LoginSign Up
← Back to all sparks
Redmine logo

Redmine

PM
Velocity0.0

Open source project management web application

www.redmine.org ↗

Redmine patches three security flaws in 7.0.2 and gives admins a page listing every webhook.

issue trackingself-hostedsecurity patchingwebhooksrailsopen source
◆Current state
Redmine 7.0.2 and 6.1.5 shipped at the end of September with three security fixes: private issue subjects exposed through the REST API, private project names and role assignments exposed through group memberships, and a DOM-based XSS on clipboard paste. Rails moves to 8.1.4 and 7.2.4 respectively. The 7.0 line also gets a webhook administration page, SVG icon caching and a fix for UI freezes on very large custom fields.
◆Where it's heading
The security cadence holds, and the two API leaks continue a run of defects where private data escapes through an include or list path. The 7.0 branch keeps absorbing polish around its headline webhook feature rather than adding new capability. This release names only the 7.0 and 6.1 series, where August's also covered 6.0.
◆Prediction
Expect another coordinated security release on the same two-to-three-month rhythm, with continued webhook and performance work on 7.0. Whether 6.0 returns to the coordinated set is unclear from these entries.

◆Recent moves

  1. 12d ago

    Redmine 7.0.3, 6.1.6 and 6.0.12 released

    Security releases across all three Redmine branches fix a wiki-macro ReDoS, a reflected XSS and back_url validation, with 7.0.3 and 6.1.6 also closing OAuth token-scope bypasses. Redmine now patches its legacy 6.0 branch whenever a High or Critical vulnerability is fixed.

    View source ↗
  2. 1mo ago

    Redmine 7.0.2 and 6.1.5 released

    Three security fixes cover two private-data leaks through the REST API and a clipboard-paste XSS, shipped on both 7.0 and 6.1. On 7.0 the release also adds a webhook admin page and fixes UI freezes on large custom fields, continuing the branch's polish phase.

    View source ↗
  3. 2mo ago

    Redmine 7.0.1, 6.1.4 and 6.0.11 released

    The first maintenance release on the 7.0 branch, backported to 6.1 and 6.0, carrying five security fixes plus a text-formatting performance regression fix and an addition to the wiki page list API. It is the follow-through that makes 7.0 safe to adopt rather than anything new.

    View source ↗
  4. 4mo ago

    Redmine 7.0.0 is now available

    ⚡ SPARK

    The anchor of the current arc: the first major version since 6.0, adding an outbound integration surface and resetting the framework baseline. Everything shipped since has been maintenance on the branch it opened.

    View source ↗
  5. 5mo ago

    Redmine 6.1.3, 6.0.10 and 5.1.13 released

    A coordinated security release across 6.1, 6.0, and 5.1 two weeks before 7.0.0 shipped, closing six defects including a permission bypass on bulk attachment downloads and a private-project name leak. Standard pre-major hygiene on the outgoing branches.

    View source ↗
  6. 8mo ago

    Redmine 6.1.2, 6.0.9 and 5.1.12 released

    The March coordinated release, seven security defects across three series plus thirty maintenance fixes on 6.1, including the RTL work that 7.0.0 would later complete. It marks where the current release rhythm was already established.

    View source ↗