Redmine Release Notes

Redmine 7.0.0 has been released and it is available for download from Download. This release ships 122 issues, with "Webhooks triggers on evens" as major feature, Rails 8 migration, RTL improved support, header/navigation redesign, and continued UI modernization started in 6.0 and 6.1.

This release also marks 20 years since Redmine's first release in 2006 (r1 committed by Jean-Philippe Lang on 28.06.2006). Two decades later, the project is still actively maintained and improved thanks to a community of contributors, users, and companies who keep investing their time and effort into it. Thank you to everyone who has been part of this journey, from the very first commit to today!

Here is a breakdown of the key highlights included in Redmine 7.0.0:

1. Key feature

Redmine can trigger external webhooks on events (#29664). The feature is disabled by default and must be enabled by a system administrator from the new “Integration” tab.

2. Rails, Ruby and platform upgrades

• Redmine has been migrated to Rails 8 (#43205).
• Ruby 4.0 is now supported (#43650). Note: Ruby versions 4.0.0 to 4.0.3 have a significant wiki rendering slowdown caused by a regression in the Ruby runtime itself (#43737, tracked upstream at bugs.ruby-lang.org #21856). This was fixed upstream in Ruby 4.0.4, so we recommend running Redmine 7.0 on Ruby 4.0.4 or later.
• Several core dependencies have been updated, including Propshaft, Commonmarker, Rubyzip, Trilogy, Rouge, the pg and sqlite3 gems, and others.
• The Raphael.js dependency has been removed in favor of native SVG APIs (#43845).
• ChartJs has been upgraded and migrated to ES Modules (#44018).
• html-pipeline gem has been removed. Loofah is used now for HTML filtering, and Textile processing has been aligned with the same approach used for CommonMark (#42737, #43643). Some existing code related to text formatting have been moved to scrubbers (#43745).
• Deprecated icon-* CSS classes, kept temporarily since 6.0 for backward compatibility, have now been removed from core stylesheets and moved to legacy-icons-compat.css, completing the transition to Tabler SVG icons (#43206). The legacy CSS file still can be imported by theme or plugin developers using the standard import syntax.

3. UI / UX improvements

• Header redesign: A new navigation bar with a lighter visual weight (#43937), and the user-related links in the top menu have been replaced with a proper user menu (#31353).
• RTL support overhaul: Physical CSS properties have been replaced with logical ones across core stylesheets, rtl.css has been removed in favor of integrated overrides, and the Gantt chart and other views have been adapted for right-to-left layouts (#43506, #43515, #43700, #43678, #43822).
• Color Standardization via Open Color: The core styling framework now integrates Open Color to unify and standardize CSS colors natively across default elements (#43256).
• General visual cleanup: simplified fieldset borders, unified spacing around section separators, increased page padding, refined box-like UI elements, and aligned sidebar/pagination styling (#44111, #43836, #43824, #43575).
• File-type icons now replace the generic paperclip icon in attachment lists, with coverage extended to more MIME types (#43797, #43805).
• The Roadmap view now highlights the currently selected version (#39882).

4. Workflow and usability enhancements

• Assignee dropdown improvements : configurable users/groups ordering, "Users by group" display option (#43996, #44015, #4507).
• Users can opt in to be automatically added as watchers of issues they're assigned to (#2716).
• A new mail notification option for watched objects only has been added (#37978).
• Add / remove multiple users from a group (#43640).
• Default due date can now be set with a configurable offset from today (#31518), an option also extended to date format custom fields (#44129).
• Default value can be set for the private issue flag (#9432).
• Time span input (e.g. 0:45) is now supported in hours filters across issue and time entry queries (#43948, #43968).
• CSV export of project memberships is now available (#37480).
• All wiki pages of a project can now be exported as a ZIP archive (#43978).

5. Text formatting and preview

• Spreadsheet tables can now be pasted directly as CommonMark/Textile tables in wiki textareas (#43950), and Tab/Shift+Tab indentation is supported in CommonMark editing (#44061).
• Microsoft Office and LibreOffice Writer files can now be previewed directly (#8959), and PDF/repository file previews are shown inline instead of forcing a download (#22483).
• Image support preview has been added for AVIF (#43943) and SVG (#44126) images.
• Text documentation workflows are smoother with new support for block indentation inside CommonMark textareas using standard Tab and Shift+Tab keys (#44061).

6. API changes

• The project is now included in the wiki page API response (#43569).
• Custom Fields API now returns visible roles consistently and includes associated projects (#44152, #44153).

7. Performance improvements

• Resolving @login-style mentions used a case-insensitive query with no supporting database index, forcing a full table scan on every mention — a serious bottleneck on large instances like redmine.org. A proper index has been added and the lookup logic optimized accordingly (#43838).
• The @mention autocomplete now limits the number of initial suggestions shown (#44190) and caches autocomplete responses to avoid firing redundant requests as you type (#44194).
• Saving workflow transitions now uses hash-based lookups instead of repeatedly scanning the full transitions array, significantly speeding up workflow edits on instances with many statuses/roles (#43957).

8. Security improvements

• Sudo mode is now enabled by default (#44052).
• "Last usage" timestamp for API and Atom access keys have been added to user account (#43938).

For a detailed overview of all the improvements and fixes, please refer to the Changelog_7_0.

Redmine Version Status and Release Policy Updates

• Redmine 5.1 is now officially End of Life (EOL) and will no longer receive security or maintenance patches.
• Redmine 6.0 series transitions to our legacy stable branch.
• Redmine 6.1 and 7.0 series are the stable versions.
• Redmine 7.1.0 is the next major release.

Many thanks again to all contributors who made this release possible, especially Go MAEDA and his team, to Jens Krämer and Holger Just for their important contributions and everyone who dedicated their time and hard work to make this major milestone release happen!

Code cleanup/refactoring

• Defect #43985: Flaky IssuesSystemTest caused by !page.has_css?
• Defect #44010: Too much INFO log of asset paths when starting Rails

Documentation

• Defect #43906: Wiki help does not display localized content for locales with a region subtag
• Patch #43896: Remove obsolete db:migrate:upgrade_plugin_migrations step from doc/UPGRADING
• Patch #43930: Add blockquote formatting in CommonMark wiki help pages

Projects

• Defect #43910: Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations

Rails support

• Patch #43909: Update Rails to 7.2.3.1

SCM

• Patch #43966: Tighten SVN repository URL validation

Security

• Patch #43986: Improve the config.filter_parameters setting
• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

Translations

• Patch #44005: Fix French translation of label_auto_watch_on_issue_created

UI

• Defect #44170: Toggling between board and list in projects query do not work properly

Code cleanup/refactoring

• Defect #43985: Flaky IssuesSystemTest caused by !page.has_css?
• Defect #44010: Too much INFO log of asset paths when starting Rails
• Defect #44072: OauthProviderSystemTest#test_application_creation_and_authorization fails randomly
• Patch #44073: TimeEntryTest#test_should_not_accept_closed_issue fails randomly depending on locale

Documentation

• Defect #43906: Wiki help does not display localized content for locales with a region subtag
• Defect #43920: German and Tamil CommonMark wiki help pages lack the Alerts section
• Patch #43447: Update INSTALL document to mention additional_environment.rb
• Patch #43896: Remove obsolete db:migrate:upgrade_plugin_migrations step from doc/UPGRADING
• Patch #43897: Use bin/rails instead of rake in documentation
• Patch #43929: German translation for Alerts section on CommonMark wiki help page
• Patch #43930: Add blockquote formatting in CommonMark wiki help pages

Issues

• Defect #44042: Watchers section in the sidebar is incorrectly updated when watching a subtasks or related issue via context menu

Projects

• Defect #43910: Projects with the identifiers "autocomplete" or "bulk_destroy" cannot perform some operations

REST API

• Defect #43698: ArgumentError occurs on /oauth/authorize when REST API is disabled

Rails support

• Patch #43909: Update Rails to 7.2.3.1

SCM

• Defect #43964: IconsHelper#scm_change_icon ignores passed options
• Patch #43966: Tighten SVN repository URL validation

Security

• Patch #43986: Improve the config.filter_parameters setting
• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak
• Defect #44174: OAuth scope enforcement bypass in user account

Translations

• Defect #43921: Tamil CommonMark help page incorrectly translates CSS property names
• Patch #43922: Japanese translation update for recent_pages macro help on project and include_subprojects options
• Patch #44005: Fix French translation of label_auto_watch_on_issue_created

UI

• Defect #43984: Current page background in pagination overflows its border
• Defect #44069: Remove redundant underline from abbr elements
• Defect #44127: Replace legacy group avatar icon with SVG
• Defect #44170: Toggling between board and list in projects query do not work properly

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (6.1.3, 6.0.10, and 5.1.13) include the following security fixes:

• Defect #43951: Bulk attachment download bypasses View files permission for project/version attachments
• Defect #44109: PreAuth leak name of private Projects
• Defect #44118: Any project member with add_issue_notes permission can add notes to private issues they cannot view, via the MailHandler reply dispatch
• Defect #44138: Stored XSS in Textile formatter due to restore_redmine_links
• Defect #44145: PostScript execution in Redmine::Thumbnail.generate via %% DSC-comment prefix
• Defect #44146: Time-entry API hidden custom-field leak

Versions 6.1.3 and 6.0.10 also include:

• Patch #43986: Improve the config.filter_parameters setting

Version 6.1.3 also includes:

• Defect #44174: OAuth scope enforcement bypass in user account

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and to Holger Just, Jens Krämer, and to Go MAEDA for their continuous work on these security issues.

Security Fixes

All three versions (6.1.2, 6.0.9, and 5.1.12) include the following security fixes:

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43864 / #43840: Update Nokogiri to 1.18.9 (5.1.12) or 1.19.1 (6.1.2 and 6.0.9).

Maintenance Improvements

Redmine 6.1.2 includes a significant number of maintenance fixes (30 in total).

• A new series of fixes for RTL languages
• SVG Icons: Theme developers can now override the default icons sprite, please see #43087 for details
• recent_pages macro supports now include_subprojects parameter

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the security issues (Sho Odagiri and kaminuma).

Code cleanup/refactoring

• Patch #43872: Update GitHub Actions workflow dependencies

Database

• Patch #43668: Serialize address limit checks during email_addresses#create

Issues

• Feature #43837: Add a hint to the issue relation add form that clarifies multiple comma-separated issue IDs are accepted

Issues filter

• Patch #43736: author.group filter test fix

Issues list

• Defect #31972: An empty group_count badge is displayed when grouped with created_on

Permissions and roles

• Feature #43659: Set minimum width for Permission column in permission report

Security

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43840: Update Nokogiri to 1.19.1

Text formatting

• Defect #40918: Wiki "Edit this section" does not extract SeText headings correctly in CommonMark Markdown

UI

• Defect #43804: Custom field preview does not work on bulk issue edit
• Defect #43869: Default assignee selected by category is not shown in UI

Calendar

• Defect #43718: Issue beginning/ending arrows should be flipped in RTL calendars

Code cleanup/refactoring

• Patch #43649: Remove MySQL 5.7-related comments from database.yml.example
• Patch #43713: Add missing entries "apps" and "shield-check" to icon_source.yml
• Patch #43872: Update GitHub Actions workflow dependencies

Database

• Patch #43668: Serialize address limit checks during email_addresses#create

Issues

• Defect #33610: Submitting the issue edit form without changes unexpectedly updates updated_on
• Feature #43837: Add a hint to the issue relation add form that clarifies multiple comma-separated issue IDs are accepted

Issues filter

• Patch #43736: author.group filter test fix

Issues list

• Defect #31972: An empty group_count badge is displayed when grouped with created_on

Performance

• Defect #43651: Searching issues with searchable custom fields causes a performance regression on MySQL

Permissions and roles

• Feature #43659: Set minimum width for Permission column in permission report

Security

• Defect #43661: Unsafe eval usage in AttachmentsHelper
• Defect #43690: Directory Traversal via Backslash-Separated Paths in Filesystem SCM
• Defect #43691: DOM (Stored) XSS in @mention autocomplete via unescaped user name
• Defect #43692: LDAP Injection (Unescaped Input in LDAP Search Filter)
• Defect #43694: DOM XSS: HTML Injection via Custom Field Name in Query Filter Generation
• Defect #43830: User who is allowed to view only their own time entries can retrieve other users’ time entry details by directly specifying the TimeEntry ID via the REST API
• Defect #43840: Update Nokogiri to 1.19.1

Text formatting

• Defect #40918: Wiki "Edit this section" does not extract SeText headings correctly in CommonMark Markdown
• Defect #43662: Cursor may move to incorrect position when pasting inline images from clipboard

Themes

• Feature #43087: Allow to change icons sprites from theme

UI

• Defect #43664: Project menu tab left/right buttons are broken in RTL layout
• Defect #43672: Indent icons for subtasks and subprojects in list tables are misplaced in RTL layout
• Defect #43674: Unintended global ol styling in changeset CSS
• Defect #43675: "Add filter" dropdown in query form appears on the wrong side in RTL layout
• Defect #43714: Arrow buttons for Available/Selected columns are misleading in the issues query form on RTL layouts
• Defect #43715: Project selector does not indent subprojects in RTL layout
• Defect #43804: Custom field preview does not work on bulk issue edit
• Defect #43869: Default assignee selected by category is not shown in UI

Wiki

• Feature #43631: Add "include_subprojects" parameter to recent_pages macro to include pages from subprojects

6.1.2

CLOSED

2026-03-15

closed: 100%
100%

14 issues (14 closed — 0 open)

Issues by Tracker

• Defect 100% 10/10
• 10/10
• Feature 100% 2/2
• 2/2
• Patch 100% 2/2
• 2/2

Related issues

• Defect #33610: Submitting the issue edit form without changes unexpectedly updates updated_on
• Defect #43651: Searching issues with searchable custom fields causes a performance regression on MySQL
• Defect #43662: Cursor may move to incorrect position when pasting inline images from clipboard
• Defect #43664: Project menu tab left/right buttons are broken in RTL layout
• Defect #43672: Indent icons for subtasks and subprojects in list tables are misplaced in RTL layout
• Defect #43674: Unintended global ol styling in changeset CSS
• Defect #43675: "Add filter" dropdown in query form appears on the wrong side in RTL layout
• Defect #43714: Arrow buttons for Available/Selected columns are misleading in the issues query form on RTL layouts
• Defect #43715: Project selector does not indent subprojects in RTL layout
• Defect #43718: Issue beginning/ending arrows should be flipped in RTL calendars
• Feature #43087: Allow to change icons sprites from theme
• Feature #43631: Add "include_subprojects" parameter to recent_pages macro to include pages from subprojects
• Patch #43649: Remove MySQL 5.7-related comments from database.yml.example
• Patch #43713: Add missing entries "apps" and "shield-check" to icon_source.yml

Powered by Redmine © 2006-2023 Jean-Philippe Lang

6.0.8

CLOSED

100%

9 issues (9 closed — 0 open)

Issues by Tracker

• Defect
  • 100% 6/6
  • 6/6
• Patch
  • 100% 3/3
  • 3/3

Related issues

• Defect #43283: Overdue due date text does not turn light gray when issue is selected
• Defect #43378: Column headers are slightly shifted to the right in tables in list views
• Defect #43521: Saving a custom field fails with 500 when regular expression is invalid
• Defect #43525: "label_added" is not translated in the repository revision view legend
• Defect #43527: Login and Email columns are unexpectedly center-aligned on the Users page since Redmine 5.1
• Defect #43612: Inline code rendering does not preserve multiple spaces
• Patch #43275: Remove continue-on-error: true from the system test job in GitHub CI
• Patch #43490: Japanese translation update (jstoolbar-ja.js) for 6.0-stable
• Patch #43633: Update Rails to 7.2.3

6.1.1

CLOSED

closed: 100%

100%
36 issues (36 closed — 0 open)

Issues by Tracker

• Defect
  100% 22/22
  22/22

• Feature
  100% 3/3
  3/3

• Patch
  100% 11/11
  11/11

Related issues

• Defect #41680: Incorrect label/value order on the issue view in RTL layout
• Defect #43265: Automatic list marker does not work for task list items
• Defect #43282: Locked users are not shown in gray in the user list
• Defect #43409: Progress bar custom field shows only "%" instead of "0%" when value is nil
• Defect #43420: Markdown alerts are missing styling in email notifications
• Defect #43422: File format custom fields use legacy download icon instead of SVG icon
• Defect #43491: Fix incorrect link for the Japanese CommonMark Quick Reference
• Defect #43492: Initials avatar shrink in the Activity view when event titles are long
• Defect #43504: Unexpected file name shown when hovering over a link in the Files column
• Defect #43507: Markdown alerts do not respect RTL text direction
• Defect #43509: Avatar in issue view is positioned incorrectly in RTL layout
• Defect #43510: Reaction buttons are positioned incorrectly in RTL layout
• Defect #43511: "Lost password" link in login form is positioned incorrectly in RTL layout
• Defect #43512: Copy button on code blocks is positioned incorrectly in RTL layout
• Defect #43514: Legacy icons still displayed alongside new SVG icons on some RTL pages
• Defect #43520: Repository browser does not indent directory hierarchy in RTL layout
• Defect #43522: "Ratio interval" custom field label is not localized
• Defect #43523: Avatar layout breaks for initials icon in user import completion page
• Defect #43526: When using the include macro in the project description, an execution error occurs in the project list (list view)
• Defect #43591: Context menu is hidden behind sidebar in RTL layout
• Defect #43592: Ajax indicator is broken in RTL layouts
• Defect #43603: Delete link is missing from the context menu when using a relative URL root
• Feature #43234: Enable CJK-friendly emphasis extension for CommonMark
• Feature #43280: Improve visual distinction of link presence in SVG icons
• Feature #43425: Update colors of Markdown "Warning" and "Caution" alerts to be consistent with standards
• Patch #43257: Remove unused files related to the quote reply feature
• Patch #43326: Bulgarian translation update for 6.1-stable
• Patch #43328: List marker missing when regular items and task list items are mixed
• Patch #43370: Russian translation update for 6.1-stable
• Patch #43372: Allow macro recent_pages to display pages from a specific project
• Patch #43379: Localize default commonmark alert titles (note, tip, warning, caution and important)
• Patch #43400: Japanese translation update for 6.1-stable
• Patch #43433: Persian translation update for 6.1-stable
• Patch #43493: Japanese translation update (field_ratio_interval and setting_issue_done_ratio_interval)
• Patch #43620: Italian translation update for 6.1-stable
• Patch #43630: Traditional Chinese translation update for 6.1-stable

New maintenance releases for the Redmine 6.1, 6.0, and 5.1 series are now available to Download. These releases address three security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (6.1.1, 6.0.8, and 5.1.11) include the following security fixes:

• Defect #43451: PostScript disguised as PDF can lead to arbitrary file operations via thumbnail generation
• Defect #43634: Authorization bypass in Redmine allows modification of attachment metadata on invisible issues
• Defect #43635: Authorization bypass in Redmine allows deletion of attachment on invisible issues

Maintenance Improvements

Redmine 6.1.1 includes a significant number of maintenance fixes (34 in total), with a particular focus on the user interface:

• RTL Support: Numerous fixes for RTL layouts, including corrected positioning for reaction buttons, copy buttons, and avatars.
• Text Formatting: Improvements to CommonMark alerts, including localized titles (note, tip, warning, etc.), a new CJK-friendly emphasis extension and automatic list markers support for task list items (#43234, #43379, #43265).
• SVG Icons: Continued refinement of the new SVG icon system and visual consistency.

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the security issues (Elweth from YesWeHack and to Abor).

Happy New Year!