Vikunja vs Sunsama
Side-by-side trajectory, velocity, and editorial themes.
Vikunja crossed the v1.0 finish line and pivoted hard into security hardening.
Vikunja shipped two v1.0 release candidates through late 2025 and early 2026, then jumped to a v2 series whose first widely-tagged point release, v2.2.1, is dominated by security work. The latest release patches multiple SSRF and IDOR vulnerabilities, enforces disabled/locked-account semantics across every auth surface (OIDC, API tokens, CalDAV, LDAP), and adds a shared SSRF-safe HTTP client that webhooks and migrations now route through. User-facing feature work has slowed; the visible energy is in plumbing and audit cleanup.
The arc moves from feature-completion (S3 storage, drag-and-drop project moves, hover previews in late 2025) toward platform credibility — closing security gaps a self-hosted task tool needs to clear before serious team adoption. The rapid version-number jump from v1.0.0-rc4 to v2.2.1 in two months suggests v1.0 shipped and the team tagged a v2 line aimed at addressing accumulated authz debt. Expect the next several releases to keep the security-first posture rather than return to a feature push.
The next release will likely continue closing remaining authz edges (more IDOR audits, additional credential-stripping in API responses) and bundle a translations and dependency sweep. A user-facing feature push probably waits until the security work plateaus.
Sunsama ships Task Priority + Auto-Sort and starts wiring Sunny into MCP — daily planning gets opinionated.
Sunsama is in steady weekly-release cadence, with the bulk of recent work concentrated in two places: the Task Priority + Auto-Sort system, which has just graduated from beta into a documented core feature, and the Sunny AI assistant, which is gaining persistent memory and MCP-callable primitives like get_task_by_id. The integration surface continues to deepen — Linear, Todoist, Jira, Asana imports now carry priority signal through into Sunsama's own model.
The product is moving from 'manual daily planner' toward 'opinionated planner that can be driven by Sunny or external agents.' Auto-Sort is the most telling move: Sunsama is now willing to reorder the user's day on its own based on priority and scheduled time, which is a philosophical step away from the manual drag-and-drop heritage. The MCP work signals they want Sunsama to be addressable by other AI tools — not just consumed via the Sunny UI.
Expect the next few weekly drops to expand Sunny's MCP toolset (write actions, not just reads) and to roll priority rollover into more of the integration importers. A 'Sunny plans your day' end-to-end flow that leans on the new priority + auto-sort plumbing is the natural next milestone.
See more alternatives to Vikunja →
See more alternatives to Sunsama →