Skip to main content

Tuleap Community Edition development and releases are no longer public. You have until September 30th to download packages and sources in Tuleap project. You can contact the team if you need further assistance.

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      rel #47138 17.6
    Details
    #47138
    Clarck Robinson (robinsoc)
    17.6
    Schedule
    2026-03-30
    19 (2026-04-24 00:00)


    Delivered
    Contents
    Referencing rel #47138

    Artifact

    request #27548 Introduce Vitest as the new default JS test runner
    request #27909 Move packages using `angular-mocks` to Vitest
    request #27921 Move packages with an independent typechecking step to Vitest
    request #35125 Explicitly import jest functions
    request #46359 Tracker report CSV export via API
    request #46397 Use Nix cache provided by Enalean instead of Cachix
    request #46739 🔥AngularJS - Merge all AngularJS "modules" into a single one
    request #46805 Simplify sql plan by replacing OR with UNION
    request #47192 Vite: 6.x to 8.x
    request #47203 web-auth/webauthn-lib 4.9.0 -> 5.2.4
    request #47217 Git repository commit list is not coherent
    request #47218 e2e are flacky since we introduce ProxySql
    request #47542 Add phpcs rule DoubleArrowNotAligned
    request #47543 Remove unused Workflowfactory::getTransitionId
    request #47545 Picomatch: 2.3.1 -> 2.3.2, 4.0.3 -> 4.0.4
    request #47546 yaml: 1.10.2 -> 1.10.3, 2.8.2 -> 2.8.3
    request #47547 league/commonmark: 2.8.1 -> 2.8.2
    request #47548 REST tests should not fail with MySQL 8.0
    request #47551 brace-expansion: 1.1.12 -> 1.1.13, 2.0.2 -> 2.0.3, 5.0.3 -> 5.0.5
    request #47552 Initialization of the dev environment is broken
    request #47553 handlebars: 4.7.8 -> 4.7.9
    request #47555 Node: 22.22.0 -> 22.22.2
    request #47559 JS tests are broken for Document app based on current date
    request #47560 Provide PHPWiki migration tools
    request #47561 Drop MySQL 8.0 support
    request #47562 Ignore Docker CVE-2026-33997 and CVE-2026-34040
    request #47563 Selecting a file should not override manually set file title
    request #47564 pnpm: 8.15.9 -> 10.33.0
    request #47565 github.com/go-jose/go-jose/v4 4.1.3 -> 4.1.4
    request #47566 Failed imported project stays in CreatingFromArchive status
    request #47568 Drop monaco-editor from our dev slide decks
    request #47570 lodash, lodash-es: 4.17.23 -> 4.18.1
    request #47571 autoprefixer: 10.4.18,10.4.21 -> 10.4.27, browserslist: 4.25.0,4.26.3,4.28.1 -> 4.28.2
    request #47573 Update dev/build environment [W15 2026]
    request #47574 Use git command directly to get branches
    request #47575 typescript-eslint: 8.43.0 -> 8.58.1
    request #47576 Fix database connection informations for IDE
    request #47577 Ignore temporarily Go stdlib vulns fixed in Go 1.26.2
    request #47578 Block "exotic" npm subdeps and prevent trust downgrade during upgrade
    request #47579 Refresh developer docs W15 2026
    request #47581 Bump to TypeScript 6.x
    request #47582 swagger-ui: 5.31.0 -> 5.32.2
    request #47583 Wasmtime: 42.0.0 -> 42.0.2
    request #47586 Git: 2.52.0 -> 2.53.0
    request #47587 MediaWiki: 1.43.6 -> 1.43.8
    request #47588 PullRequest owner should be able to add reviewer
    request #47589 follow-redirects: 1.15.11 -> 1.16.0
    request #47591 DOMPurify: 3.3.2/3.3.3 -> 3.4.0
    request #47593 SVN plugin can not be uninstalled and reinstalled
    request #47596 PSL: 5.0.0 -> 6.1.1
    request #47598 @vitejs/plugin-vue: bump to 6.0.6
    request #47599 DOMPurify: 3.4.0 -> 3.4.1
    request #47600 uuid 8.3.2 -> 14.0.0
    request #47601 "Special" chars are not well handled during setup of the DB user
    request #47602 Drop gettext-extractor transitive dependency
    request #47603 postcss: 8.4.49, 8.5.1, 8.5.3, 8.5.6, 8.5.8 -> 8.5.12
    request #47605 Lint shell scripts
    request #47606 Disable turborepo update notifier
    request #47607 Jira API breakage
    request #47608 Start using native TypeScript for typechecking when possible
    request #47609 Password expiration date makes ALL password expired
    request #47610 Move @tuleap/plugin-tracker-rich-text-editor to Vitest
    request #47612 Wasmtime: 42.0.1 -> 44.0.1
    request #47613 Tracker report XLSX export uses UTC for date timezone
    request #47614 Jira next-gen projects simple board can have sprints
    request #47615 Update dev/build environment [W19 2026]
    request #47616 Clear the downloads folder in report-export.cy.ts
    request #47617 axios: 1.15.0 -> 1.16.0
    request #47618 vue-eslint-parser: 10.2.0 -> 10.4.0
    request #47619 PHPSecLib: 3.0.51 -> 3.0.52
    request #47620 go.opentelemetry.io/otel: 1.39.0 -> 1.43.0
    request #47622 Create pull request button get too much information from REST API
    request #47623 Temporarily ignore GO-2026-4918 and GO-2026-4971
    request #47624 @babel/plugin-transform-modules-systemjs: 7.25.9 -> 7.29.5
    request #47625 fast-uri: 3.0.6 -> 3.1.2
    request #47626 Sprint planning drag and drop flaky test
    request #47627 Mermaid: 11.12.3 -> 11.15.0
    request #47628 Timetracking e2e tests are flaky
    request #47630 Use our standard dev image to run PHPUnit E2E tests
    request #47633 go-git: 5.13.2 -> 5.19.0
    request #47634 Bump to pnpm 11
    request #47635 Parallelize gettext extraction
    request #47636 Enable Rocky Linux security repo in Tuleap container images
    request #47637 brace-expansion: 5.0.5 -> 5.0.6
    request #47639 Open list value is not trimmed
    request #47640 ws: 8.17.1 -> 8.20.1
    request #47643 Text fields doesn't support more than 64kb of content
    request #47646 turbo: 2.9.4 -> 2.9.14
    request #47647 Update developer documentation
    request #47648 uuid: 8.3.2 -> 14.0.0
    request #47649 js-cookie: 3.0.5 -> 3.0.7
    request #47650 golang.org/x/crypto 0.50.0 -> 0.52.0
    request #47652 Wasmtime: 44.0.1 -> 44.0.2
    request #47653 qs: 6.14.2 -> 6.15.2
    request #47655 Realtime nginx config should `upgrade` in lowercase
    request #47656 tmp: 0.2.5 -> 0.2.6
    request #47657 stylelint: 16.19.1 -> 17.12.0
    request #47658 symfony/mailer: 7.2.3 -> 7.4.12
    request #47659 symfony/yaml: 8.0.1 -> 8.0.13
    request #47661 Some services do not start in dev web container
    request #47664 Failed imported project are counted in project list
    request #47667 Update dev/build environment [W24 2026]
    request #47668 Be more permissive with Tracker Functions max execution time
    request #47669 legacy modal v2 breaks cardwall JavaScript
    request #47671 Cannot start the container with an explicit port in TULEAP_FQDN
    request #47672 Mustache: move away from our fork based on 2.14.2 to 3.2.0
    request #47673 esbuild 0.25.1, 0.25.12, 0.27.7 > 0.28.1
    request #47675 Wasmtime: 44.0.2 -> 45.0.2
    request #47678 ws 8.20.1 -> 8.21.0
    request #47679 markdown-it 14.1.1 -> 14.2.0
    request #47680 js-yaml 3.14.2, 4.1.1 -> 4.2.0
    request #47681 tmp 0.2.6 -> 0.2.7
    request #47682 dompurify 3.4.1 -> 3.4.10
    request #47683 missing SQL_CALC_FOUND_ROWS
    request #47685 pnpm: 10.33.0 -> 10.34.2
    request #47686 PHPSecLib: 3.0.52 -> 3.0.55
    request #47687 Artifact update fails for project administrators
    request #47688 Node: 22.22.2 -> 22.23.0
    request #47694 dompurify 3.4.10 -> 3.4.11
    request #47697 User cannot edit/delete tracker reminder notification
    request #47702 Make the rules about the use of AI tooling explicit
    request #47704 linkify-it: 5.0.0 -> 5.0.1
    request #47707 Document images are no longer displayed
    request #47708 Update dev/build environment [W27 2026]
    request #47710 Bind db container to localhost
    request #47711 Archive bz2tuleap tool
    request #47712 pnpm: 10.34.2 -> 10.34.4
    request #47713 Mediawiki: 1.43.8 -> 1.43.9
    request #47714 Attach high-level SBOM to the published container images
    request #47716 restore modal trigger for tracker report "Save as..." button
    request #47718 Add new signing key for @goyotm
    request #47719 Typescript: upgrade from the native nightly to the stable 7.0
    request #47720 Temporarily ignore CVE-2026-42505 / GO-2026-5856
    request #47721 Make tables in embedded document usable
    request #47722 Update developer unit testing doc
    request #47724 Setup vulnerability scan for "high-level" tools
    request #47726 systeminformation 5.31.6 -> 5.31.17
    request #47727 Update the FFT part of the documentation
    request #47728 git other group permission delegation is flacky
    request #47729 Widget document under review still exposes the legacy url
    request #47730 Program Management project creation timeout
    request #47731 Ignore AngularJS CVE-2026-11998
    request #47732 Add missing indexes on the invitations table
    request #47733 Sanitize pasted HTML content in the ProseMirror editor
    request #47734 the navigation to section can be incorrect in artidoc
    request #47736 guzzlehttp/guzzle: 7.12.1 -> 7.15.1
    request #47738 socket.io: 4.6.2 -> 4.8.3
    request #47739 js-yaml 4.2.0 -> 4.3.0
    request #47740 brace-expansion: 1.1.13 -> 1.1.16, 2.0.3 -> 2.1.2, 5.0.6 -> 5.0.7
    request #47741 body-parser: 2.2.1 -> 2.3.0
    request #47742 Flaky JS taskboard test suite
    request #47743 dompurify 3.4.11 -> 3.4.12
    request #47744 Artifact link field can take a long time to load
    request #47745 fast-uri -> 3.1.4
    request #47746 golang.org/x/text: 0.37.0 -> 0.39.0
    request #47748 google.golang.org/grpc: v1.79.3 -> v1.82.1
    request #47750 Replace MailHog with MailPit
    request #47752 postcss 8.5.12, 8.5.15 -> 8.5.23
    request #47753 Setup Mago analyzer
    request #47754 Flaky phpwiki-notifications e2e test
    request #47755 brace-expansion: 5.0.7 -> 5.0.8
    request #47757 MySQL: 8.4.10 -> 8.4.11
    request #47758 immutable: 5.1.5 -> 5.1.9
    request #47759 swagger-ui: 5.32.9 -> 5.32.13
    request #47761 MyProjects widget should only let you massmail members when you are a member of a project
    request #47762 Node: 22.23.0 -> 22.23.2
    request #47763 Passwordless authentication should not allow to enumerate existing user accounts
    request #47767 brace-expansion 1.1.16 -> 1.1.18, 5.0.8 -> 5.0.9
    request #47768 Update dev/build environment [W32 2026]
    request #47769 Wasmtime: 46.0.1 -> 46.0.2
    request #47771 guzzlehttp/guzzle: 7.15.1 -> 7.15.2
    request #47772 fast-uri: 3.1.4 -> 3.1.5
    request #47773 socket.io-parser: 4.2.6 -> 4.2.7
    request #47776 Users can spam the history log of a project
    request #47778 Potential stored SQL injection in a 2015 DB migration bucket
    request #47779 Use nginx normalized $uri instead $request_uri to avoid cache bust/config bypass
    request #47781 OAuth2 flow can reject HTTPS request forwarded by a trusted reverse proxy
    request #47783 league/commonmark: 2.8.2 -> 2.9.0
    request #47784 squizlabs/php_codesniffer: 4.0.1 -> 4.0.4
    request #47786 smarty/smarty: 5.7.0 -> 5.8.4
    request #47788 E2E PHPUnit based tests are never executed
    request #47790 Silence temporarily image-size CVE-2025-71330 and CVE-2025-71329
    request #47791 Add shellcheck linting at the error level
    request #47792 Users might still be visible in document item notifications after being removed from a private project
    request #47793 storybook: 10.2.13 -> 10.5.7
    request #47794 Update dev/build env [W33 2026]
    request #47795 Setup linter rules with Mago
    request #47796 Silence temporarily extract-zip CVE-2026-56876
    request #47797 nanoid: 3.3.17 -> 3.3.18
    request #47799 user password recovery must be covered by e2e test
    request #47800 Temporarily ignore GO-2026-5026, GO-2026-5972, GO-2026-6090, GO-2026-6218 and GO-2026-6089
    request #47804 user preference e2e test is flacky
    request #47806 ProjectTest Rest are flacky
    request #47808 Test REST gerrit are flacky
    request #47810 bug on XTS visitGreaterThanOrEqualComparison() passes $metadata_greater_than_comparison_checker instead of a >=checker
    request #47814 Rest tests - program management instantiation is flacky
    request #47815 flacky e2e Unhandled exception: u/ProjectMember/MyRepository08930477/MyRepository.git is not a git repository:
    request #47816 Tracker report multi-tracker export export in colums instead of rows
    request #47820 eslint-plugin-storybook: 0.12.0 -> 10.5.7
    request #47821 ProxySQL: 3.0.10 -> 3.0.11
    request #47823 bump league/commonmark 2.9.0 => 2.10.0
    request #47825 bump postcss-selector-parser to 6.1.3 && 7.1.3
    request #47827 fast-uri: 3.1.5 -> 3.1.6
    request #47828 qs: 6.15.2 -> 6.16.0
    request #47829 @humanfs/node: 0.16.7 -> 0.16.8
    request #47830 PHP dependencies are missing from SBOM analysis
    request #47831 flacky TTM test
    request #47832 flacky XTS integration tests
    request #47836 vitest: 4.1.2 -> 4.1.11
    request #47837 js-yaml: 4.3.1 -> 4.3.2
    request #47841 colord: 2.9.3 -> 2.9.4
    request #47842 google.golang.org/grpc: 1.83.1 -> 1.83.2
    request #47844 override extract-zip to -
    request #47848 Silence temporarily extract-zip CVE-2026-56876
    request #47849 flacky e2e on tracker multi report export
    request #47853 project can be created from archive is flacky
    request #47858 Update dev/build env [W38 2026]
    request #47860 Use tarball from releases.nixos.org to get nixpkgs content
    request #47861 otlptrace: 1.31.0 -> 1.46.0
    request #47864 French translation error in create artifact from kanban
    request #47866 Do not override tabs / spaces in Prettier configuration
    request #47868 Bump to pnpm 12
    request #47870 Enable SVN cache option introduced in 1.7 and short circuit Apache authorization
    Referenced by rel #47138

    Artifact

    story #42227 Have pie chart graph
    Display settings

    Follow-ups