chore(deps): update container image vikunja/vikunja to v2.6.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
vikunja/vikunja	major	0.24.6 → 2.6.0

---

Release Notes

go-vikunja/vikunja (vikunja/vikunja)

v2.6.0

Compare Source

Bug Fixes

• (a11y) Label the audio player and play button with the file name
• (a11y) Move focus into the main content when the skip link is used
• (a11y) Keep closed popups out of the tab order
• (a11y) Announce the quick action result type
• (a11y) Announce the description save state
• (a11y) Give password fields a prose placeholder
• (a11y) Label the link share password fields
• (api) Enforce token scopes for task expansions
• (api tokens) Don't audit autopatch's internal dispatch legs
• (api/v1) Validate the email update body and report the mailer-dependent message
• (api/v2) Don't require read_one for autopatch's internal GET
• (attachments) Manage the preview blob url lifecycle
• (attachments) Guard audio load against double clicks, failures and unmount races
• (attachments) Track the playing audio element from the play event
• (attachments) Give the video error state a panel
• (auth) Don't auto-redirect to the OIDC provider when the login URL must stay copyable
• (auth) Allow API tokens to call /api/v2/token/test (#​3548)
• (auth) Send the refresh token cookie to the v2 refresh endpoint
• (auth) Clear the refresh cookie only when the token is unusable
• (auth) Reject bot accounts during OIDC fallback
• (auth) Hide enabled totp secrets
• (button) Restore shadow and wrap prop defaults
• (caldav) Don't duplicate a task when a client PUTs a stale href
• (caldav) Keep pseudo collection hrefs and reads inside their own collection
• (caldav) Let the permission check decide what a collection accepts
• (caldav) Force a full resync for pseudo collections
• (caldav) Stop advertising writes clients cannot make
• (caldav) Encode task uids in hrefs instead of interpolating them raw (#​3560)
• (caldav) Stop answering requests out of process-wide state
• (caldav) Authorize task relations
• (ci) Bump LLM-action fork pin to root-container fix (#​3430)
• (ci) Set repo for auto-merge label workflow via env
• (ci) Restore preview builds for fork PRs behind an approval gate
• (doctor) Stop creating the files directory during diagnostics
• (doctor) Stop creating the sqlite database during diagnostics
• (doctor) Stop creating a temp database for the ephemeral sentinel
• (doctor) Fail early when the database path is a directory
• (doctor) Print an absolute config file path
• (doctor) Time out the S3 storage probe
• (doctor) Print each check group as it completes
• (doctor) Accept matching directory owner
• (e2etests) Drain pending event handlers before seeding fixtures
• (editor) Join list items on backspace instead of splitting the list
• (editor) Open the lightbox only for resolved attachment images
• (editor) Don't trust stored image ids, scope and dedupe the blob lookup
• (editor) Preserve subscript and superscript in pasted text (#​3606)
• (events) Don't log event payloads in the poison queue handler
• (files) Bound S3 storage calls with the caller's context
• (filters) Bound expression complexity
• (frontend) Keep focus in the multiselect input after selecting an option
• (frontend) Don't duplicate subtasks as top-level rows in saved filter list views
• (frontend) Show confirmation notice when registration requires email verification
• (frontend) Don't overlap project color with drag handle on touch capable desktops
• (frontend) Redeem email confirmation link while logged in
• (frontend) Do not retry a rate-limited token refresh
• (frontend) Keep API token delete target during modal close animation
• (frontend) Guard token delete flow against double submit
• (frontend) Add accessible name to custom expiry date input
• (gantt) Measure day width when the chart appears after loading
• (images) Bound decode and resize dimensions
• (keyvalue) Dedupe keys returned by redis SCAN
• (keyvalue) Escape glob metacharacters in redis ListKeys prefix
• (labels) Let bots use labels created by their owner (#​3609)
• (labels) Return 403 instead of panicking on bulk label replace
• (labels) Share labels between all bots of the same owner
• (labels) Fail closed if the visibility condition degenerates
• (lightbox) Make the toolbar readable and labelled in both themes
• (lightbox) Surface image load failures instead of spinning forever
• (lightbox) Accept only blob urls and close on unsafe sources
• (lightbox) Keep double-click from closing the lightbox or entering edit mode
• (lightbox) Correct pan clamping, zoom anchoring and wheel sensitivity
• (lightbox) Harden the gesture lifecycle
• (lightbox) Fall back to a generic accessible name for empty alt
• (link share) Don't apply Bulma content typography to the shared project view
• (metrics) Store active users as TTL keys in keyvalue to avoid concurrent map access
• (migration) Don't fail todoist migration on undownloadable attachments
• (migration) Map exported assignees to the importing user instead of failing
• (migration) Don't panic on events for unregistered migrators
• (migration) Keep imported tasks done when they are placed in an imported bucket
• (migration) Cascade archived state to descendants on structure import
• (migration) Serialize imports per user
• (migration) Cap csv rows while decoding
• (migration) Bound planka import resources
• (migration) Bound vikunja file imports
• (migration) Reload conflicting claims after rollback
• (modal) Make the fullscreen variant closable on every viewport
• (notifications) Retry subscriber notifications instead of dropping them on error
• (notifications) Include the project prefix in task identifiers (#​3538)
• (openid) Pin token endpoint auth method instead of probing (#​3607)
• (packaging) Restart the service on package upgrades
• (packaging) Run the postinstall script on apk and arch upgrades
• (packaging) Stop rpm upgrades from replacing the config
• (permissions) Decode a null permission as unknown, not read
• (plugins) Exclude example plugin from module build
• (popup) Let a popup's own trigger close it again
• (projects) Make position healing include the moved project
• (projects) Reload projects when the api recalculated positions
• (projects) Deny writes to pseudo projects across the permission family
• (projects) Backfill is_archived for descendants of archived projects
• (projects) Only cascade archived state to descendants when it changes
• (projects) Reject un-archiving a child while its parent is archived
• (projects) Sub-resource permission checks no longer get the un-archive exception
• (projects) Allow un-archiving orphaned projects, batch descendant archive update
• (projects) Tolerate dangling stored parent when updating, keep admin bypass for filter buckets
• (projects) Report null for a max_permission nobody computed
• (projects) Report read for the Favorites pseudo project
• (quick-add) Reuse existing labels in the desktop quick entry window (#​3533)
• (ratelimit) Namespace each limiter's counters by prefix
• (ratelimit) Give session renewal its own budget
• (routes) Extract the client IP for requests over a unix socket
• (routes) Rate limit /api/v2/user/token/refresh
• (routes) Share one unauth rate limiter with v1's public routes
• (routes) Rate limit the unauthenticated v2 auth routes
• (routes) Rate limit basic auth failures
• (settings) Show the current language in the settings select
• (sharing) Stop logging the link share password
• (sharing) Keep the link share password form after a wrong password
• (sharing) Restrict link share hash reads
• (sharing) Restrict team attachment visibility
• (static) Don't unescape already-decoded request paths (#​3437)
• (subscriptions) Don't let implicit subscribes lift an explicit opt-out
• (tasks) Don't wrap reminders into the past when repeating from current date
• (tasks) Keep task attribute icons on the same line as a wrapped title
• (tasks) Vertically center the assignee avatar in the task row
• (tasks) Center color bubble, label tag and avatar on the task row line
• (tasks) Remove double spacing between assignee avatar and username
• (tasks) Scope saved filter view updates to filters that can see the task
• (tasks) Hide assignee email addresses
• (tasks) Authorize both sides of relation deletion
• (tasks) Restrict subtask expansion by access
• (tasks) Require access for favorites
• (tasks) Validate position target views
• (teams) Preserve members across list responses (#​3486)
• (user) Keep email confirmation status after registration
• (user) Keep old email active until new one is confirmed
• (user) Expire used TOTP passcodes via keyvalue TTL
• (users) Reject link shares from user listings
• (views) Persist per-view sort and filter across page reloads
• (webhooks) Wrap long target URLs instead of overflowing the table
• Don't tag prerelease docker images as latest (10cfb6a)
• Disable pagination previous/next links instead of rendering dead router links (2812ace)
• Use caller's session in LoadFileMetaByID to prevent connection pool deadlock (0441065)
• Release db connection before reading attachment files from storage (96ddc10)
• Load export file meta inside transaction and open storage after commit (6d2b5af)
• Expose pkg/config and viper to yaegi plugins (358d043)
• Expose xorm and xormigrate to yaegi plugins (8dfb5d4)
• Sort saved filters alphabetically in sidebar navigation 🤖🤖🤖 (#​3497) (4505e6e)

Dependencies

• (deps) Update dependency basic-ftp to v6.1.0
• (deps) Update dependency @​types/codemirror to v5.60.18
• (deps) Update dependency basic-ftp to v6.2.0
• (deps) Update node.js to v24.19.0
• (deps) Update dependency dompurify to v3.4.13 [security]
• (deps) Update danielroe/provenance-action digest to 2fb14fe
• (deps) Update pnpm to v11.21.0
• (deps) Update dev-dependencies
• (deps) Update dependency undici@​7 to v8.10.0
• (deps) Update dependency nanoid to v6.0.1
• (deps) Update aws-sdk-go-v2 monorepo
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.26.x docker digest to 1a7c89c
• (deps) Bump nanoid from 3.3.16 to 6.0.1 in /frontend
• (deps) Drop redundant esbuild devDependency
• (deps) Update nanoid to 3.3.18
• (deps) Update js-yaml to 3.15.1
• (deps) Update brace-expansion to 5.0.9
• (deps) Update brace-expansion to 5.0.9 in desktop
• (deps) Update fast-uri to 3.1.5
• (deps) Update docker/dockerfile:1 docker digest to ecfaec9
• (deps) Update dependency go to v1.26.6
• (deps) Update dependency postcss to v8.5.26
• (deps) Update dependency vue to v3.5.41
• (deps) Update module golang.org/x/image to v0.45.0
• (deps) Update dependency marked to v18.0.9
• (deps) Update cachix/install-nix-action action to v31.11.1
• (deps) Update module charm.land/lipgloss/v2 to v2.0.6
• (deps) Update dependency rollup-plugin-visualizer to v7.1.1
• (deps) Update module github.com/stretchr/testify to v1.12.0
• (deps) Update dependency serialize-javascript to v7.1.0
• (deps) Update dependency undici@​6 to v8.10.0
• (deps) Update dependency ip-address to v10.5.0
• (deps) Update dependency pinia to v4.0.3
• (deps) Update tiptap to v3.30.1
• (deps) Update dependency esbuild to v0.28.2
• (deps) Update dependency @​sentry/vue to v10.70.0
• (deps) Update dependency js-yaml@​4 to v5.3.0
• (deps) Update e18e/action-dependency-diff action to v1.7.1
• (deps) Update module golang.org/x/net to v0.58.0
• (deps) Update dependency js-yaml to v5.3.0
• (deps) Update module github.com/mattn/go-sqlite3 to v1.14.50
• (deps) Update dependency fast-uri@​3 to v4
• (deps) Update module github.com/arran4/golang-ical to v0.3.6
• (deps) Update dependency dayjs to v1.11.22
• (deps) Update docker/setup-buildx-action action to v4.3.0
• (deps) Update pnpm to v11.22.0
• (deps) Update module github.com/stretchr/testify to v1.12.1
• (deps) Update dependency @​intlify/unplugin-vue-i18n to v11.2.5
• (deps) Update dependency go to v1.26.7
• (deps) Update module charm.land/bubbletea/v2 to v2.0.9
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.26.x docker digest to f4dc2c0
• (deps) Update crowdin/github-action action to v2.17.1
• (deps) Update dependency dayjs to v1.11.23
• (deps) Update module github.com/aws/smithy-go to v1.27.9
• (deps) Update dependency marked to v18.0.10
• (deps) Update dependency dompurify to v3.4.14
• (deps) Update danielroe/provenance-action digest to 755e844
• (deps) Update tiptap to v3.30.2
• (deps) Update ghcr.io/techknowlogick/xgo:go-1.27.x docker digest to d3a0360
• (deps) Update dependency rollup to v4.62.5
• (deps) Update module github.com/aws/smithy-go to v1.28.1
• (deps) Update node.js to v24.20.0
• (deps) Update dependency vue-i18n to v11.4.9
• (deps) Update danielroe/provenance-action digest to b3ab830
• (deps) Update dependency fast-uri@​3 to v4.1.3
• (deps) Update module github.com/threedotslabs/watermill to v1.5.3
• (deps) Update pnpm to v11.23.0
• (deps) Update tiptap to v3.30.3
• (deps) Update module github.com/getsentry/sentry-go to v0.49.0
• (deps) Update crowdin/github-action action to v3
• (deps) Update module github.com/yuin/goldmark to v2
• (deps) Update dependency picomatch to v4.0.7
• (deps) Update dependency @​sentry/vue to v10.71.0
• (deps) Update pnpm to v11.24.0
• (deps) Update dependency marked to v18.0.11
• (deps) Update module github.com/yuin/goldmark to v2 (#​3627)
• (deps) Update node.js to e67514e (#​3638)
• (deps) Update dependency js-yaml to v5.4.0
• (deps) Update dependency js-yaml@​4 to v5.4.0
• (deps) Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.109.1
• (deps) Update dependency rollup to v4.63.0
• (deps) Update dependency vue-i18n to v11.4.10
• (deps) Update dependency axios to v1.20.0 (#​3649)
• (deps) Update tiptap to v3.30.5
• (deps) Update dependency js-yaml@​4 to v5.4.1
• (deps) Update dependency js-yaml to v5.4.1
• (deps) Update dependency vue to v3.5.42
• (deps) Update softprops/action-gh-release action to v3.0.3
• (deps) Update dependency happy-dom to v20.11.8
• (deps) Update dependency vue-router to v5.3.0
• (deps) Update dependency rollup to v4.63.1
• (deps) Update danielroe/provenance-action digest to 71d3c60
• (deps) Update postgres:18 docker digest to 4ef4dbc
• (deps) Update dependency markdown-it to v15.0.1
• (deps) Update dependency basic-ftp to v6.2.1

Documentation

• (api) Correct v2 password-token description to match 404 behavior
• (config) Clarify realip trust semantics for ipextractionmethod

Features

• (a11y) Show task glance tooltip on keyboard focus, dismiss with Escape
• (a11y) Close popups with Escape
• (admin) Port GET /admin/users to /api/v2 (#​3676)
• (api/v2) Expose pending email, add cancel and resend endpoints
• (attachments) Compact attachment rows, move metadata into tooltips
• (attachments) Keep the uploader avatar in the attachment meta line
• (attachments) Add zoom & pan image lightbox
• (attachments) Play audio attachments when clicking the attachment row
• (attachments) Preview video attachments in a modal 🤖🤖🤖 (#​3491)
• (attachments) Show a play icon for video attachments
• (cmd) Add --config flag to pin the config file (#​3652)
• (db) Memoize per-session data and drop it on the first write
• (doctor) Report service.rootpath in the configuration group
• (editor) Add helper to parse task ids from same-origin task urls
• (editor) Add taskLink node rendered as a task pill
• (frontend) Show pending email change with resend and cancel
• (frontend) Add planka migration form
• (frontend) Refresh the token via /api/v2 with a v1 fallback
• (frontend) Let users unsubscribe from an inherited subscription
• (keyvalue) Add PutWithTTL to the storage interface
• (labels) Search labels by description, through MultiFieldSearch
• (lightbox) Keyboard zoom and pan
• (migration) Client-aware get and size-limited download helpers, bounded json decode
• (migration) Add planka api client
• (migration) Fetch planka projects and boards
• (migration) Convert planka data to vikunja structure
• (migration) Add planka migrator routes on v2
• (notifications) Notify subscribers when a task is created
• (notifications) Add clearing stored notifications (#​2735)
• (subscriptions) Add muted column to subscriptions
• (subscriptions) Allow unsubscribing from an inherited subscription
• (subscriptions) Enforce one subscription row per user and entity
• (tasks) Subscribe task creator to their own task
• (tasks) Audio attachment preview
• (user) Add pending_email column
• (user) Notify the current address when an email change is requested
• (user) Add shared bot identity helpers
• Regenerate and commit swagger docs and yaegi symbols during release tagging (339b9a2)
• Report ParadeDB extension and index status in doctor command (7e4df58)
• Drop columns for real in SQLite migrations (88e8bcf)
• Expose database connection pool stats as prometheus metrics (263c24f)
• Show relative time in api token expiry notifications (7d91052)
• Add shared task cache with service-level invalidation (7d84f71)
• Add default due time settings (#​3433) (d71301f)
• Filter tasks by creator username (#​2916) (07927c5)

Miscellaneous Tasks

• (devenv) Provide go 1.27.0 and golangci-lint 2.13.0 in dev shell
• (i18n) Update translations via Crowdin
• (lint) Ban replacing a session context outside pkg/db
• (tasks) Drop redundant comments
• Bump go to 1.27.0 (c80aac2)
• Bump golangci-lint to v2.13.0 (8d6e0e5)
• Regenerate yaegi symbols (e38f210)

Other

• (other) [skip ci] Updated yaegi symbols
• (other) [skip ci] Updated swagger docs
• (other) Bump ParadeDB image to v0.25.3 to fix flaky block read errors
• (other) Add workflow to sync auto-merge label with PR auto-merge state
• (other) Remove "waiting for reply" label when a PR gets new commits
• (other) Link the preview deployment from the PR

Performance

• (labels) List a user's labels without joining label_tasks
• (projects) Resolve a user's project access in one query per request
• (projects) Resolve project permissions from the access memo
• (projects) Filter accessible projects through the memo
• (projects) List a user's projects from the memo instead of recursive CTEs
• (tasks) Only use DISTINCT when a join can multiply rows
• (tasks) Add composite index on (done, due_date)

Refactor

• (attachments) Show mime type in the file name tooltip
• (attachments) Rename AudioPreview prop to attachment
• (attachments) Drop the unused canPreview helper
• (attachments) Gate video previews on mime alone
• (attachments) Collapse blob previews into one state
• (auth) Give RefreshSession typed domain errors
• (bots) Take a verified user, not any web.Auth
• (db) Resolve the database path without creating anything
• (editor) Extract the TipTap extension list into createEditorExtensions
• (files) Split base path creation out of storage validation
• (files) Move base path creation and validation onto FileStorage
• (frontend) Centralize menu shortcuts (#​2832)
• (labels) Split the label query into two honest functions
• (labels) Share one visibility condition between list and read
• (lightbox) Extract zoom math into helpers/imageZoom.ts with tests
• (projects) Read archived state from the materialized column only
• (projects) Dedupe effective parent lookup, tidy error ordering and comments
• (projects) Extract getUserIDsWithProjectAccess and make it authoritative
• (routes) Extract pathScoped middleware helper
• Share top-layer container lookup between editor popups and glance tooltip (dec61cf)
• Mount the lightbox only while open, keyed by url (935f275)
• Use IsBotOwnedBy for bot ownership checks (669395e)

Testing

• (attachments) Cover AudioPreview lifecycle, coordination and error paths
• (db) Make database path tests platform-aware
• (e2e) Cover registration flow when email confirmation is required
• (e2e) Spy on v2 refresh endpoint
• (e2e) Make team owner a fixture member
• (editor) Run task link tests against the real editor extension config
• (files) Restore the storage global after InitFileHandler
• (files) Cover Ensure and ValidateBasePath per backend
• (frontend) Cover delete modal close race and double submit guard
• (migration) Handle database id sequences
• (projects) Materialize inherited archived state in fixtures
• (projects) Cover the parent owner on member-created subprojects
• (projects) Assert search stays within the accessible set
• (routes) Cover the v2 unauthenticated rate limit
• (subscriptions) Cover the opt-out paths and the rows they leave behind
• (tasks) Cover saved filter view scoping, access paths and filter edge cases
• (views) Cover restoring persisted sort into the url query
• Ensure previous pagination button on first page does not navigate to negative page (0db7607)
• Cover the doctor database checks (363813f)
• Stop leaking config overrides between tests (f42d1a6)
• Assert both refresh cookie paths and consolidate the cookie helpers (e955522)
• Cover the v2 admin license gate (4864678)
• Merge overlapping refresh rate limit subtests (4dbdc64)

v2.5.0

Compare Source

Bug Fixes

• (api tokens) Guard GetTokenFromTokenString against short token strings
• (api/v2) Strip internal error detail in NewError, not NewErrorWithContext
• (api/v2) Stop leaking the healthcheck cause to unauthenticated callers
• (api/v2) Validate slice-of-struct body fields at the boundary
• (auth) Use configured bcrypt rounds everywhere
• (auth) Gate the v2 login route on local or ldap auth being enabled
• (avatar) Bounds-check size before narrowing int64 to int
• (caldav) Close username enumeration oracle in basic auth (#​3349)
• (caldav) Answer PROPPATCH with 207/403 instead of a blanket 501 (#​3364)
• (caldav) Return 404 for principal sub-paths and foreign usernames (#​3371)
• (caldav) Remove double trailing slash from current-user-principal href
• (caldav) Don't wipe fields the parser doesn't understand on update
• (caldav) Anchor RELATED=END alarm triggers on due date when the task has one
• (caldav) Report completion status from Done instead of done_at
• (caldav) Stop corrupting percent signs in REPORT responses
• (ci) Tag preview images with the PR head sha
• (ci) Describe PR head instead of base branch for preview version
• (ci) Replace retired GitHub Models inference in auto-label workflow (#​3415)
• (ci) Pin LLM-action to fork with reasoning model support
• (config) Apply deprecated service.jwtsecret to service.secret
• (db) Ping the database on connect so failures report the real error
• (desktop) Coordinate token refresh across renderer windows
• (desktop) Create quick-entry window lazily
• (dump) Parse dumped time strings so restore works on MySQL and MariaDB
• (dump) Skip directory entries in dump zip when restoring
• (dump) Reuse single stdin reader for all restore prompts
• (filter) Don't rewrite in/not in/like inside quoted values
• (filters) Skip saved filters owned by disabled users
• (filters) Don't let one filter fail the whole filter view maintenance
• (frontend) Route to not-found on forbidden task instead of blank shell
• (frontend) Don't reload page on first service worker install
• (frontend) Force rel=noopener on links in project descriptions
• (gravatar) Route avatar requests through the SSRF-safe http client
• (labels) Allow attaching labels via inherited child-project access (#​3374)
• (license) Refuse redirects and use the SSRF-safe http client for checks
• (mage) Scaffold new migrations with partialSync
• (migration) Seed task positions for exports without order information
• (migration) Stop existing-table struct syncs from dropping indexes
• (migration) Recreate indexes dropped by partial-struct sync migrations
• (migration) Detect sqlite indexes created with lowercase SQL (#​3354)
• (migration) Prevent stack overflow on ticktick parentId cycles
• (migration) Abort import on unexpected task creation error
• (migration) Repair kanban views without a bucket configuration mode
• (migration/csv) Cap CSV import buffer to the configured upload limit
• (models) Use ILIKE for the team search count query
• (models) Write back dates rescheduled by repeat logic under restricted column updates
• (notifications) Deliver task deleted notifications again
• (notifications) Don't notify subscribers who lost access to the entity
• (notifications) Check project access when reading notifications
• (notifications) Require a persisted notification to declare its project
• (notifications) Delete stored notifications of unknown types
• (oauth2) Burn authorization code even when validation fails (#​3350)
• (openid) Stop logging raw token-endpoint response bodies
• (packaging) Return ENOSYS instead of SIGSYS for filtered syscalls
• (packaging) Stop masking filesystem paths in the systemd unit (#​3306)
• (plugins) Regenerate stale yaegi symbol tables
• (projects) Don't report database errors as a missing project
• (ratelimit) Don't panic on unauthenticated requests
• (ratelimit) Key by ip when the configured kind is unknown
• (security) Rate limit the websocket upgrade endpoint (#​3348)
• (security) Return the negated user id from LinkSharing.GetID
• (security) Reject link shares at team, bot and webhook permission checks
• (security) Reject link shares in Webhook.ReadAll
• (security) Reject non-user tokens in GetUserFromClaims
• (subscriptions) Declare subscription entity as string enum in v2 OpenAPI schema
• (subscriptions) Marshal unknown subscription entity type as null
• (unsplash) Route api requests through the SSRF-safe http client
• (views) Seed and maintain kanban buckets when a view's kind changes
• (views) Preselect manual bucket mode in the view edit form
• (views) Drop deleted bucket from view state after deleting it
• (web) Stop logging the full auth object on permission denials
• (webhooks) Bound the error response body read
• Shadow embedded CRUDable Update method on LinkSharing (c580d51)
• Shadow embedded CRUDable ReadAll method on SavedFilter (6f65621)
• Embed user.User by value in AdminUser (4cc647b)
• Embed LinkSharing by value in LinkShareToken (b8492a0)
• Always serialize parent_project_id for pseudo-projects (2e0cd81)
• Avoid panic on null jwt claim values (ccba2e4)
• Report the real link share id in saved filter errors (ed8dc89)

Dependencies

• (deps) Update postgres:18 docker digest to 3a82e1f
• (deps) Update dev-dependencies
• (deps) Update actions/checkout action to v7.0.1
• (deps) Update danielroe/provenance-action digest to 8ecbdd2
• (deps) Update pnpm to v11.14.0
• (deps) Update module github.com/prometheus/client_golang to v1.24.0
• (deps) Update module github.com/labstack/echo/v5 to v5.3.1
• (deps) Update danielroe/provenance-action digest to fcc45fd
• (deps) Update pnpm to v11.15.0
• (deps) Update aws-sdk-go-v2 monorepo
• (deps) Update dependency happy-dom to v20.11.0
• (deps) Update dependency postcss to v8.5.20
• (deps) Update pnpm to v11.15.1
• (deps) Update dependency vue-i18n to v11.4.7
• (deps) Update dependency undici@​7 to v8.8.0
• (deps) Update docker/login-action action to v4.5.0
• (deps) Update module github.com/ganigeorgiev/fexpr to v0.6.0
• (deps) Update dependency marked to v18.0.7
• (deps) Update dependency undici@​6 to v8.8.0
• (deps) Update crowdin/github-action action to v2.17.0
• (deps) Update module github.com/gabriel-vasile/mimetype to v1.4.15
• (deps) Update docker/login-action action to v4.5.1
• (deps) Update dependency js-yaml to v5.2.2 [security]
• (deps) Update dependency js-yaml@​4 to v5.2.2 [security]
• (deps) Update dependency @​sentry/vue to v10.67.0
• (deps) Update module github.com/prometheus/client_golang to v1.24.1
• (deps) Update dependency tar to v7.5.21
• (deps) Update dependency @​fortawesome/vue-fontawesome to v3.3.3
• (deps) Update dependency flatted to v3.4.3
• (deps) Update dependency postcss to v8.5.22
• (deps) Update pnpm to v11.16.0
• (deps) Update pnpm to v11.17.0
• (deps) Lock file maintenance
• (deps) Update danielroe/provenance-action digest to b793421
• (deps) Update dependency @​sentry/vue to v10.68.0
• (deps) Update dependency undici@​7 to v8.9.0
• (deps) Update dependency postcss to v8.5.23
• (deps) Update tiptap to v3.29.0
• (deps) Update module github.com/aws/smithy-go to v1.27.5
• (deps) Update dependency tar to v7.5.22
• (deps) Update module github.com/yuin/goldmark to v1.8.5
• (deps) Update playwright to v1.62.0
• (deps) Update dependency undici@​6 to v8.9.0
• (deps) Update dependency ip-address to v10.2.2
• (deps) Update danielroe/provenance-action digest to ec1767b
• (deps) Update actions/stale action to v11
• (deps) Update dependency basic-ftp to v6.0.2
• (deps) Update dependency ip-address to v10.3.1
• (deps) Update dependency vite-plugin-vue-devtools to v8.2.1
• (deps) Update docker/login-action action to v4.5.2
• (deps) Update docker/login-action action to v4.6.0
• (deps) Update dependency vue-i18n to v11.4.8
• (deps) Update module github.com/mattn/go-sqlite3 to v1.14.49
• (deps) Update module github.com/aws/smithy-go to v1.27.6
• (deps) Update dependency postcss to v8.5.25
• (deps) Update node.js to v24.18.1
• (deps) Update dependency minimatch to v10.2.6
• (deps) Update tiptap to v3.29.2
• (deps) Update dependency rollup to v4.62.3
• (deps) Update pnpm to v11.18.0
• (deps) Update dependency @​sentry/vue to v10.69.0
• (deps) Update dependency axios to v1.19.0
• (deps) Update vueuse to v14.4.0
• (deps) Update dependency flatted to v3.4.4
• (deps) Update dependency markdown-it to v15
• (deps) Update pnpm/action-setup action to v6.0.10
• (deps) Update pnpm to v11.19.0
• (deps) Update danielroe/provenance-action digest to 193227b
• (deps) Update dependency ip-address to v10.4.0
• (deps) Update playwright to v1.62.1
• (deps) Update module github.com/danielgtaylor/huma/v2 to v2.39.1
• (deps) Update node.js to v24.19.0
• (deps) Update dependency js-yaml@​4 to v5.2.3
• (deps) Update dependency js-yaml to v5.2.3
• (deps) Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.106.4
• (deps) Update module github.com/redis/go-redis/v9 to v9.22.0
• (deps) Update dependency rollup to v4.62.4

Documentation

• (agents) Explicit mention of no raw sql [skip ci]
• (skill) Ban plain tx.Sync on existing tables in the migration skill
• Update readme with LLM disclosure, update sponsors [skip ci] (7f7d61f)

Features

• (api/v2) Add bulk task creation endpoint
• (audit) Audit full personal data export requests
• (desktop) Add a Content Security Policy to the app window (#​3351)
• (dev) Add paseo config
• (mage) Add generate:yaegi-symbols and check:yaegi-symbols targets
• (tasks) Calculate top-of-view positions per batch
• (tasks) Generalize task creation to batches
• (tasks) Add BulkTaskCreation model
• (tasks) Update saved-filter views once per creation batch
• (tasks) Add bulk creation to the task service
• (tasks) Add bulk quick-add creation to the task store
• (tasks) Create quick-add tasks through the bulk endpoint

Miscellaneous Tasks

• (i18n) Update translations via Crowdin
• Cleanup dead code (1e081d3)

Other

• (lint) Forbid plain Sync in migrations via forbidigo
• (other) Drop unused contents: write from generate-swagger-docs
• (other) [skip ci] Updated swagger docs
• (other) Auto-regenerate yaegi symbols alongside swagger docs
• (other) [skip ci] Updated yaegi symbols

Performance

• (tasks) Index task_positions on (project_view_id, position)

Refactor

• (projects) Resolve read permissions for many projects at once
• Drop redundant link share branch in comment permissions (d545e3b)

Testing

• (api-tokens) Match permission checkbox name exactly
• (e2e) Cover multiline creation order and subtasks
• (models) Restore notification faking after user delete tests
• (ratelimit) Assert exact statuses instead of absence of 500
• Guard schema-link creation for all v2 response types (f02df25)
• Guard parent_project_id in project responses (aa62c00)
• Cover link share principal confusion at the HTTP layer (2b1558e)
• Assert link share attachments are not attributed to a colliding user (4b35f5d)

v2.4.0

Compare Source

Bug Fixes

• (a11y) Make list view task links keyboard focusable and openable with Enter
• (a11y) Show a visible focus ring on checkboxes and other focusable controls
• (a11y) Make task title keyboard editable
• (a11y) Pick label text color by actual WCAG contrast ratio
• (a11y) Fix light theme contrast of success and danger text
• (a11y) Make kanban cards reachable and openable by keyboard
• (a11y) Show a keyboard-only focus ring on text inputs and editable titles
• (a11y) Move focus to main content when the skip link is activated
• (a11y) Add accessible names to all icon-only buttons
• (a11y) Login tab order, announced errors, combobox pattern, named dialogs and selects (#​3228)
• (a11y) Expose expanded, sort, result-count and toggle states to assistive technology
• (a11y) Contrast tokens, empty-title feedback, structure and landmarks (#​3234)
• (a11y) Render the kanban bucket footer as a list item
• (a11y) Un-nest the attachment rows
• (a11y) Keep the auth hero heading readable with a gradient scrim
• (a11y) Label the bucket selector with its purpose and current bucket
• (a11y) Announce comment and attachment counts on task cards and rows
• (a11y) Make the editor toolbar a single tab stop with roving focus
• (admin) Reload created user before returning in admin create handler
• (ai) Correct snake_case in json instructions
• (api) Uppercase project identifier before by-index lookup
• (api) Close the user data export reader after download
• (api) Export api-token permission groups in snake_case
• (api) Return 200 instead of 500 when listing attachments on a task with none
• (api) Derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)
• (api) Reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)
• (api/docs) Make redoc load docs.json from public URL
• (api/docs) Use Base in redoc template
• (api/v2) Publish OpenAPI Servers and make schemas publicly fetchable
• (api/v2) Return generic 401 instead of leaking internal auth error
• (api/v2) Don't leak internal error detail in 5xx responses
• (api/v2) Dedupe BucketConfigurationMode enum tag
• (api/v2) Guard against nil bucket configuration elements
• (api/v2) Scope project view delete to its parent project
• (api/v2) Apply rate limit before the admin gate
• (api/v2) Accept real image content-types on avatar upload
• (api/v2) Align avatar upload body limit with global overhead
• (api/v2) Reject non-decodable images (e.g. SVG) on avatar upload with 400
• (api/v2) Keep include_public out of the team body schema
• (api/v2) Omit project max_permission (null) when not expanded
• (api/v2) Drop ETag/conditional read on project get
• (api/v2) Map ValidationHTTPError to its HTTP status
• (api/v2) Return 200 from notifications mark-all (creates nothing)
• (api/v2) Group time-entries token routes under their own scope
• (api/v2) Expose v2-only token route groups via the routes endpoint
• (api/v2) Return ErrProjectDoesNotExist for unknown project identifiers
• (api/v2) Gate /register at registration time, not per request
• (api/v2) Close export reader when commit fails before streaming
• (assignees) Resolve 500 error when reading task assignees
• (assignees) Use db.ILIKE helper for assignee search count query
• (attachments) Keep blob mime type so pdf previews open inline (#​3157)
• (audit) Handle reopen failure after a failed rotation
• (audit) Only attribute the logout event to user tokens
• (auth) Tolerate string booleans in oidc provider config (#​2599)
• (auth) Make refresh token path respect to public URL
• (auth) Cleanup getRefreshTokenCookiePath implementation
• (auth) Don't panic on /token/test with API token
• (auth) Remove stale OIDC callback lock
• (auth) Roll back on commit failure in DeleteSession
• (auth) Return ErrAccountLocked for locked accounts on login
• (auth) Build OIDC end-session URL with RP-Initiated Logout params (#​2943)
• (auth) Preserve desktop authorize URL when not signed in (#​2944)
• (auth) Link OIDC username fallback on preferred_username, not just sub (#​2945)
• (auth) Dedupe and retry token refresh to prevent spurious logouts (#​2948)
• (auth) Allow api tokens to access global v2 task list endpoint
• (auth) Use binddn as group sync dn instead of userbind
• (auth) Require verified email before OIDC email-fallback account linking (GHSA-xv7q-fvmc-jx96)
• (auth) Reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)
• (caldav) Return 404 when trying to access a project that cannot exist with CalDAV (#​2796)
• (caldav) Store markdown descriptions as HTML, skip spurious updates
• (caldav) Compute VTODO DURATION components correctly (#​3155)
• (caldav) Parse ISO 8601 week durations in reminder triggers (#​3183)
• (ci) Skip interactive prompt in nixpkgs update workflow
• (ci) Use working model
• (ci) Don’t close issue directly
• (ci) Add mage aliases for pacakge releases
• (ci) Configure gpg loopback pinentry for reprepro signing
• (ci) Sign APT Release files manually instead of via reprepro gpgme
• (ci) Install makepkg for repo-add utility scripts
• (ci) Rename .archlinux files to .pkg.tar.zst for repo-add
• (ci) Add debug step to list incoming package files
• (ci) Add deeper debug for archlinux/pacman package contents
• (ci) Install libarchive-tools for repo-add bsdtar dependency
• (ci) Set RELEASE_VERSION to avoid git dependency in containers
• (ci) Add libc6-compat for Alpine, fix S3 upload glob, add debug
• (ci) Inline APK repo generation to avoid glibc binary on Alpine
• (ci) Skip desktop .apk in APK repo, not a valid Alpine package
• (ci) Revert S3 glob to */ and clean up directories before upload
• (ci) Update s3-action to skip directories during upload
• (ci) Pin s3-action to main branch
• (ci) Exclude package files from repo metadata upload
• (ci) Write GPG key directly to file instead of importing and exporting
• (ci) Resolve symlinks before upload instead of deleting them
• (ci) Commit newly added Crowdin translation files
• (ci) Escape ${{ secrets.* }} mention in release-binaries description
• (ci) Switch release composite actions to unstable on non-tag builds
• (ci) Drop "./" from PACKAGE_OUTPUT_DIR so strip-path-prefix matches
• (ci) Generate config.yml.sample in release-os-package for vikunja
• (ci) Copy pnpm-workspace.yaml into Docker frontend build
• (cli) Guard last admin on scheduled CLI deletion path
• (cli) Drain the mail queue before user commands exit
• (comments) Even padding around comment message
• (db) Interpolate table identifiers in truncate instead of binding them
• (desktop) Rebuild tray menu in place instead of recreating the Tray
• (desktop) Support Ctrl and mouse-wheel zoom shortcuts
• (desktop) Drop redundant zoom clamp
• (desktop) Show tray icon in packaged builds
• (desktop) Quit on SIGTERM and SIGINT
• (desktop) Show hidden window when relaunched from tray
• (desktop) Set the main window icon on Linux
• (desktop) Register vikunja-desktop:// scheme handler for AppImage (#​3203)
• (docker) Make /tmp world-writable so exports work under any UID
• (editor) Render floating popups inside the task dialog (Kanban popup)
• (editor) Render link prompt inside the task dialog so it works in the Kanban popup (#​2940)
• (editor) Make link prompt a sub-modal — Escape cancels it without closing the task dialog
• (events) Build event doers without re-fetching the user
• (events) Handle nil auth when building event doers
• (export) Treat a missing export meta row as no export in the status
• (files) Never cache file downloads in v1 or v2
• (filter) Accept non-zero-padded dates in task filters
• (filters) Resolve relative and absolute date filters in UTC (#​3181) 🤖🤖🤖 (#​3229)
• (frontend) Render editor popups inside modal dialog top-layer
• (frontend) Guard caldav and totp settings routes when disabled
• (frontend) Guard Object.keys against null in refactored helpers
• (frontend) Restore tablet pagination layout (space-between + flex order)
• (frontend) Make sw.ts respect to frontend base URL
• (frontend) Fix hard-coded API base in checkAndSetApiUrl.ts
• (frontend) Use import.meta.env.MODE instead of DEV for testid directive
• (frontend) Respect week_start setting when language is not explicitly set
• (frontend) Add postcss-html as explicit devDependency
• (frontend) Focus quick actions input after modal opens
• (frontend) Respect user's 12h/24h time format in date pickers
• (frontend) Extend checkbox hit target to 44x44
• (frontend) Skip task detail on label and checkbox clicks
• (frontend) Scope checkbox hit-area pseudo to the task row
• (frontend) Ensure text color inherits in filter autocomplete component
• (frontend) Prevent avatar layout shift while loading
• (frontend) Wrap notifications in Teleport to appear above modals for #​2744
• (frontend) Fix buttons alignments in rtl direction
• (frontend) Restore quick actions menu styling and height limit
• (frontend) Auto-refresh relative dates as time passes
• (frontend) Scroll tall default modals instead of clipping their top
• (frontend) Zero seconds on api token custom expiry date
• (frontend/kanban) Honor server bucket redirect on drag (#​2618)
• (frontend/oidc) Prefix frontend base to redirect URL
• (frontend/vite) Configure vite dev proxy to handle frontend path
• (gantt) Preserve horizontal scroll when focusing a task bar
• (kanban) Prevent task taps from leaking through the sticky add-task footer on touch devices
• (kanban) Count tasks in bucket, not filter total, for saved-filter bucket limits
• (kanban) Upsert race condition in kanban task bucket sync (#​2938)
• (kanban) Authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)
• (kanban) Prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)
• (kanban) Pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)
• (keyvalue) Treat undecodable cached values as a cache miss
• (labels) Report owner-level max_permission
• (labels) Explain why link-share users can't create labels (#​3233)
• (license) Degrade to free when servers unreachable or key rejected
• (link-sharing) Resolve share read permission via project id so by-id reads work
• (migration) Reuse existing labels on re-import
• (migration) Tolerate non-numeric values in TickTick CSV exports
• (migration) Don't drop TickTick tasks sharing a malformed id
• (migration) Fail loudly if a deduplicated position pair has no row
• (modal) Open dialog reliably in electron desktop
• (modal) Clear stale data-closing flag when re-opened mid-close
• (modal) Skip showModal if enabled flipped false before mount
• (modal) Print full content of modal dialogs
• (models) Allow user-delete cascade to complete for disabled creators
• (models) Make API tokens work on /api/v2 routes
• (models) Validate API token permissions against v1+v2 route union
• (notifications) Pass lang to overdue reminder translation
• (notifications) Skip logo attachment for conversational mails
• (notifications) Strip remote images from notification emails
• (notifications) Refresh embedded users when reading notifications
• (notifications) Log unexpected user refresh failures
• (notifications) Use full user so notifications show display name
• (notifications) Queue mails only after the notification row is committed (#​3150)
• (notifications) Render Markdown in plain-text emails (#​3219)
• (oauth2server) Accept all loopback redirect forms
• (postgres) Resolve all statements against the configured schema (#​3156)
• (print) Hide bucket select icon
• (print) Hide description editor when no description is present
• (print) Hide reaction create button
• (project) Replace CAST(... AS int) with CASE WHEN for MySQL 8 compat
• (projects) Enforce write permission on target parent when duplicating a project (GHSA-f27p-pw2p-9pr4)
• (quick-add) Don't abort task creation when a label can't be created (#​3232)
• (relations) Correctly position quick add magic hint (#​2766)
• (routes) Set Cache-Control: no-store on /api/v2 too
• (routes) Apply rate-limit and metrics middleware to /api/v2
• (routes) Generate request IDs at the start of the middleware chain
• (search) Mirror ParadeDB BM25 matching into the subtask parent search condition
• (security) Clear plaintext user tokens for reset/confirm/deletion (GHSA-r6w9-259g-gwrv)
• (security) Hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)
• (security) Require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)
• (security) Reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)
• (static) Correct the API_URL value to replace in index.html
• (task) Print styles
• (task) Don't drop the list-view done save during the check animation
• (task) Recurring tasks return to original bucket when no default is set (#​2806)
• (task-comments) Derive update event doer from authenticated user
• (tasks) Let getCommentUrl handle frontendUrl including sub-path
• (tasks) Disable task glance tooltip on touch devices
• (tasks) Prevent duplicate task_positions rows and stale identifiers
• (tasks) Add labels sequentially when the backend db serializes writes
• (tasks) Reset description checklist when a recurring task recurs (#​2941)
• (tasks) Show filter-matched subtasks whose parent is filtered out (#​2952)
• (tasks) Prevent position race conditions with atomic upserts and locking (#​3098)
• (tasks) Bump project and task updated times when task sub-entities change
• (tasks) Make subtask root condition NULL-safe and search-aware (#​3197)
• (time-tracking) Reject inverted time-entry intervals
• (time-tracking) Cap smart-fill start at now so the range is never inverted
• (tooltip) Show tooltips in top layer when inside modal dialog
• (ui) Make code element background dark-mode aware and harden config store
• (user) Skip last-admin guard when target is already unreachable
• (user) Correct week_start validation range
• (user) Stop double-encoding FrontendSettings on UpdateUser (#​2793)
• (veans) Preserve unsent task fields on update via PATCH (#​2962)
• (views) Persist list/table sort across sidebar navigation (#​2778)
• (webhook) Use same casing for basic auth fields (#​2688)
• Fatal with clear message when keyvalue type is redis but redis is not enabled (85cfadc)
• Prevent package postinstall hang when generating jwt secret (9456223)
• Respect allow_icon_changes config on web and desktop (fb6f16a)
• Dispatch pending events after user creation commits (b867109)
• Blur quick add input on escape (5edc7b5)
• Don't re-login after logout when OIDC auto-redirect is enabled (e25ca7a)
• Use correct type for permission error (e1afa03)
• Adapt to sentry-go v0.47 API changes (c7413a1)
• Resolve golangci-lint v2.12 findings (93f8808)
• GCS signing issue ([#​2920](https://redirect.github.com/go-vikunja/vikunja/

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.