Files
kimai2/UPGRADING.md
Kevin Papst 31a8f887a5 Release 2.58 (#5952)
* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore
2026-05-25 15:39:47 +02:00

4.3 KiB

Upgrading Kimai - Version 2.x

Make sure to create a backup before you start!

Read the updates documentation to find out how you can upgrade your Kimai installation to the latest stable release.

Check below if there are more version specific steps required, which need to be executed after the normal update process. Perform EACH version specific task between your version and the new one, otherwise you risk data inconsistency or a broken installation.

2.58.0

The official Docker image no longer runs with the default APP_SECRET=change_this_to_something_unique. If you did not explicitly set your own APP_SECRET (via -e APP_SECRET=... or your compose/environment config), the container now generates a unique secret on first start and persists it as var/data/.appsecret inside the data volume that the documented Docker setup already mounts.

As a one-time effect of this upgrade, all existing sessions, "remember me" cookies and pending password-reset links become invalid — every user has to log in again once. No manual action is required; the container starts as before. It is recommended to configure your own APP_SECRET explicitly.

2.56.0

The required minimum PHP version is now 8.2, read https://www.php.net/supported-versions.php

If you are still using PHP 8.1, please be aware it is EOL and does not receive any security updates.

If you have to upgrade to a newer version, do yourself the favor and upgrade directly to PHP 8.5. The requirement for 8.2 is an intermediate solution for the near future, and the requirement will be raised to 8.5 rather sooner than later.

2.0.30

The DATABASE_URL in your environment settings (e.g. .env, docker-compose.yaml or webserver config) now requires the charset and serverVersion params, e.g.: DATABASE_URL=mysql://user:password@127.0.0.1:3306/database?charset=utf8mb4&serverVersion=10.5.8-MariaDB (examples in .env).

2.0

!! This release requires minimum PHP version to 8.1 !!

Breaking changes

  • All plugins need to be updated: delete all previous version from your installation (rm -r var/plugins/*) before updating!
  • The local.yaml is not compatible with old version, remove it before the update and then re-create it after everything works
    • removed: configuring the dashboard is not supported any longer
    • removed: custom translation files via theme.branding.translation
    • removed: changing the plugin directory via kimai.plugin_dir

Developer

Developer read the full documentation at https://www.kimai.org/documentation/migration-v2.html.

  • Invoice renderer and templates for XML, JSON and TEXT were moved to the Extended invoicing plugin (install if you use one of those)
  • Moved company.docx to external repo (needs to be re-uploaded if you want to keep on using it!)
  • Role names are forced to be uppercase
  • Removed unused public/avatars/ directory
  • Time-tracking mode duration_only was removed, existing installations will be switched to duration_fixed_begin
  • Removed Twig filters. You might have to replace them in your custom export/invoice templates:
    • date_full => date_time
    • duration_decimal => duration(true)
    • currency => currency_name
    • country => country_name
    • language => language_name
  • Removed support for custom translation files (use TranslationBundle instead or write your own plugin)
  • Removed all 3rd party mailer packages, you need to install them manually (ONLY if you used a short syntax to configure the MAILER_URL in .env):
    • composer require symfony/amazon-mailer
    • composer require symfony/google-mailer
    • composer require symfony/mailchimp-mailer
    • composer require symfony/mailgun-mailer
    • composer require symfony/postmark-mailer
    • composer require symfony/sendgrid-mailer