Version: 3.9.7

Highlights

Cross-Project Program Views

Task views can now span multiple projects as programs, with sprints inherited across the program board so you can plan and track work at a higher level. (#3587)

New Features

• Personal Access Tokens - Completed the move of personal access token management into core with a dedicated token controller and language keys (#3597)
• MCP Domain Tools - Reorganized MCP tool classes into their respective domain modules (#3581)

Bug Fixes

• Program Board - Fixed milestones, kanban rendering, and status rollup clarity on the program board (#3592)
• MCP Runtime - Repaired runtime bugs in domain tools uncovered during live end-to-end testing (#3586)
• System Update - System updates now properly clear cached bootstrap manifests.
• General Fixes - Resolved a batch of recently reported bugs (#3540, [#3331], [#3310], [#3589], [#3330], [#3546], [#3593])

Improvements

• API Rate Limit - Raised the default API rate limit from 10 to 120 requests per minute (#3591)

What's Changed

Other Changes

• fix: resolve recent reported bugs (#3535, [#3539], [#3536], [#3542]) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3547
• fix: define $groupId variable before Blade component render in kanban view by @GautamKumarOffical in https://github.com/Leantime/leantime/pull/3554
• feat(components): forms.button — migrate all buttons + establish the role model by @marcelfolaron in https://github.com/Leantime/leantime/pull/3531
• feat(events): class-based domain events + filters with legacy-string plugin bridge (Tickets pilot) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3503
• chore(phpstan): raise static analysis to level 2 (429→0, fix-forward) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3559
• feat(components): forms.text-input no-op primitive + migrate 146 inputs (56 files) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3558
• feat(core): extract shared AI/MCP support classes and add PAT management by @marcelfolaron in https://github.com/Leantime/leantime/pull/3560
• chore(phpstan): raise static analysis to level 3 (46→0, fix-forward) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3561
• chore(phpstan): raise static analysis to level 4 (227→0, dead-code removal) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3565
• feat(components): forms.textarea no-op primitive + migrate 10 plain textareas by @marcelfolaron in https://github.com/Leantime/leantime/pull/3562
• feat(components): migrate 44 class=button submit inputs to forms.button by @marcelfolaron in https://github.com/Leantime/leantime/pull/3563
• chore(phpstan): climb to level 5 (argument types) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3566
• feat(components): button + text-input completion round 2 (53 missed elements) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3564
• fix: batch of open bug fixes (#3555, [#3575], [#3571], [#3568], [#3569], [#3570]) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3577
• fix(users): strip credentials from getUser API responses (#3556) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3576
• feat(users): getMyDaySchedule @api (work hours + timezone) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3579
• feat(content-templates): generic templates domain (Phases 1, 3, 3b, 3c, 3d, 4) by @gloriafolaron in https://github.com/Leantime/leantime/pull/3493
• fix(projects): resolve user role inheritance when adding user to project (supersedes [#3572]) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3580
• refactor(js): update internal /api/* calls to canonical domain routes by @ellitedom03 in https://github.com/Leantime/leantime/pull/3557
• fix(js): encode avatar-src user id to clear CodeQL xss-through-dom alerts by @marcelfolaron in https://github.com/Leantime/leantime/pull/3582
• harden(plugins): require permission for plugin management + tighten install input by @marcelfolaron in https://github.com/Leantime/leantime/pull/3583
• harden(security): authz, SSRF, reset-token, LDAP, and stored-XSS fixes by @marcelfolaron in https://github.com/Leantime/leantime/pull/3584
• Release v3.9.6 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3585
• feat(domains): move MCP tool classes into domain modules by @marcelfolaron in https://github.com/Leantime/leantime/pull/3581
• fix(mcp): repair runtime bugs in domain tools found in live e2e testing by @marcelfolaron in https://github.com/Leantime/leantime/pull/3586
• feat(tickets,sprints): cross-project (program) task views + inherited sprints by @marcelfolaron in https://github.com/Leantime/leantime/pull/3587
• chore(ratelimit): raise the default API limit from 10 to 120 req/min by @marcelfolaron in https://github.com/Leantime/leantime/pull/3591
• fix: program board follow-ups — milestones, kanban render, status rollup clarity by @marcelfolaron in https://github.com/Leantime/leantime/pull/3592
• fix: batch of open bug fixes (#3540, [#3331], [#3310], [#3589], [#3330], [#3546]) by @marcelfolaron in https://github.com/Leantime/leantime/pull/3593
• fix(auth): complete PAT move to core — add TokenNew controller and language keys by @marcelfolaron in https://github.com/Leantime/leantime/pull/3597
• Release v3.9.7 by @marcelfolaron in https://github.com/Leantime/leantime/pull/3596

New Contributors

• @GautamKumarOffical made their first contribution in https://github.com/Leantime/leantime/pull/3554
• @ellitedom03 made their first contribution in https://github.com/Leantime/leantime/pull/3557

Full Changelog: https://github.com/Leantime/leantime/compare/v3.9.5...v3.9.7