next fixed: next 16.4.2, dompurify 3.4.17 and vitest 4.1.12.
• Requests that change something (list and calendar filters, templates, search index, logout) are accepted as POST only; the GET variants of the former React interface are removed.
• More pages require the second factor of their area: the imports of salaries, incoming invoices and bank account records, the upload of incoming invoices, the bank accounts, currency pairs and conversion rates, the customer groups and the project wizard (finance), as well as the structure wizard, the caches and the Sipgate page (administration). The system statistics no longer require the second factor of the administration.
• The QR codes of the authenticator key (two-factor setup), of the REST client token (my account) and of the calendar subscriptions are sent within the response instead of as an image link, so the secret or token no longer shows up in access logs. QR code images are not cached anymore. The WebAuthn options no longer contain the session id, and changes of the two-factor setup check the CSRF token themselves.
• Security hardening
  • Stricter Content Security Policy by default (no eval, no foreign frames, objects or form targets), new Referrer-Policy and Permissions-Policy headers, no conflicting X-Frame-Options any more. An own value of projectforge.security.csp-header-value stays as it is.
  • The session id is renewed after a successful second factor.
  • The preset of a new entry and the cloning of an entry require the right to add entries of this kind.
  • Html of the forecast analysis and of list notes is escaped or sanitized more thoroughly.
  • Polls: only participants answer, for themselves, and a user with full access on behalf of an attendee; the answers of others can no longer be overwritten, and parallel users no longer mix up their polls.
  • Requests that change something (sending 2FA codes, system actions, cancelling jobs, logout, saving list and calendar filters and favorites) are sent as POST.
  • Data transfer: who may change or delete an area is decided by its stored admins; a user can no longer make himself admin of an area by saving it.
  • Project wizard: existing access rights of a group on the parent elements are only added to, never reduced; the preview shows nothing about elements the user may not see.
  • Leave account corrections can be added by HR staff with write access only, also the preset of a new one.
  • Skill matrix: saving a skill no longer moves it to another user.
  • The unused QR code image endpoints are removed; QR codes are delivered as data urls only.
  • Order book: whether a project manager may change or delete an order is decided by the stored order as well; saving a foreign order with the own project no longer takes it over.
  • Ending a mass update (cancel) is sent as POST.
  • Deleting and restoring an entry are decided by the stored entry as well, not only by the posted one: a foreign entry (e.g. a memo, timesheet or calendar) can no longer be taken over by deleting or restoring it with the own user as owner.
  • Calendar events: changing or deleting an event also requires write access to its stored calendar; a foreign event can no longer be moved into the own calendar.
  • To-dos, Merlin templates and polls: whether an entry may be changed is decided by the stored entry as well (assignee, admins, owner), not only by the saved one.
  • System groups can no longer be deleted by sending them under another name.
  • Bank accounts: whether an account may be changed or deleted is decided by the stored account; saving a foreign account with the own user as owner no longer takes it over.
  • Addresses: adding an address to an address book requires full access to that book, also when it is saved along with an own one.
  • Invoices: deleting an invoice is decided by its stored type and cancelled invoice; deleting it as a posted cancellation no longer resets the status of another invoice.
• Changing the own password or WLAN password: a wrong old password counts as failed login attempt and locks further attempts for a while, like the login does.
• A password change (own, by an admin or by a password reset) now also ends the user's other open sessions, not only the stay-logged-in devices. The session the own password was changed in stays logged in.