v4.5.0

End of life

v4.5.0 is the final release of the v4 line. v4 is no longer maintained — all further fixes, features, and support move to the current stable line, main / v6. New installations should start on v6; existing v4 installs should upgrade to v6.

This release exists to ship one good-will security fix (below) to v4 users who cannot upgrade immediately, plus the maintenance and feature work that had accumulated on the branch since v4.4.2.

Security

• Entry deletion now enforces ownership (IDOR). Previously any authenticated user could delete another user's time entry by id. Deletion is now allowed only for the entry's owner, or a project leader / admin — mirroring the read-access rule. — @CybotTM (#560)

Features

• Configurable Jira API version per ticket system. Jira Server/Data Center 9.x (REST v2, search) and Jira Cloud (REST v3, search/jql) use different search endpoints; the ticket system now carries the API version and picks the correct path. — @CybotTM, building on @cweiske's groundwork in TIM-130 (#225)
• New route GET /tracking/entry/{id} to fetch a single entry by id, with owner/PL access control and translated 404/403 responses. — @tivvie (TIM-123)
• Customer lists are sorted by name. — @bergo (TIM-126)

Fixes

• Reject entry creation when the activity parameter is missing or invalid. — @tivvie (TIM-132, #240)
• Check authentication before resolving the user in the group-by-user interpretation. — @tivvie (TIM-136, #234)

Maintenance

• Pin all CI actions to commit SHAs and bump them to current majors (the docker-publish workflow builds green again). — @CybotTM (#561, #562)
• Refresh composer.lock within the existing PHP 7.4 constraints. — @CybotTM (#565)

Full Changelog: v4.4.2...v4.5.0