* bump version * fix formatting locale reset after embedded controller sub-requests (#5944) * fix GHSA-c6w6-57jj-62vh * fix GHSA-m492-gv72-xvxj * fix GHSA-jr9p-4h4j-6c58 * make sure to only use JS logic to call API endpoints * fixes GHSA-r8vr-m544-qh4h * make sure to only use JS logic to call API endpoints * fix GHSA-rw46-qg69-vg6h * fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown * fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images * fix GHSA-xv4r-4885-gwpg * fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF * fix tooltip survives page reload * updated wizard images * split wizard and password reset subscriber into two classes * relax upper php limit * added zizmor workflow scans and apply findings * user permissions <name>_other_profile now respect teams * move all linting steps to new job * updated docker image version names * use .env.local for storing APP_SECRET * improve build order and use given tag as ref for checkout, not default main branch * improved APP_SECRET handling, see entrypoint.sh * use local code for building the image for more flexibility, added dockerignore
4.3 KiB
Upgrading Kimai - Version 2.x
Make sure to create a backup before you start!
Read the updates documentation to find out how you can upgrade your Kimai installation to the latest stable release.
Check below if there are more version specific steps required, which need to be executed after the normal update process. Perform EACH version specific task between your version and the new one, otherwise you risk data inconsistency or a broken installation.
2.58.0
The official Docker image no longer runs with the default APP_SECRET=change_this_to_something_unique.
If you did not explicitly set your own APP_SECRET (via -e APP_SECRET=... or your compose/environment
config), the container now generates a unique secret on first start and persists it as var/data/.appsecret
inside the data volume that the documented Docker setup already mounts.
As a one-time effect of this upgrade, all existing sessions, "remember me" cookies and pending
password-reset links become invalid — every user has to log in again once. No manual action is required;
the container starts as before. It is recommended to configure your own APP_SECRET explicitly.
2.56.0
The required minimum PHP version is now 8.2, read https://www.php.net/supported-versions.php
If you are still using PHP 8.1, please be aware it is EOL and does not receive any security updates.
If you have to upgrade to a newer version, do yourself the favor and upgrade directly to PHP 8.5. The requirement for 8.2 is an intermediate solution for the near future, and the requirement will be raised to 8.5 rather sooner than later.
2.0.30
The DATABASE_URL in your environment settings (e.g. .env, docker-compose.yaml or webserver config)
now requires the charset and serverVersion params, e.g.: DATABASE_URL=mysql://user:password@127.0.0.1:3306/database?charset=utf8mb4&serverVersion=10.5.8-MariaDB (examples in .env).
2.0
!! This release requires minimum PHP version to 8.1 !!
Breaking changes
- All plugins need to be updated: delete all previous version from your installation (
rm -r var/plugins/*) before updating! - The
local.yamlis not compatible with old version, remove it before the update and then re-create it after everything works- removed: configuring the
dashboardis not supported any longer - removed: custom translation files via
theme.branding.translation - removed: changing the plugin directory via
kimai.plugin_dir
- removed: configuring the
Developer
Developer read the full documentation at https://www.kimai.org/documentation/migration-v2.html.
- Invoice renderer and templates for XML, JSON and TEXT were moved to the Extended invoicing plugin (install if you use one of those)
- Moved
company.docxto external repo (needs to be re-uploaded if you want to keep on using it!) - Role names are forced to be uppercase
- Removed unused
public/avatars/directory - Time-tracking mode
duration_onlywas removed, existing installations will be switched toduration_fixed_begin - Removed Twig filters. You might have to replace them in your custom export/invoice templates:
date_full=>date_timeduration_decimal=>duration(true)currency=>currency_namecountry=>country_namelanguage=>language_name
- Removed support for custom translation files (use TranslationBundle instead or write your own plugin)
- Removed all 3rd party mailer packages, you need to install them manually (ONLY if you used a short syntax to configure the
MAILER_URLin.env):composer require symfony/amazon-mailercomposer require symfony/google-mailercomposer require symfony/mailchimp-mailercomposer require symfony/mailgun-mailercomposer require symfony/postmark-mailercomposer require symfony/sendgrid-mailer