Redmine Release Notes

New maintenance releases for the Redmine 7.0 and 6.1 series are now available to Download, addressing security vulnerabilities along with various bug fixes and performance improvements.

Security Fixes

Both versions (7.0.2 and 6.1.5) include:

• Defect #44467: Private/invisible issue subjects leaked via REST API include=children
• Defect #44468: Private project names and role assignments leaked via GET /groups/.json?include=memberships
• Defect #44429: DOM-Based XSS via Clipboard HTML Paste

Key Improvements in 7.0.2

• Rails Support: Rails updated to 8.1.4 (7.0.2) and 7.2.4 (6.1.5).
• Webhooks: Added an administration page listing all webhooks (#44337) and fixed N+1 queries (#44386).
• Performance: Optimized SVG icon rendering with path caching (#44415, #44412) and fixed UI freezes on custom fields with thousands of values (#44372).
• UI & Responsive: Refreshed mobile header and flyout menu colors (#44444) and fixed autocomplete popup positioning (#44408).
• Attachments & SCM: Fixed Ghostscript timeout process leaks (#44378), SVN URLs containing spaces (#27043), and Git branches containing 40-character hex strings (#44476).

Download and Changelog:

Find the new packages in the Download section, see the full list of changes in the Changelog and the updated Security Advisories.

Many thanks to all contributors and security researchers who helped with these releases.

6.1.5 (2026-09-30)

Attachments

• Defect #44556: No error is shown when pasting an image after the limit of attachments at once is reached

Code cleanup/refactoring

• Defect #44438: DateCalculationTest is not run by rails test
• Defect #44527: Stubs of initialize_ldap_con in UserTest have no effect
• Patch #44392: Replace IO.read with File.read
• Patch #44455: Fix tests that fail when the date changes during a test run

Database

• Defect #44375: Concurrency problem in project deletion / project marking for deletion

Documentation

• Patch #44413: Document that Redmine does not start on Ruby 3.3.0

Issues

• Defect #44560: Issue creation fails when the default assignee is no longer assignable

LDAP

• Defect #44526: 500 error when the LDAP server is unreachable on macOS 26.7

Performance

• Feature #44415: Reduce icon rendering time by caching sprite paths

Plugin API

• Defect #37686: Plugin migrations are skipped or fail due to stale cached versions when a plugin is migrated more than once in the same process

Projects

• Defect #44462: Project list rows show the context menu cursor although no context menu is available

Rails support

• Patch #44524: Update Rails to 7.2.4

Security

• Defect #44467: Private/invisible issue subjects leaked via REST API include=children
• Defect #44468: Private project names + role assignments leaked via GET /groups/<id>.json?include=memberships

SCM

• Defect #27043: Subversion repositories with spaces in the root URL cause broken file and diff links on the revision page
• Defect #44476: Fails to fetch revisions if a Git branch name contains a 40-character hexadecimal string

Translations

• Defect #44418: Fix typo in Japanese translation of mail_body_account_information_external

Accounts / authentication

• Defect #44360: Lost password page is unreachable by admins when two-factor authentication setup is required
• Defect #44245: Password reset page exposes whether an email address is registered through different redirect behavior

Code cleanup/refactoring

• Patch #44330: Convert CRLF line endings to LF in three test fixture files

Email notifications

• Defect #44220: Backport password reset security notification does not include IP address

Permissions and roles

• Patch #44328: Reading issue categories should be granted by view_issues, not manage_categories

Rails support

• Patch #44304: Update Rails to 7.2.3.2

SCM

• Defect #44354: GitAdapterTest#test_diff_path_invalid fails with Git 2.55.0

Security

• Patch #44371: Filter key parameter from logging
• Defect #44249: API requests can affect a user's session and circumvent security policies
• Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
• Defect #44309: Nested issue-relations endpoints bypass source issue visibility
• Defect #44310: Child project inherit_members updates bypass member-management authorization

Text formatting

• Defect #13723: Collapse doesn't work with section edit link

Accounts / authentication

• Defect #44343: Deleting a user who has authorized an OAuth2 application fails with ActiveRecord::InvalidForeignKey
• Defect #44360: Lost password page is unreachable by admins when two-factor authentication setup is required
• Defect #44245: Password reset page exposes whether an email address is registered through different redirect behavior

Administration

• Defect #44273: Applications item is not highlighted in the administration menu

Attachments

• Defect #44216: Backport uploading files with excessively long extensions may fail

Code cleanup/refactoring

• Patch #44330: Convert CRLF line endings to LF in three test fixture files

Documentation

• Patch #44232: Document Ghostscript as an optional dependency in doc/INSTALL

Email notifications

• Defect #44220: Backport password reset security notification does not include IP address

Issues

• Defect #44258: Deleting an issue journal (note) shifts #note-N anchors of later journals, breaking existing links

Permissions and roles

• Patch #44328: Reading issue categories should be granted by view_issues, not manage_categories

Rails support

• Patch #44304: Update Rails to 7.2.3.2

SCM

• Defect #44223: Setup Subversion and Mercurial on GitHub Actions
• Defect #44354: GitAdapterTest#test_diff_path_invalid fails with Git 2.55.0

Security

• Patch #44371: Filter key parameter from logging
• Defect #44249: API requests can affect a user's session and circumvent security policies
• Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
• Defect #44309: Nested issue-relations endpoints bypass source issue visibility
• Defect #44310: Child project inherit_members updates bypass member-management authorization

Text formatting

• Defect #13723: Collapse doesn't work with section edit link

Translations

• Defect #44291: Fix typos and inconsistent "e-mail" spelling in Czech translation

UI

• Defect #44221: "Selected Columns" checkbox does not enable or disable the column lists on the new Gantt query form

New maintenance releases for the Redmine 7.0, 6.1, and 6.0 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (7.0.1, 6.1.4, and 6.0.11) include the following security fixes:

• Defect #44249: API requests can affect a user's session and circumvent security policies
• Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
• Defect #44309: Nested issue-relations endpoints bypass source issue visibility
• Defect #44310: Child project inherit_members updates bypass member-management authorization
• Patch #44371: Filter key parameter from logging

Maintenance Improvements

Redmine 7.0.1 is the first maintenance release for Redmine 7.0 and includes numerous fixes and improvements, notably:

• Rails Support: Rails updated to 8.1.3.1 (7.0.1) and 7.2.3.2 (6.1.4 and 6.0.11).
• Performance: Resolved a text formatting performance regression when containers have many attachments (#44348).
• Third-party libraries: Broken charts In Repository Statistics
• REST API: Added project information to the wiki page list API response (#44353).
• Authentication & Administration: Fixed user deletion when OAuth2 applications are authorized (#44343), prevented browsers from autofilling administrator passwords into user account forms (#44268), and fixed lost password access for 2FA-enforced admins (#44360).
• UI & Usability: Fixed journal #note-N link shifting upon deletion (#44258), Classic theme top menu positioning (#44351), wide tab bar wrapping issues (#44318), improved the highlight of the top menu (#44341), and the style of the newly account menu (#44293).

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and helped resolve them.

7.0.0

CLOSED

2026-06-30

closed: 100%

100%

122 issues (122 closed — 0 open)

Issues by Tracker

• Defect 100% 16/16
• 16/16
• Feature 100% 63/63
• 63/63
• Patch 100% 43/43
• 43/43

Related issues

Defect

• Defect #25114: Context menu is mispositioned when #content is relatively positioned by themes
• Defect #38055: Filter operator "doesn't contain" on custom fields ignores issues with no value
• Defect #38513: Incorrect case of MIME-Version email header field name
• Defect #41434: CSV import fails on CRLF files when first row has quoted field with newline
• Defect #42408: Typo in Javascript function name 'toggleExpendCollapseIcon': s//Expend/Expand
• Defect #43588: Right column in issue view uses splitcontentleft CSS class instead of splitcontentright
• Defect #43742: Missing #wrapper positioning may increase reflow cost
• Defect #43838: User mentions using the @login syntax cause performance issues when rendering content on instances with a large number of users.
• Defect #43876: Text in select, input, and button is clipped due to fixed height when font size is increased
• Defect #43965: "Previous" and "Next" links in changeset view do not match the changeset list order
• Defect #44029: Wide tables in attachment preview overflow the container border
• Defect #44126: SVG attachments are displayed as XML source instead of image previews
• Defect #44152: Custom Fields API does not return visible roles for custom fields other than issue custom fields
• Defect #44165: Basic authentication challenge is sent for API key authentication failures
• Defect #44173: Password reset security notification does not include IP address
• Defect #44186: Uploading files with excessively long extensions may fail

Feature

• Feature #2716: User option to automatically add assignee to watchers
• Feature #4507: Make first and last name field order follow Users display format setting
• Feature #8959: Preview support for Microsoft Office and LibreOffice Writer files
• Feature #9432: Default value for the private issue flag
• Feature #15167: Hide unused Options section in spent time report
• Feature #22483: Show PDF attachments and repo entries instead of downloading them
• Feature #29664: Webhook triggers in Redmine
• Feature #31353: Replace user related links in the top menu bar with a proper user menu.
• Feature #31518: Default due date for new issues with configurable offset from today
• Feature #34917: Use "Remove" instead of "Delete" for non-destructive unlink/removal action labels
• Feature #37480: CSV export of project memberships
• Feature #37978: Add a mail notification option for watched objects only
• Feature #39882: Highlight selected version on the Roadmap view
• Feature #42444: Allow use of the CSS text-decoration property in text formatting
• Feature #43085: Scroll to notes section instead of top of edit form when quoting issue content
• Feature #43205: Update to Rails 8
• Feature #43256: Introduce Open Color to unify and standardize CSS colors
• Feature #43279: Simplify fieldset borders in issue edit form
• Feature #43363: Improve error message display in imports view
• Feature #43381: Improve visibility of error message during file upload
• Feature #43390: Remove avatars-on / avatars-off classes from body element
• Feature #43397: Organize Gantt chart code by separating it into views and Stimulus controllers
• Feature #43506: Declare text direction on HTML element for better RTL/LTR styling support
• Feature #43515: Improve RTL layouts by removing rtl.css and integrating its overrides into application.css using CSS logical properties
• Feature #43563: Increase top padding of div#content to improve visual spacing and readability
• Feature #43569: Adds project to wiki page API response
• Feature #43575: Clean up box-like UI elements by adjusting borders and padding
• Feature #43615: Right-align all time-tracking columns in Issues list
• Feature #43650: Ruby 4.0 support
• Feature #43658: Add "Color" to the list of default gravatar options
• Feature #43678: Improve Gantt chart behavior in RTL environments
• Feature #43700: Improve RTL layout support by replacing physical CSS properties with logical ones in core CSS files
• Feature #43728: Change calendar today indicator from yellow background to blue date circle
• Feature #43797: Show file-type icons instead of paperclip icons in attachment lists
• Feature #43805: Update file-type icons for additional MIME types
• Feature #43808: Change default admin email to [email protected] for clarity
• Feature #43818: Show warning for closed projects on all project pages not only on Overview
• Feature #43824: Improve usability and visual appearance by increasing page-side spacing
• Feature #43825: Preserve checkbox selection in user search dialogs
• Feature #43836: Unify spacing around section separators on issue details page
• Feature #43885: Align issue previous/next link styling with pagination buttons
• Feature #43895: Disable "Use current date as start date for new issues" by default for new installations
• Feature #43918: Deprecate broken Mantis and Trac migration rake tasks
• Feature #43937: Redesign the header with a navigation bar and lighter visual weight
• Feature #43938: Track last usage of API and Atom access keys
• Feature #43943: AVIF images support
• Feature #43948: Allow 0:45h time span format input in the hours filter of TimeEntryQuery
• Feature #43950: Add support for pasting spreadsheet tables as CommonMark/Textile tables in wiki textareas
• Feature #43957: Improve workflow update performance
• Feature #43968: Allow 0:45h time span format input in the estimated_hours and spent_time filter of IssueQuery
• Feature #43969: Add icons to Add links in Subtasks and Related issues sections of the issue view
• Feature #43978: Export all Wiki pages as ZIP archive
• Feature #43988: Align sidebar selected link color with the main menu indicator
• Feature #43996: Add setting to choose users/groups order in assignee dropdown
• Feature #44013: Add links to groups in the project Settings > Members tab
• Feature #44015: "Users by group" display option for assignee drop-down
• Feature #44052: Enable sudo mode by default
• Feature #44061: Support Tab/Shift+Tab indentation of selected textarea lines in CommonMark Markdown
• Feature #44062: Add an Environment heading to the admin information page
• Feature #44071: Make context menu width flexible to avoid wrapping labels
• Feature #44129: Allow relative default values for date format custom fields
• Feature #44153: Include associated projects in issue custom fields API response
• Feature #44194: Cache user mention autocomplete responses to reduce redundant requests

Patch

• Patch #42737: Replacing html-pipeline with Loofah for HTML Filtering
• Patch #42762: Improve Git/Mercurial revision graph on the repository page
• Patch #43084: Add view_issues_edit_top hook to customize the issue editing form
• Patch #43206: Remove deprecated icon-* classes from stylesheets
• Patch #43276: Replace the use of form.text_area with form.textarea
• Patch #43289: Incorrect comments_count value in News fixture for news_001
• Patch #43321: Remove deprecated method ApplicationHelper#render_if_exist
• Patch #43323: Update RuboCop Performance to 1.26
• Patch #43324: Update Rubyzip to 3.4
• Patch #43388: Remove CSS hacks for Internet Explorer
• Patch #43395: Update roadie-rails to 3.4
• Patch #43396: Update propshaft to 1.3
• Patch #43408: Update Commonmark gem to 2.5
• Patch #43429: Remove unused method addable_watcher_users from acts_as_watchable.rb
• Patch #43437: Update RuboCop to 1.88
• Patch #43438: Update RuboCop Rails to 2.34
• Patch #43465: Update pg gem to 1.6
• Patch #43466: Update sqlite3 gem to 2.9
• Patch #43472: Update Mail gem to 2.9
• Patch #43594: Update Commonmarker gem to 2.8
• Patch #43640: Improve Group Controller – Enable Adding/Removing Multiple Users from Users View
• Patch #43643: Align the Textile processing approach with CommonMark by using Loofah
• Patch #43702: Remove unused CSS rules
• Patch #43745: Move parse_hires_images and parse_inline_attachments to scrubbers
• Patch #43800: Add local license files under doc/licenses for bundled third-party components
• Patch #43802: Avoid using non-reserved domain names in examples and tests
• Patch #43822: Use logical CSS property in CommonMark help examples for RTL support
• Patch #43845: Remove the Raphael.js dependency by switching to SVG API
• Patch #43931: Remove .github/PULL_REQUEST_TEMPLATE.md as pull requests are disabled
• Patch #43934: Optimize Issue#visible_journals_with_index preload to skip user email_address when Gravatar is disabled
• Patch #43981: Update net-ldap to 0.20
• Patch #44018: Update Chart.js to 4.5.1 and migrate to ES Modules
• Patch #44032: Update Trilogy gem to 2.12
• Patch #44038: Update Tabler Icons to v3.43.0
• Patch #44065: Remove unused i18n keys
• Patch #44074: ignored and unnecessary scope in twofa token lookup
• Patch #44111: Improve layout consistency of roadmap, news, and documents index pages
• Patch #44117: Remove obsolete .hgignore file
• Patch #44139: Update Rouge to 5.0
• Patch #44169: Refactor context menus controller to namespaced sub-controllers
• Patch #44190: Improve @mention performance by limiting initial suggestions
• Patch #44195: Add __pycache__ directory to .gitignore
• Patch #44200: Update I18n gem to 1.15

Redmine 7.0.0 has been released and it is available for download from Download. This release ships 122 issues, with "Webhooks triggers on evens" as major feature, Rails 8 migration, RTL improved support, header/navigation redesign, and continued UI modernization started in 6.0 and 6.1.

This release also marks 20 years since Redmine's first release in 2006 (r1 committed by Jean-Philippe Lang on 28.06.2006). Two decades later, the project is still actively maintained and improved thanks to a community of contributors, users, and companies who keep investing their time and effort into it. Thank you to everyone who has been part of this journey, from the very first commit to today!

Here is a breakdown of the key highlights included in Redmine 7.0.0:

1. Key feature

Redmine can trigger external webhooks on events (#29664). The feature is disabled by default and must be enabled by a system administrator from the new “Integration” tab.

2. Rails, Ruby and platform upgrades

• Redmine has been migrated to Rails 8 (#43205).
• Ruby 4.0 is now supported (#43650). Note: Ruby versions 4.0.0 to 4.0.3 have a significant wiki rendering slowdown caused by a regression in the Ruby runtime itself (#43737, tracked upstream at bugs.ruby-lang.org #21856). This was fixed upstream in Ruby 4.0.4, so we recommend running Redmine 7.0 on Ruby 4.0.4 or later.
• Several core dependencies have been updated, including Propshaft, Commonmarker, Rubyzip, Trilogy, Rouge, the pg and sqlite3 gems, and others.
• The Raphael.js dependency has been removed in favor of native SVG APIs (#43845).
• ChartJs has been upgraded and migrated to ES Modules (#44018).
• html-pipeline gem has been removed. Loofah is used now for HTML filtering, and Textile processing has been aligned with the same approach used for CommonMark (#42737, #43643). Some existing code related to text formatting have been moved to scrubbers (#43745).
• Deprecated icon-* CSS classes, kept temporarily since 6.0 for backward compatibility, have now been removed from core stylesheets and moved to legacy-icons-compat.css, completing the transition to Tabler SVG icons (#43206). The legacy CSS file still can be imported by theme or plugin developers using the standard import syntax.

3. UI / UX improvements

• Header redesign: A new navigation bar with a lighter visual weight (#43937), and the user-related links in the top menu have been replaced with a proper user menu (#31353).
• RTL support overhaul: Physical CSS properties have been replaced with logical ones across core stylesheets, rtl.css has been removed in favor of integrated overrides, and the Gantt chart and other views have been adapted for right-to-left layouts (#43506, #43515, #43700, #43678, #43822).
• Color Standardization via Open Color: The core styling framework now integrates Open Color to unify and standardize CSS colors natively across default elements (#43256).
• General visual cleanup: simplified fieldset borders, unified spacing around section separators, increased page padding, refined box-like UI elements, and aligned sidebar/pagination styling (#44111, #43836, #43824, #43575).
• File-type icons now replace the generic paperclip icon in attachment lists, with coverage extended to more MIME types (#43797, #43805).
• The Roadmap view now highlights the currently selected version (#39882).

4. Workflow and usability enhancements

• Assignee dropdown improvements : configurable users/groups ordering, "Users by group" display option (#43996, #44015, #4507).
• Users can opt in to be automatically added as watchers of issues they're assigned to (#2716).
• A new mail notification option for watched objects only has been added (#37978).
• Add / remove multiple users from a group (#43640).
• Default due date can now be set with a configurable offset from today (#31518), an option also extended to date format custom fields (#44129).
• Default value can be set for the private issue flag (#9432).
• Time span input (e.g. 0:45) is now supported in hours filters across issue and time entry queries (#43948, #43968).
• CSV export of project memberships is now available (#37480).
• All wiki pages of a project can now be exported as a ZIP archive (#43978).

5. Text formatting and preview

• Spreadsheet tables can now be pasted directly as CommonMark/Textile tables in wiki textareas (#43950), and Tab/Shift+Tab indentation is supported in CommonMark editing (#44061).
• Microsoft Office and LibreOffice Writer files can now be previewed directly (#8959), and PDF/repository file previews are shown inline instead of forcing a download (#22483).
• Image support preview has been added for AVIF (#43943) and SVG (#44126) images.
• Text documentation workflows are smoother with new support for block indentation inside CommonMark textareas using standard Tab and Shift+Tab keys (#44061).

6. API changes

• The project is now included in the wiki page API response (#43569).
• Custom Fields API now returns visible roles consistently and includes associated projects (#44152, #44153).

7. Performance improvements

• Resolving @login-style mentions used a case-insensitive query with no supporting database index, forcing a full table scan on every mention — a serious bottleneck on large instances like redmine.org. A proper index has been added and the lookup logic optimized accordingly (#43838).
• The @mention autocomplete now limits the number of initial suggestions shown (#44190) and caches autocomplete responses to avoid firing redundant requests as you type (#44194).
• Saving workflow transitions now uses hash-based lookups instead of repeatedly scanning the full transitions array, significantly speeding up workflow edits on instances with many statuses/roles (#43957).

8. Security improvements

• Sudo mode is now enabled by default (#44052).
• "Last usage" timestamp for API and Atom access keys have been added to user account (#43938).

For a detailed overview of all the improvements and fixes, please refer to the Changelog_7_0.

Redmine Version Status and Release Policy Updates

• Redmine 5.1 is now officially End of Life (EOL) and will no longer receive security or maintenance patches.
• Redmine 6.0 series transitions to our legacy stable branch.
• Redmine 6.1 and 7.0 series are the stable versions.
• Redmine 7.1.0 is the next major release.

Many thanks again to all contributors who made this release possible, especially Go MAEDA and his team, to Jens Krämer and Holger Just for their important contributions and everyone who dedicated their time and hard work to make this major milestone release happen!

Code cleanup/refactoring

• Defect #43985: Flaky IssuesSystemTest caused by !page.has_css?
• Defect #44010: Too much INFO log of asset paths when starting Rails

Documentation

• Defect #43906: Wiki help does not display localized content for locales with a region subtag
• Patch #43896: Remove obsolete db:migrate:upgrade_plugin_migrations step from doc/UPGRADING
• Patch #43930: Add blockquote formatting in CommonMark wiki help pages

Projects

• Defect #43910: Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations

Rails support

• Patch #43909: Update Rails to 7.2.3.1

SCM

• Patch #43966: Tighten SVN repository URL validation

Security

• Patch #43986: Improve the config.filter_parameters setting
• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

Translations

• Patch #44005: Fix French translation of label_auto_watch_on_issue_created

UI

• Defect #44170: Toggling between board and list in projects query do not work properly

Code cleanup/refactoring

• Defect #43985: Flaky IssuesSystemTest caused by !page.has_css?
• Defect #44010: Too much INFO log of asset paths when starting Rails
• Defect #44072: OauthProviderSystemTest#test_application_creation_and_authorization fails randomly
• Patch #44073: TimeEntryTest#test_should_not_accept_closed_issue fails randomly depending on locale

Documentation

• Defect #43906: Wiki help does not display localized content for locales with a region subtag
• Defect #43920: German and Tamil CommonMark wiki help pages lack the Alerts section
• Patch #43447: Update INSTALL document to mention additional_environment.rb
• Patch #43896: Remove obsolete db:migrate:upgrade_plugin_migrations step from doc/UPGRADING
• Patch #43897: Use bin/rails instead of rake in documentation
• Patch #43929: German translation for Alerts section on CommonMark wiki help page
• Patch #43930: Add blockquote formatting in CommonMark wiki help pages

Issues

• Defect #44042: Watchers section in the sidebar is incorrectly updated when watching a subtasks or related issue via context menu

Projects

• Defect #43910: Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations

REST API

• Defect #43698: ArgumentError occurs on /oauth/authorize when REST API is disabled

Rails support

• Patch #43909: Update Rails to 7.2.3.1

SCM

• Defect #43964: IconsHelper#scm_change_icon ignores passed options
• Patch #43966: Tighten SVN repository URL validation

Security

• Patch #43986: Improve the config.filter_parameters setting
• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak
• Defect #44174: OAuth scope enforcement bypass in user account

Translations

• Defect #43921: Tamil CommonMark help page incorrectly translates CSS property names
• Patch #43922: Japanese translation update for recent_pages macro help on project and include_subprojects options
• Patch #44005: Fix French translation of label_auto_watch_on_issue_created

UI

• Defect #43984: Current page background in pagination overflows its border
• Defect #44069: Remove redundant underline from abbr elements
• Defect #44127: Replace legacy group avatar icon with SVG
• Defect #44170: Toggling between board and list in projects query do not work properly

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (6.1.3, 6.0.10, and 5.1.13) include the following security fixes:

• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

Versions 6.1.3 and 6.0.10 also include:

• Patch #43986: Improve the config.filter_parameters setting

Version 6.1.3 also includes:

• Defect #44174: OAuth scope enforcement bypass in user account

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to Holger Just, Jens Krämer, and to Go MAEDA for their continuous work on these security issues.

Security Fixes

All three versions (6.1.2, 6.0.9, and 5.1.12) include the following security fixes:

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43864 / #43840: Update Nokogiri to 1.18.9 (5.1.12) or 1.19.1 (6.1.2 and 6.0.9).

Maintenance Improvements

Redmine 6.1.2 includes a significant number of maintenance fixes (30 in total).

• A new series of fixes for RTL languages
• SVG Icons: Theme developers can now override the default icons sprite, please see #43087 for details
• recent_pages macro supports now include_subprojects parameter

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the security issues (Sho Odagiri and kaminuma).

Code cleanup/refactoring

• Patch #43872: Update GitHub Actions workflow dependencies

Database

• Patch #43668: Serialize address limit checks during email_addresses#create

Issues

• Feature #43837: Add a hint to the issue relation add form that clarifies multiple comma-separated issue IDs are accepted

Issues filter

• Patch #43736: author.group filter test fix

Issues list

• Defect #31972: An empty group_count badge is displayed when grouped with created_on

Permissions and roles

• Feature #43659: Set minimum width for Permission column in permission report

Security

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43840: Update Nokogiri to 1.19.1

Text formatting

• Defect #40918: Wiki "Edit this section" does not extract SeText headings correctly in CommonMark Markdown

UI

• Defect #43804: Custom field preview does not work on bulk issue edit
• Defect #43869: Default assignee selected by category is not shown in UI

Calendar

• Defect #43718: Issue beginning/ending arrows should be flipped in RTL calendars

Code cleanup/refactoring

• Patch #43649: Remove MySQL 5.7-related comments from database.yml.example
• Patch #43713: Add missing entries "apps" and "shield-check" to icon_source.yml
• Patch #43872: Update GitHub Actions workflow dependencies

Database

• Patch #43668: Serialize address limit checks during email_addresses#create

Issues

• Defect #33610: Submitting the issue edit form without changes unexpectedly updates updated_on
• Feature #43837: Add a hint to the issue relation add form that clarifies multiple comma-separated issue IDs are accepted

Issues filter

• Patch #43736: author.group filter test fix

Issues list

• Defect #31972: An empty group_count badge is displayed when grouped with created_on

Performance

• Defect #43651: Searching issues with searchable custom fields causes a performance regression on MySQL

Permissions and roles

• Feature #43659: Set minimum width for Permission column in permission report

Security

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43840: Update Nokogiri to 1.19.1

Text formatting

• Defect #40918: Wiki "Edit this section" does not extract SeText headings correctly in CommonMark Markdown
• Defect #43662: Cursor may move to incorrect position when pasting inline images from clipboard

Themes

• Feature #43087: Allow to change icons sprites from theme

UI

• Defect #43664: Project menu tab left/right buttons are broken in RTL layout
• Defect #43672: Indent icons for subtasks and subprojects in list tables are misplaced in RTL layout
• Defect #43674: Unintended global ol styling in changeset CSS
• Defect #43675: "Add filter" dropdown in query form appears on the wrong side in RTL layout
• Defect #43714: Arrow buttons for Available/Selected columns are misleading in the issues query form on RTL layouts
• Defect #43715: Project selector does not indent subprojects in RTL layout
• Defect #43804: Custom field preview does not work on bulk issue edit
• Defect #43869: Default assignee selected by category is not shown in UI

Wiki

• Feature #43631: Add "include_subprojects" parameter to recent_pages macro to include pages from subprojects

6.1.2

CLOSED

2026-03-15

closed: 100%
100%

14 issues (14 closed — 0 open)

Issues by Tracker

• Defect 100% 10/10
• 10/10
• Feature 100% 2/2
• 2/2
• Patch 100% 2/2
• 2/2

Related issues

• Defect #33610: Submitting the issue edit form without changes unexpectedly updates updated_on
• Defect #43651: Searching issues with searchable custom fields causes a performance regression on MySQL
• Defect #43662: Cursor may move to incorrect position when pasting inline images from clipboard
• Defect #43664: Project menu tab left/right buttons are broken in RTL layout
• Defect #43672: Indent icons for subtasks and subprojects in list tables are misplaced in RTL layout
• Defect #43674: Unintended global ol styling in changeset CSS
• Defect #43675: "Add filter" dropdown in query form appears on the wrong side in RTL layout
• Defect #43714: Arrow buttons for Available/Selected columns are misleading in the issues query form on RTL layouts
• Defect #43715: Project selector does not indent subprojects in RTL layout
• Defect #43718: Issue beginning/ending arrows should be flipped in RTL calendars
• Feature #43087: Allow to change icons sprites from theme
• Feature #43631: Add "include_subprojects" parameter to recent_pages macro to include pages from subprojects
• Patch #43649: Remove MySQL 5.7-related comments from database.yml.example
• Patch #43713: Add missing entries "apps" and "shield-check" to icon_source.yml

Powered by Redmine © 2006-2023 Jean-Philippe Lang