False
        

Triggered text Ignored text Blocked text

tag:github.com,2008:https://github.com/go-vikunja/vikunja/releases

Release notes from vikunja

2026-10-02T17:10:44Z tag:github.com,2008:Repository/159556794/v2.7.0 2026-10-02T21:18:37Z

v2.7.0

<p>🦙 Vikunja 2.7.0 is out!</p> <p>🔒 Six security fixes<br> 🤖 An MCP server so your AI assistant can work with your tasks<br> 📅 Plus a new date picker</p> <p><a href="https://vikunja.io/changelog/vikunja-2.7.0-was-released/" rel="nofollow">https://vikunja.io/changelog/vikunja-2.7.0-was-released/</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.6.0 2026-08-31T18:13:15Z

v2.6.0

<p>🚀 Vikunja 2.6.0 is out! 380 commits, 18 of which are security fixes. 🔒</p> <p>Also new: import from Planka 📥, image/audio/video previews for attachments 🖼️, and an email change flow that no longer locks you out on a typo. ✉️</p> <p><a href="https://vikunja.io/changelog/vikunja-2.6.0-was-released/" rel="nofollow">https://vikunja.io/changelog/vikunja-2.6.0-was-released/</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.5.0 2026-08-04T12:46:14Z

v2.5.0

<p>🚀 Vikunja 2.5.0 is out! Small release, 203 commits of cleanup.</p> <p>🔒 One security fix: a share link could act as another user. Please update.</p> <p>⚡ Pasting a list into quick add magic now creates every task in one request, in the order you wrote them.</p> <p>Plus a bunch of CalDAV, notification and import fixes 🦙</p> <p><a href="https://vikunja.io/changelog/vikunja-2.5.0-was-released/" rel="nofollow">https://vikunja.io/changelog/vikunja-2.5.0-was-released/</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.4.0 2026-07-19T19:13:16Z

v2.4.0

<p>🦙 Vikunja 2.4.0 is out! Ten security fixes (please update soon), the first Vikunja Pro features, and a brand-new v2 API. Full rundown: <a href="https://vikunja.io/changelog/vikunja-2.4.0-pro-and-a-new-api" rel="nofollow">https://vikunja.io/changelog/vikunja-2.4.0-pro-and-a-new-api</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.3.0 2026-04-09T19:53:26Z

v2.3.0

<p>🦙 Vikunja 2.3.0 is out! 11 security fixes, a new plugin system, quick-entry window for the desktop app, Vikunja as an OAuth 2.0 provider, WeKan + CSV imports, and more across 277 commits. Updating soon is highly reccomended!</p> <p><a href="https://vikunja.io/changelog/whats-new-in-vikunja-2.3.0" rel="nofollow">https://vikunja.io/changelog/whats-new-in-vikunja-2.3.0</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.2.2 2026-03-23T21:35:07Z

v2.2.2

<p>🔒 Vikunja 2.2.2 is out: nine security fixes including a critical chain that could expose instance-wide data. Also adds centralized SSRF protection and a few nice bug fixes. Please update soon!</p> <p>(2.2.1 has been released as well but did not fix the issues fully, therefore I went and pushed 2.2.2 right after)</p> <p><a href="https://vikunja.io/changelog/vikunja-v2.2.2-was-released" rel="nofollow">https://vikunja.io/changelog/vikunja-v2.2.2-was-released</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.2.1 2026-03-23T18:50:19Z

v2.2.1: [2.2.1] - 2026-03-23

<p>Bug Fixes</p> <ul> <li><em>(auth)</em> Reject disabled/locked users in OIDC callback</li> <li><em>(auth)</em> Reject disabled/locked users in API token middleware</li> <li><em>(auth)</em> Return correct error type for locked users in OIDC callback</li> <li><em>(auth)</em> Reject disabled/locked users in CheckUserCredentials</li> <li><em>(auth)</em> Skip profile updates for disabled LDAP users</li> <li><em>(caldav)</em> Replace href with pathname from parseURL for api base</li> <li><em>(frontend)</em> OrigUrlToCheck references the same object as urlToCheck</li> <li><em>(openid)</em> Merge VikunjaGroups and ExtraSettingsLinks from userinfo</li> <li><em>(user)</em> Reject disabled/locked users in getUser by default</li> <li><em>(user)</em> Handle status errors in pkg/user callers, remove redundant checks</li> <li><em>(user)</em> Handle status errors across the codebase, remove redundant checks</li> <li><em>(user)</em> Use getUser directly for uniqueness checks in UpdateUser</li> <li><em>(user)</em> Use unique error code for ErrCodeAccountLocked</li> <li>Remove small class from preset label (<a href="/go-vikunja/vikunja/blob/v2.2.1/652eb9bba3701b72cbb26f5e60f7fc559c452eb7">652eb9b</a>)</li> <li>Include kanban bucket move permission in tasks preset (<a href="/go-vikunja/vikunja/blob/v2.2.1/0085772b63b12747b804a7caac2ab4c846b664b3">0085772</a>)</li> <li>Prevent TOTP passcode reuse within validity window (<a href="/go-vikunja/vikunja/blob/v2.2.1/5f06e1dce56ca2b1845c9adb7aacab8777296e1f">5f06e1d</a>)</li> <li>Update TOTP reuse test to use user10 matching rebased fixture (<a href="/go-vikunja/vikunja/blob/v2.2.1/acafa6db10b238dae5b66851cc2c5dedbd51bbd1">acafa6d</a>)</li> <li>Add TTL-based expiry and cleanup for used TOTP passcode entries (<a href="/go-vikunja/vikunja/blob/v2.2.1/0f98c19ab66215200facebd8fac58d5aedc8c0ef">0f98c19</a>)</li> <li>Check child project's own IsArchived flag in CheckIsArchived (<a href="/go-vikunja/vikunja/blob/v2.2.1/d0606eadea06669326f9f39747d2fc49191c2e69">d0606ea</a>)</li> <li>Update ParadeDB search test count for new fixture (<a href="/go-vikunja/vikunja/blob/v2.2.1/595002bf96556e9f1d16fb4e2016d16d7a2e2564">595002b</a>)</li> <li>Filter related tasks by project access to prevent cross-project info disclosure (<a href="/go-vikunja/vikunja/blob/v2.2.1/67a47787fa12ff61ff80be0c79032bec71e3e63d">67a4778</a>)</li> <li>Prevent attachment IDOR by validating task_id in ReadOne (<a title="GHSA-jfmm-mjcp-8wq2" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-jfmm-mjcp-8wq2/hovercard" href="https://github.com/advisories/GHSA-jfmm-mjcp-8wq2">GHSA-jfmm-mjcp-8wq2</a>) (<a href="/go-vikunja/vikunja/blob/v2.2.1/b8edc8f17f47222e439bbac8725758a02782e943">b8edc8f</a>)</li> <li>Prevent link share IDOR by validating project_id in Delete and ReadOne (<a href="/go-vikunja/vikunja/blob/v2.2.1/654d2c7042f912f662bb49e05b7f9bb74e6ae1b4">654d2c7</a>)</li> <li>Prevent SSRF via OpenID Connect avatar download (<a title="GHSA-g9xj-752q-xh63" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-g9xj-752q-xh63/hovercard" href="https://github.com/advisories/GHSA-g9xj-752q-xh63">GHSA-g9xj-752q-xh63</a>) (<a href="/go-vikunja/vikunja/blob/v2.2.1/363aa6642352b08fc8bc6aaff2f3a550393af1cf">363aa66</a>)</li> <li>Prevent SSRF via migration file attachment URLs (<a title="GHSA-g66v-54v9-52pr" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-g66v-54v9-52pr/hovercard" href="https://github.com/advisories/GHSA-g66v-54v9-52pr">GHSA-g66v-54v9-52pr</a>) (<a href="/go-vikunja/vikunja/blob/v2.2.1/93297742236e3d33af72c993e5da960db01d259e">9329774</a>)</li> <li>Prevent SSRF via Microsoft Todo migration pagination links (<a href="/go-vikunja/vikunja/blob/v2.2.1/73edbb6d467bb1c01f928568c6f28f3d5eabe807">73edbb6</a>)</li> <li>Prevent SSRF via Unsplash background image download (<a href="/go-vikunja/vikunja/blob/v2.2.1/a94109e1beab683277fb1524514fcd7368cd071d">a94109e</a>)</li> <li>Block link share users from listing link shares in ReadAll (<a href="/go-vikunja/vikunja/blob/v2.2.1/9efe1fadba817923c7c7f5953c3e9e9c5683bbf3">9efe1fa</a>)</li> <li>Correct error message assertion in linkshare ReadAll tests (<a href="/go-vikunja/vikunja/blob/v2.2.1/a0478a0d96befef4583fdf10ac7a02eff4d8e435">a0478a0</a>)</li> <li>Strip BasicAuth credentials from project webhook API responses (<a href="/go-vikunja/vikunja/blob/v2.2.1/75c9b753a8e4feed8f681ad76fe8f125b0016366">75c9b75</a>)</li> <li>Strip BasicAuth credentials from user webhook API responses (<a href="/go-vikunja/vikunja/blob/v2.2.1/6aef5aff62f58edd178d954e30981b18c2348bc2">6aef5af</a>)</li> <li>Use MySQL-compatible CREATE INDEX in migration 20260224215050 (<a href="/go-vikunja/vikunja/blob/v2.2.1/867c52745f595f9fb00e868ed3a81a31e2c89672">867c527</a>)</li> <li>Skip quick add magic parsing when text is wrapped in quotes (<a href="/go-vikunja/vikunja/blob/v2.2.1/07b9742d98d8068ae14f752babfe2715f031fc0b">07b9742</a>)</li> </ul> <p>Dependencies</p> <ul> <li><em>(deps)</em> Update dependency rollup to v4.60.0</li> <li><em>(deps)</em> Update dependency caniuse-lite to v1.0.30001781</li> <li><em>(deps)</em> Update flatted to 3.4.2 to fix prototype pollution vulnerability</li> <li><em>(deps)</em> Update dev-dependencies</li> <li><em>(deps)</em> Update dev-dependencies to v8.57.2</li> </ul> <p>Documentation</p> <ul> <li>Mention mole proxy in outgoingrequests config docs (<a href="/go-vikunja/vikunja/blob/v2.2.1/701e3f952514cb12f4cec5b533b38ce81b1cc60f">701e3f9</a>)</li> </ul> <p>Features</p> <ul> <li><em>(user)</em> Add ErrAccountLocked error type</li> <li>Add quick presets for API token permission selection (<a href="/go-vikunja/vikunja/blob/v2.2.1/68097cf7004f3d7f1d6e5ff57f7adf5b001f513d">68097cf</a>)</li> <li>Add outgoingrequests config keys for centralized SSRF protection (<a href="/go-vikunja/vikunja/blob/v2.2.1/f96b53fe998e9a7484507d4a31dd79f86dd556c6">f96b53f</a>)</li> <li>Add shared SSRF-safe HTTP client utility (<a href="/go-vikunja/vikunja/blob/v2.2.1/0266fffad2fcf9a81c2eb3d0466734633fdf7fb7">0266fff</a>)</li> </ul> <p>Miscellaneous Tasks</p> <ul> <li><em>(ci)</em> Update golangci-lint to v2.10.1</li> <li><em>(i18n)</em> Update translations via Crowdin</li> <li><em>(lint)</em> Suppress known gosec false positives</li> <li><em>(lint)</em> Suppress additional gosec false positives</li> <li><em>(lint)</em> Suppress gosec false positives on SSRF-safe HTTP client calls</li> </ul> <p>Refactor</p> <ul> <li><em>(user)</em> Export IsErrUserStatusError for use across packages</li> <li>Reorganize quick add magic into focused modules (<a href="/go-vikunja/vikunja/blob/v2.2.1/cb81cf1aa83d006ac83f74556c1b195f22a1335f">cb81cf1</a>)</li> <li>Add accessibleProjectIDsSubquery helper for project-level authz filtering (<a href="/go-vikunja/vikunja/blob/v2.2.1/e2683bb2bcffa879054474e702ea8c2c405c8b8d">e2683bb</a>)</li> <li>Use accessibleProjectIDsSubquery in addBucketsToTasks (<a href="/go-vikunja/vikunja/blob/v2.2.1/833f2aec006ac0f6643c41872e45dd79220b9174">833f2ae</a>)</li> <li>Use shared SSRF-safe HTTP client in webhook code (<a href="/go-vikunja/vikunja/blob/v2.2.1/e5a1c057719dd768e5101787830dce585aeaf460">e5a1c05</a>)</li> </ul> <p>Testing</p> <ul> <li><em>(auth)</em> Add comprehensive disabled/locked user auth tests</li> <li>Add TOTP fixture and load it in user test bootstrap (<a href="/go-vikunja/vikunja/blob/v2.2.1/de58f630ee41d8672c7a4c644edb8b0b8b9c97e8">de58f63</a>)</li> <li>Add failing test for TOTP passcode reuse prevention (<a href="/go-vikunja/vikunja/blob/v2.2.1/5591ca94baf8cdece3f5ca6a1968fa96886e7de1">5591ca9</a>)</li> <li>Add API token fixture for disabled user (<a href="/go-vikunja/vikunja/blob/v2.2.1/198322c8e153d41b37ae761fb0ebe71059c87e12">198322c</a>)</li> <li>Verify disabled user's API token is rejected (<a href="/go-vikunja/vikunja/blob/v2.2.1/e4379eff108b4061d39a63dbe7a60fd6ab2793a7">e4379ef</a>)</li> <li>Verify disabled user is rejected via CalDAV auth (<a href="/go-vikunja/vikunja/blob/v2.2.1/8b614a4cb3226a9816da6ec46b81b2234e88760a">8b614a4</a>)</li> <li>Verify GetUserByID rejects disabled users and returns user with error (<a href="/go-vikunja/vikunja/blob/v2.2.1/525f5ee407b74db31d0476882a89d359641f83a6">525f5ee</a>)</li> <li>Add cross-project task relation fixture for authz test (<a href="/go-vikunja/vikunja/blob/v2.2.1/589d2a55561601d26c043db6c8b33893ce738ccc">589d2a5</a>)</li> <li>Add failing test for cross-project task relation info disclosure (<a href="/go-vikunja/vikunja/blob/v2.2.1/50c3eebd235896fce0984a242c97385bc77458c4">50c3eeb</a>)</li> <li>Add attachment fixture on inaccessible task for IDOR test (<a href="/go-vikunja/vikunja/blob/v2.2.1/b2c3c36b6fdf05caefd223067ec7d1ebdf7d66fd">b2c3c36</a>)</li> <li>Add IDOR test for task attachment ReadOne (<a title="GHSA-jfmm-mjcp-8wq2" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-jfmm-mjcp-8wq2/hovercard" href="https://github.com/advisories/GHSA-jfmm-mjcp-8wq2">GHSA-jfmm-mjcp-8wq2</a>) (<a href="/go-vikunja/vikunja/blob/v2.2.1/3111f3d70ce08764b18f887b1824205b9f133503">3111f3d</a>)</li> <li>Use new outgoingrequests config keys in SSRF tests (<a href="/go-vikunja/vikunja/blob/v2.2.1/d4d88c0f5935c51a8f9c0b205e9b517537792228">d4d88c0</a>)</li> <li>Remove redundant webhook SSRF tests (<a href="/go-vikunja/vikunja/blob/v2.2.1/848a4e7f0757bc6a18bcdbc0205f23fe226a1866">848a4e7</a>)</li> <li>Add BasicAuth credentials to webhook fixture (<a href="/go-vikunja/vikunja/blob/v2.2.1/094ff5f1efe403df5c5e63ba99144cddff293059">094ff5f</a>)</li> <li>Add failing test for webhook BasicAuth credential exposure (<a href="/go-vikunja/vikunja/blob/v2.2.1/751ab2c63505119d9c3b1f458100147d26f49b94">751ab2c</a>)</li> <li>Update user count assertions for new locked user fixture (<a href="/go-vikunja/vikunja/blob/v2.2.1/c1418c1619b15fb9a9707ab4820528e087ddd354">c1418c1</a>)</li> <li>Add failing tests for quote-escaped task text parsing (<a href="/go-vikunja/vikunja/blob/v2.2.1/8538b4c885d03789061161772233ea60be8bbe37">8538b4c</a>)</li> </ul> kolaente tag:github.com,2008:Repository/159556794/v2.2.0 2026-03-20T13:42:37Z

v2.2.0

<p>🔒 Vikunja 2.2.0 is out! 10 security fixes (update now!), plus task duplication, an improved Gantt chart with subtask hierarchy & dependency arrows, and user-level webhooks. 237 commits of goodness 🚀</p> <p>Check out the release post for a more in-depth view: <a href="https://vikunja.io/changelog/vikunja-v2.2.0-was-released" rel="nofollow">https://vikunja.io/changelog/vikunja-v2.2.0-was-released</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.1.0 2026-02-27T14:26:53Z

v2.1.0

<p>🎉 Just two days after the last release, Vikunja 2.1.0 is now released!</p> <p>🔒 Fixes a security issue with password reset tokens and adds a nice touch: checklist indicators now turn green when all items are done!</p> <p>Check out the full release post on the website: <a href="https://vikunja.io/changelog/vikunja-v2.1.0-was-released/" rel="nofollow">https://vikunja.io/changelog/vikunja-v2.1.0-was-released/</a></p> github-actions[bot] tag:github.com,2008:Repository/159556794/v2.0.0 2026-02-25T13:58:47Z

v2.0.0

<p>This release fixes 4 critical security issues. Please upgrade as soon as you can!</p> <p>Check out the full release notes here: <a href="https://vikunja.io/changelog/vikunja-v2.0.0-was-released/" rel="nofollow">https://vikunja.io/changelog/vikunja-v2.0.0-was-released/</a></p> github-actions[bot]