Worklenz Files

Worklenz 3.0.0 is the first release of the open-core edition. The open-source and Enterprise editions now share a version scheme — the Enterprise line is at 3.x, and future open-source releases continue from 3.x. The jump from v2.1.7 reflects this alignment, not a break in the 2.x line.

This release consolidates roughly six months of work from the development branch onto main.

Highlights

Open-core restructuring

• Enterprise/Business features moved behind a dedicated src/ee/ seam (backend and frontend) with their own LICENSE.md
• Exposed Business Plan source removed from the public tree
• Docker / Nginx management scripts and self-hosting setup restored and documented

Features folded in from development

• Client portal — clients, invoices, services, requests, chat, portal settings
• Project finance — rate cards, finance drawer/table, expenses, per-team currency
• Slack integration — project + settings integration, channel management
• Home dashboard rework, planner/schedule views, recurring tasks, time entries
• Guest access level, phase assignees, task-comment soft delete, project links

Security

• CodeQL pass on the merged tree: fixed SSRF in JIRA import, regex injection in comment mentions, ReDoS in the URL extractor, parameter type-confusion, tainted format strings, DOM XSS in entity decoding, and replaced hand-rolled HTML sanitizers with sanitize-html / DOMPurify (#410, [#412])
• Earlier SQL-injection hardening across controllers (#369)

Database

• ~40 new migrations (client portal, rate cards, notifications, holidays, indexes) — see worklenz-backend/database/migrations

Upgrade notes

• Run pending database migrations before starting the new backend
• Docker images are published as ghcr.io/worklenz/worklenz_backend and worklenz_frontend, tagged 3.0.0, 3.0, 3, and latest
• Users pinned to :2 should review the migration set and the src/ee/ licensing split before moving to :3

Full diff: https://github.com/Worklenz/worklenz/compare/v2.1.7...v3.0.0