DryTrix Release Notes

docs: bump version references to 5.18.2 (Dries Peeters)

fix(security): harden OIDC fetch URL and API error responses (Dries Peeters)

fix(security): centralize safe_redirect and close residual CodeQL sinks (Dries Peeters)

fix(security): finish CodeQL security alert remediation (Dries Peeters)

fix(security): clear CodeQL code-scanning findings (Dries Peeters)

ci: add CodeQL workflow to resume code scanning (Dries Peeters)

fix(security): harden DOM sinks and stop leaking bulk-delete errors (Dries Peeters)

fix(security): vendor patched sprintf-js for Dependabot #222 (Dries Peeters)

fix(docker): refresh base packages and upgrade pip/setuptools (Dries Peeters)

fix(security): avoid DOM XSS from untrusted strings in UI JS (Dries Peeters)

fix(security): harden PDF templates and stop leaking exceptions (Dries Peeters)

fix(security): block open redirects via referrer and next params (Dries Peeters)

fix: add CSP nonces to remaining inline scripts (Dries Peeters)

fix: import db in timer review and idle-response handlers (Dries Peeters)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

docs: bump version references to 5.18.1 (Dries Peeters)

fix idle regressions after #779/#781 and run releases only on version tags (Dries Peeters)

test(idle): cover idle-response semantics (first-answer-wins, tokens, credit math) (Giorgio)

refactor(mobile): mobile app follows the server-authoritative idle check (#722) (Giorgio)

fix(mobile): make idle prompt notification actionable on Android (Giorgio)

feat(idle): server-authoritative Still working? protocol (#722) (Giorgio)

fix(timer): render Confirm Changes summary as HTML in edit dialog (#777) (Giorgio)

fix(server): stop single eventlet worker from wedging on DB waits (Giorgio)

Gusto: send X-Gusto-API-Version on API requests (Taulant Shatri)

Fix Railyard badge link case in README (Dries Peeters)

chore(deps): bump source-map-js (dependabot[bot])

chore(deps): bump werkzeug (dependabot[bot])

Add Deploy to Railyard button (almokhtar-oss)

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates (dependabot[bot])

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore: bump version to 5.18.0 and update docs (Dries Peeters)

• Fix Android Chromium freeze from Flatpickr mobile-mode init loop (#771). (Dries Peeters)
• Fix instance audit 500s, API edge cases, and smoke-test reliability. (Dries Peeters)
• Add TimeTracker footer watermark to exported PDFs. (Dries Peeters)
• feat(observability): add request IDs, hardening metrics, and Sentry hooks (Dries Peeters)
• ci: add Bandit and pip-audit gates and raise the coverage floor (Dries Peeters)
• chore(ops): harden readiness probes, migrations, and production defaults (Dries Peeters)
• fix(data): harden invoice numbering, timers, and scheduler leadership (Dries Peeters)
• fix(security): harden redirects, SSRF, session rollback, and HTTP timeouts (Dries Peeters)
• chore(deps): bump pyjwt (dependabot[bot])
• chore(deps-dev): bump electron (dependabot[bot])
• docs: restructure README for conversion and add in-app star prompts (Dries Peeters)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

Chore

chore: bump version to 5.17.0 and update docs (Dries Peeters)

Feat

feat: ship gap-roadmap Phase 4/5 foundations and hygiene cleanup (Dries Peeters)

Fix

fix(invoices): harden Factur-X/ZUGFeRD PDF/A-3 compliance (#433) (Dries Peeters)

Feat

feat(idle): add admin choice for unanswered Still working? prompts (#722) (Dries Peeters)

Feat

feat(timer): allow start time override from dashboard Start Timer modal (#760) (Dries Peeters)

Build Status

Desktop Applications

✅ Windows build: Success
✅ Linux build: Success
✅ macOS build: Success

Mobile Applications

✅ Android build: Success
✅ iOS build: Success

Chore

chore: bump version to 5.16.0 and update docs (Dries Peeters)

Features

feat(payroll): add Gusto and ADP connectors with sync logging (Dries Peeters)

feat(crm): sync Gmail and Outlook threads into clients, leads, deals (Dries Peeters)

feat(integrations): add Sage Business Cloud and DATEV accounting (Dries Peeters)

feat(api): add client portal REST endpoints under /api/v1/portal (Dries Peeters)

feat(portal): add client–team messaging hub (Dries Peeters)

feat(workflows): add visual builder for trigger/condition/action graphs (Dries Peeters)

feat(invoices): make create and edit forms mobile-friendly (Dries Peeters)

feat(portal): resolve custom domains and brand portal login (Dries Peeters)

feat: add ship-week and sprint product gaps (Dries Peeters)

feat(support): add milestone celebration modal and clearer key CTA copy (Dries Peeters)

Chore

chore(deps-dev): bump js-yaml (dependabot[bot])

Build Status

Desktop Applications

✅ Windows build: Success

✅ Linux build: Success

✅ macOS build: Success

Mobile Applications

✅ Android build: Success

✅ iOS build: Success

chore: release 5.15.0 — timer override, Pomodoro, expense lifecycle, payroll templates, geofencing, gamification, calendar DnD, shareable reports, recurring costs (Dries Peeters)

fix(dashboard): use correct timer_page endpoint for Open timer link (Dries Peeters)

fix(migrations): use boolean literals for PostgreSQL server defaults (Dries Peeters)

feat(timer): allow overriding start time when starting or while running (#760) (Dries Peeters)

fix(inventory): correct PO line stock IDs and restore edit form (#759) (Dries Peeters)

feat(mobile): extend API client for expenses, reports, and geofencing (Dries Peeters)

feat: register gap features and surface them on the dashboard (Dries Peeters)

feat(api): expose focus, recurring-cost, and shared-report endpoints (Dries Peeters)

feat(admin): add payroll template and geofence management pages (Dries Peeters)

feat(integrations): add ActivityWatch rules/inbox and sync-error routes (Dries Peeters)

feat(attendance): add geofencing policies for workday clock-in (Dries Peeters)

feat(reports): add public tokenized shareable report links (Dries Peeters)

feat(projects): add recurring project cost engine (Dries Peeters)

feat(calendar): enable drag-and-drop move and resize for events (Dries Peeters)

feat(gamification): expose badges, leaderboards, and award hooks (Dries Peeters)

feat(activitywatch): add rules, merge filters, and review inbox (Dries Peeters)

feat(integrations): deepen QuickBooks and Xero sync coverage (Dries Peeters)

feat(payroll): add configurable payroll export templates (Dries Peeters)

feat(finance): add expense lifecycle parity on mobile and desktop (Dries Peeters)

feat(focus): wire Pomodoro sessions into APIs and timer UI (Dries Peeters)

feat: add models and migrations for product gap backlog (Dries Peeters)

chore(deps): bump weasyprint in the pip group across 1 directory (dependabot[bot])

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore: release 5.14.1 — Docker base image fix (Dries Peeters)

fix(docker): upgrade base images to fix expired Bullseye security repo (Dries Peeters)

chore: release 5.14.0 — OrcaRouter AI provider (Dries Peeters)

feat(ai): add OrcaRouter as a named hosted AI provider (Dries Peeters)

chore(release): bump version to 5.13.5 and update docs (Dries Peeters)

fix(timezone): accept plain date in local_date formatting (Dries Peeters)

fix(manual-entry): restore single-client lock by dropping force_selectable (MacJediWizard)

fix(idle): exclude paused timers from the idle auto-stop sweep (MacJediWizard)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore(release): bump version to 5.13.4 and update docs (Dries Peeters)

docs(release): fold post-merge fixes into 5.13.3 notes (Dries Peeters)

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates (dependabot[bot])

docs(changelog): unreleased entries for 746 offline fixes, onboarding tour fix, idle needs-review flow (Giorgio)

feat(idle): port needs-review flow for unanswered idle timers from mobile-client-v2 (Giorgio)

fix(web): graceful frontend handling when backend goes down (Giorgio)

chore(deps): bump fast-uri (dependabot[bot])

chore(release): bump version to 5.13.3 and update docs (Dries Peeters)

fix(idle): enforce Still working? timeout across clients (#722) (Dries Peeters)

fix(pwa): stop SW fake 503s after tab idle (#746) (Dries Peeters)

feat(tasks): show tracked time on list and detail views (#745) (Dries Peeters)

chore(ci): fix pre-existing flake8 W391 and missing script nonces on main (Giorgio)

fix(timeformat): make datetime-local inputs honor the chosen time format (Giorgio)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

docs(release): fold post-merge fixes into 5.13.3 notes (Dries Peeters)

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates (dependabot[bot])

docs(changelog): unreleased entries for 746 offline fixes, onboarding tour fix, idle needs-review flow (Giorgio)

feat(idle): port needs-review flow for unanswered idle timers from mobile-client-v2 (Giorgio)

fix(web): graceful frontend handling when backend goes down (Giorgio)

chore(deps): bump fast-uri (dependabot[bot])

chore(release): bump version to 5.13.3 and update docs (Dries Peeters)

fix(idle): enforce Still working? timeout across clients (#722) (Dries Peeters)

fix(pwa): stop SW fake 503s after tab idle (#746) (Dries Peeters)

feat(tasks): show tracked time on list and detail views (#745) (Dries Peeters)

chore(ci): fix pre-existing flake8 W391 and missing script nonces on main (Giorgio)

fix(timeformat): make datetime-local inputs honor the chosen time format (Giorgio)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore(release): bump version to 5.13.2 and update docs (Dries Peeters)

feat(integrations): export all connectors and add Linear setup wizard (Dries Peeters)
fix(android): sign release APKs with a stable CI keystore (Dries Peeters)
fix(web): manual entry cascading pickers, inline create flow, dark-mode comboboxes (#728) (Giorgio)
docs(changelog): mention project-first selection with client auto-fill (Giorgio)
feat(mobile): allow project-first selection with client auto-fill (Giorgio)
docs(changelog): document mobile start timer fixes; test last_used_at parsing (Giorgio)
fix(mobile): stop/pause buttons flashing disabled while timer polls (Giorgio)
fix(mobile): unwrap nested payload when creating client/project/task (Giorgio)
fix(mobile): crash when opening start timer sheet (Giorgio)
fix(mobile): unify start timer flow with cascading pickers and inline creation (Giorgio)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore(release): bump version to 5.13.1 and update docs (Dries Peeters)

Restore extension Create project client guard after last-used sort. (Dries Peeters)

Sort project lists by most recently used first. (Dries Peeters)

Fix Issue #728 combobox blur reset and extension create-project guard. (Dries Peeters)

Fix idle timeout recording 0 minutes and missing Still working? prompts (#722). (Dries Peeters)

Fix Issue #728 leftover picker bugs: no auto-selected project, require a client to create one, and translate Create labels. (Dries Peeters)

Attach a Chrome extension zip to every GitHub release. (Dries Peeters)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore(release): bump version to 5.13.0 and update docs (Dries Peeters)

Improve UX across dashboard, lists, timer bar, and productivity views. (Dries Peeters)

Add backend support for dashboard alerts, timer switch, and productivity breakdown. (Dries Peeters)

Fix productivity heatmap and empty_state template errors. (Dries Peeters)

Resolve invoice tax rate and currency from project/client settings. (Dries Peeters)

Declutter navigation and improve mobile More drawer. (Dries Peeters)

Enhance recurring tasks list with filters, toggles, and run-now. (Dries Peeters)

Add dashboard quick log time and tasks due today widgets. (Dries Peeters)

Improve floating timer bar and idle-stop UX. (Dries Peeters)

fix: log swallowed errors and surface user feedback where actionable (Dries Peeters)

feat(timer): warn on long-running entries and show workday progress (Dries Peeters)

feat(dashboard): add daily progress widget and quick-start timer strip (Dries Peeters)

feat(mobile): expand bottom nav More drawer with key destinations (Dries Peeters)

chore(static): add missing favicon, apple touch icon, and OG image (Dries Peeters)

fix(portal): add missing client portal customization admin template (Dries Peeters)

fix(recurring-tasks): complete CRUD flow and add sidebar navigation (Dries Peeters)

Improve support incentives with Supporter identity and smarter prompts. (Dries Peeters)

fix(timer): keep heartbeats alive and stop at idle boundary (#736) (Dries Peeters)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success

chore(release): bump version to 5.12.0 (Dries Peeters)

feat(projects): add project health dashboard and API (Dries Peeters)

feat(team): add weekly resource scheduling swimlane view (Dries Peeters)

feat(quotes): support digital signatures in the client portal (Dries Peeters)

feat(expenses): add manager approval queue with pending badge (Dries Peeters)

feat(reports): add billable utilization report and dashboard widget (Dries Peeters)

feat(projects): add milestones for project checkpoints (Dries Peeters)

feat(tasks): add task dependencies with Gantt links (Dries Peeters)

fix(dashboard): restore Start Timer modal click handlers (Dries Peeters)

fix(approvals): normalize PostgreSQL approvalstatus enum case (Dries Peeters)

📦 Build Status

Desktop Applications

• ✅ Windows build: Success
• ✅ Linux build: Success
• ✅ macOS build: Success

Mobile Applications

• ✅ Android build: Success
• ✅ iOS build: Success