ProjectRoleRestrictionModel, ColumnRestrictionModel, ColumnMoveRestrictionModel)user_id in subtask time tracking write methods<30m instead of <1h#id link at the start of a line is no longer swallowedvisibility valuezh_TW translationselect2 to 4.0.13 and PHPUnit to 12.5.23hash_equals) for API and webhook token validation to mitigate timing attacks.TaskFinderModel)WEBHOOK_ALLOW_PRIVATE_NETWORKSpimple/pimple to version 3.6.2PluginController actions.php-cs-fixer Docker image instead of installing it via Composer.pimple/pimple from version 3.5.0 to 3.6.1.//example.com) from being used as login redirect targets.TRUSTED_PROXY_NETWORKS configuration option to explicitly define trusted reverse proxy networks.tests/Dockerfile.actions/checkout from v5 to v6actions/upload-artifact from v4 → v5 → v6sanitize_path function$escape parameter must be provided in PHP 8.4 for CSV functionsRememberMeAuth provider when REMEMBER_ME_AUTH is falseunserialize()TaskAssignCurrentUserColumnIfNoUserAlreadySet and TaskAssignToUserOnCreationInColumnpdf() method in Core\Http\Responsephp-cs-fixer on GitHub Actionsgh-cli feature source in devcontainer configurationHost header injection via SERVER_NAMEhttp://localhost/.Implicitly nullable parameter declarations errors in PHP 8.4healthcheck.php, and new Docker Compose files for MariaDB, Postgres, and SQLiteTRUSTED_PROXY_HEADERS config option
- If you use a reverse proxy, you can now specify which headers to trust for the client IP address. Nothing is trusted by default.CONTRIBUTING.md fileset-output deprecated commanddocker-compose.yml sample file to the latest specsVagrantfileClientError exception for empty responses and JSON parsing errorsnull input in the Lexer classview routes for project and task file browsingcreateProject and updateProject proceduresubuntu-24.04export-ignore the ChangeLogsymfony/service-contracts from 2.5.3 to 2.5.4symfony/event-dispatcher-contracts from 2.5.3 to 2.5.4symfony/deprecation-contracts from 2.5.3 to 2.5.4alpine from 3.20 to 3.21FileStorage (CVE-2024-51747)symfony/finder from 5.4.43 to 5.4.45symfony/stopwatch from 5.4.40 to 5.4.45apple-mobile-web-app-capable meta tagsymfony/finder from 5.4.40 to 5.4.42symfony/console from 5.4.40 to 5.4.41docker/build-push-action from 5 to 6project_id form value for addUser and addGroup actions (CVE-2024-36399)symfony/* dependenciescolor_id argument to createCategory and updateCategory API proceduresDASHBOARD_MAX_PROJECTSversion.txt during Git checkoutphpunit/phpunit from 9.6.15 to 9.6.16symfony/console from 5.4.32 to 5.4.34symfony/console from 5.4.28 to 5.4.32phpunit/phpunit from 9.6.13 to 9.6.15creator_id with the current logged user if the task is importedproject_id from task links (A few were missed in #4892)ProjectModelphpunit/phpunit and symfony/* dependenciesapt update before installing ApacheTaskMoveColumnClosed does not log column movementphpunit/phpunit from 9.6.9 to 9.6.10Improvements:
Bug fixes:
Breaking changes:
/var/www/app/{data,plugins}Bug fixes:
SESSION_DURATION option to define the session lifetime stored in the databasephpunit/phpunit from 9.6.6 to 9.6.8EVENT_MOVE_COLUMN event when moving task to another swimlanephpunit/phpunit, symfony/stopwatch, and symfony/finderGITHUB_TOKEN instead of a personal token to run GitHub ActionsImprovements:
Bug fixes:
New features:
Improvements:
Bug fixes:
New features:
Improvements:
Bug fixes:
TaskAssignDueDateOnMoveColumn actionphpunit/phpunit from 9.5.24 to 9.5.25symfony/stopwatch from 5.4.5 to 5.4.13version.txt to app foldermaster to mainphpunit/phpunit from 9.5.14 to 9.5.23symfony/finder from 5.4.3 to 5.4.11subtask_time_tracking table. The constraints references a no-longer-existing table task_has_subtasksproject_id from task URLsda_DK translationsproject_id for file attachments download URL (already checked elsewhere)LDAP_USER_CREATION in config.default.phpcall_user_func_array() calls to be compatible with PHP 8position argument to API procedure updateSubtask()symfony/stopwatch to 5.4.0pimple/pimple to 3.5.0MANIFEST.inLICENSE missing in PyPi distributioncreateLdapUser API procedure when LDAP groups are not configuredmodel:task:duplication:aftersaveBASE_DN optionalAssetHelper class for css() & js() functionsAPP_VERSION constantget_event_loop call when not in main thread<details> HTML elementNone beeing returnedsetup.pyclassifierspbr.travis.ymltox.ini and unit tests.htaccess to avoid potential issues with possible specific Apache configurations./kanboard to ./cliFor each subtask, the timer can be stopped/started at any time:
![]()
The timer starts automatically when you toggle the subtask status.
You can always replace the value calculated by editing the subtask or ignore that if you don't need this feature.
The settings option to enable/disable subtask time tracking is removed. It's always enabled now.
More information in the documentation

It's now possible to filter the email notifications, instead of receiving all emails, you can choose between several configurations:
The email template for task updates have been improved to show the differences.
There is also a direct link to the board in the email footer if you have defined an application URL in your settings.
It's now possible to send email with the HTTP API of Postmark, Sendgrid and Mailgun. Those integrations were already existing into Kanboard to receive incoming emails.
The main advantage of this method instead of the standard SMTP configuration is the speed. Opening SMTP sessions over TLS is slower than using a simple HTTPS request because the SMTP protocol is more verbose.
Like the iCal subscription, there is now a RSS feed by user. This subscription contains all activity events from the projects of the user.
Note: The URL of project feed have changed, don't forget to update your RSS reader.

The Javascript library used too draw charts have been replaced by C3JS. Diagrams are easier to generate and they are looking better.
Atlassian have updated the API of Bitbucket. Now, it's possible to receive commits, issues and comments from Bitbucket in Kanboard.
More automatic actions have been added, by example you can add a comment in Kanboard when you commit some changes related to a task.
It's now possible to configure recurring tasks in Kanboard. To fit with the Kanban methodology, the recurring tasks are not based on a date but on board events.
Such as Slack and Hipchat integrations, notifications can be sent to a Jabber chat room.
The source code behind the API has been refactored and new procedures have been added:
The API authentication can also be done with a custom HTTP header now.
You can create tasks directly by email now. There are several methods to do that, I choose the easiest method to implement: using a third-party service.
Basically, you have the choice between 3 SMTP providers:
These services handle incoming emails without having to configure any SMTP server. Emails are received by Kanboard via a webhook.
It's now possible to insert a screenshot or copy and paste any image directly in Kanboard. This feature is very useful for bug reports by example.
Note: This feature doesn't works with all browsers.
The burndown chart is available for each project. This diagram is a graphical representation of work left to do versus time.
The sum of task complexity is recorded for each day.
Daily project summaries include all tasks now, before it was only open tasks. Those data are used by the cumulative flow diagram.
The budget section is available for each project. The data used for the calculation come from the subtask time tracking, the user timetable and the user hourly rate.
When you start a new project you can define a budget line. Then Kanboard will calculate the cost for you based on the user timesheet.
Each user can have a different hourly rate, this feature is used for the budget calculation.
For each person, you can define a regular timetable for the week but also schedule time-off and overtime.
This data is also used in the calendar if you have enabled the subtask time tracking. The time spent takes into account the worked hours.
Each time you move a task to another column, Kanboard records this action in a seperate table now. So you have a better understanding of the history of the task.
If you use Slack or Hipchat, you can receive Kanboard notifications on your team channel.
Kanboard supports the two factor authentication by using the standard Time-based One-time Password Algorithm defined in the RFC 6238.
After each successful authentication, Kanboard will ask you a pin code generated by any TOTP compatible software.
There are many free and open source software available:
This method doesn't use any mobile phone and can be used offline.
getVersiongetAllSwimlanesgetSwimlanegetSwimlanesmoveSwimlaneUpmoveSwimlaneDownupdateSwimlaneaddSwimlaneremoveSwimlanedisableSwimlaneenableSwimlanegetAvailableActionsgetAvailableEventsgetCompatibleEventsgetActionscreateActionremoveActionYou can try Kanboard for free on Heroku cloud platform.
This setup use Postgresql and doesn't require any configuration, everything is done automatically.
Calendars are visible on the dashboard, in the project view and from the user page.
For now, tasks with a due date and subtask time tracking are shown (see below). Moving the task to another day change the due date.
Now, the filters hide the tasks instead of changing the opacity. Moreover, the user interface have been improved to be more flexible:

You can also filter by recently modified tasks.
New dropdown menu for quick actions:

Swimlanes can be hidden to save space on the screen:

When you have a lot of tasks on the board, it's very useful to collapse tasks:

This feature can be toggled by using the keyboard shortcut s or with the board menu.
A new dropdown menu is available for each task on the board for quick editing:

In one click, you can:
Now, you can link tasks together:

Default relationships are:
Those labels can be changed in the application settings.
Now, you can select which part of the project you want to copy:

Several keyboard shortcuts are introduced:
The subtask time tracking information are now synchronized with the task time spent and time estimated:

createLdapUser()getProjectActivity()getOverdueTasks()The user interface is more usable on tablets and smartphones. There is no more overlapping text. The board scroll horizontally.
It's not perfect on smartphone but you can navigate through the user interface without any problem.
LDAP_USERNAME_CASE_SENSITIVE to trueFILES_DIR and DEBUG_FILE
Boards can be divided into horizontal lanes. So you can have a better organization of your tasks.
By example, in software development you can separate different releases. Swimlanes are configurable in project settings.
Read the documentation about swimlanes for more details.
A new user role is introduced: Project manager.

Any standard users can be promoted project manager.
Read the documentation about project permissions for more details.
Symfony\EventDispatcher instead of my own dispatcherMonolog by my lightweight logging library SimpleLoggerKanboard got a lifting with this new version:

Some sections have been moved to focus on the most used features.
Improvements on the user interface are never done. The goal is to have a software that will be more efficient and more robust after each iteration.
Projects and subtasks with sorting and pagination have been added to the dashboard:

This version introduce 3 new graphs:

Symfony\Consoledata/debug.log with MonologThe version 1.0.10 requires at least PHP 5.3.7. That means a default PHP installation on Debian 6 Squeeze are not supported anymore.
Strict-Transport-Security HTTP headercloseTask and openTaskconfig.default.php