Skip to content

OpenProject 17.9.5

Choose a tag to compare

View all tags
@oliverguenther oliverguenther released this 30 Oct 09:52
· 4891 commits to dev since this release
v17.9.5
fd4580a
This commit was signed with the committer’s verified signature.
oliverguenther Oliver Günther
GPG key ID: 88872239EB414F99
Verified
Learn about vigilant mode.

Release date: 2026-10-30

We released OpenProject 17.9.5.
The release contains several bug fixes and we recommend updating to the newest version.
Below you will find a complete list of all changes and bug fixes.

Security fixes

GHSA-2qr3-mhmh-xfwj - Work-package budget link discloses budget subject to users lacking view_budgets

Authenticated users who is a member of a project that uses the Budgets module, when having t
view_work_packages but not view_budgets, can see budget subjects if they are linked to a work package through the work package's API form response.

This report has been responsibly disclosed by GitHub user barnessomer through GitHub advisories.

For more information, please see the GitHub advisory #GHSA-2qr3-mhmh-xfwj

Bug fixes and changes

  • Bugfix: Work package identifiers not updated after alleged successful migration [#75941]
  • Bugfix: Project copy blocks all work package creates until the copy completes [#82056]
  • Bugfix: OpenTelemetry logs "invalid span attribute value type Hash" for every S3 request made through fog [#82184]
Assets 2
Loading