Redmine

New maintenance releases for the Redmine 7.0 and 6.1 series are now available to Download, addressing security vulnerabilities along with various bug fixes and performance improvements.

Security Fixes
Both versions (7.0.2 and 6.1.5) include:

• Defect #44467: Private/invisible issue subjects leaked via REST API include=children
• Defect #44468: Private project names and role assignments leaked via GET /groups/<id>.json?include=memberships
• Defect #44429: DOM-Based XSS via Clipboard HTML Paste

Key Improvements in 7.0.2

• Rails Support: Rails updated to 8.1.4 (7.0.2) and 7.2.4 (6.1.5).
• Webhooks: Added an administration page listing all webhooks (#44337) and fixed N+1 queries (#44386).
• Performance: Optimized SVG icon rendering with path caching (#44415, #44412) and fixed UI freezes on custom fields with thousands of values (#44372).
• UI & Responsive: Refreshed mobile header and flyout menu colors (#44444) and fixed autocomplete popup positioning (#44408).
• Attachments & SCM: Fixed Ghostscript timeout process leaks (#44378), SVN URLs containing spaces (#27043), and Git branches containing 40-character hex strings (#44476).

Download and Changelog: Find the new packages in the Download section, see the full list of changes in the Changelog and the updated Security Advisories.

Many thanks to all contributors and security researchers who helped with these releases.

New maintenance releases for the Redmine 7.0, 6.1, and 6.0 series are now available to Download. These releases address multiple security vulnerabilities along with various bug fixes and improvements.

Security Fixes

All three versions (7.0.1, 6.1.4, and 6.0.11) include the following security fixes:

• Defect #44249: API requests can affect a user's session and circumvent security policies
• Defect #44308: Stored XSS in Redmine Textile Formatter via < notextile > Tag-Restoration ("Frankenstein tag")
• Defect #44309: Nested issue-relations endpoints bypass source issue visibility
• Defect #44310: Child project inherit_members updates bypass member-management authorization
• Patch #44371: Filter key parameter from logging

Maintenance Improvements

Redmine 7.0.1 is the first maintenance release for Redmine 7.0 and includes numerous fixes and improvements, notably:

• Rails Support : Rails updated to 8.1.3.1 (7.0.1) and 7.2.3.2 (6.1.4 and 6.0.11).
• Performance : Resolved a text formatting performance regression when containers have many attachments (#44348).
• Third-party libraries : Broken charts In Repository Statistics
• REST API : Added project information to the wiki page list API response (#44353).
• Authentication & Administration: Fixed user deletion when OAuth2 applications are authorized (#44343), prevented browsers from autofilling administrator passwords into user account forms (#44268), and fixed lost password access for 2FA-enforced admins (#44360).
• UI & Usability: Fixed journal `#note-N` link shifting upon deletion (#44258), Classic theme top menu positioning (#44351), wide tab bar wrapping issues (#44318), improved the highlight of the top menu (#44341), and the style of the newly account menu (#44293).

Download and Changelog

You can find the new versions in the Download section. For a complete list of changes, please review the detailed Changelog for each version.

Many thanks to all the contributors who helped with these releases, especially those who responsibly reported the vulnerabilities and helped resolve them.

Redmine 7.0.0 has been released and it is available for download from Download. This release ships 122 issues, with "Webhooks triggers on evens" as major feature, Rails 8 migration, RTL improved support, header/navigation redesign, and continued UI modernization started in 6.0 and 6.1.

This release also marks 20 years since Redmine's first release in 2006 (r1 committed by Jean-Philippe Lang on 28.06.2006). Two decades later, the project is still actively maintained and improved thanks to a community of contributors, users, and companies who keep investing their time and effort into it. Thank you to everyone who has been part of this journey, from the very first commit to today!

Here is a breakdown of the key highlights included in Redmine 7.0.0:

1. Key feature: Redmine can trigger external webhooks on events (#29664). The feature is disabled by default and must be enabled by a system administrator from the new “Integration” tab.

2. Rails, Ruby and platform upgrades:

• Redmine has been migrated to Rails 8 (#43205).
• Ruby 4.0 is now supported (#43650). Note: Ruby versions 4.0.0 to 4.0.3 have a significant wiki rendering slowdown caused by a regression in the Ruby runtime itself (#43737, tracked upstream at bugs.ruby-lang.org #21856). This was fixed upstream in Ruby 4.0.4, so we recommend running Redmine 7.0 on Ruby 4.0.4 or later.
• Several core dependencies have been updated, including Propshaft, Commonmarker, Rubyzip, Trilogy, Rouge, the pg and sqlite3 gems, and others.
• The Raphael.js dependency has been removed in favor of native SVG APIs (#43845).
• ChartJs has been upgraded and migrated to ES Modules (#44018).
• html-pipeline gem has been removed. Loofah is used now for HTML filtering, and Textile processing has been aligned with the same approach used for CommonMark (#42737, #43643). Some existing code related to text formatting have been moved to scrubbers (#43745).