What go-vikunja/vikunja shipped
Written by FoxPlug from the repository's own releases; not affiliated with Vikunja. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/go-vikunja/vikunja; Vikunja did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of September 28, 2026
What shipped
- Vikunja 2.7.0 released with six security fixes, a new date picker, and an MCP server for task integration. Release
- Fixed Postgres connection failures when passwords contain special characters like @ by properly percent-encoding credentials. Pull request #4092
- Due date tooltips now respect 12/24-hour time format preferences, and time inputs can be confirmed with Enter key. Pull request #4078
- Settings now save only changed fields as a JSON Merge Patch instead of re-sending all settings on every change. Pull request #4087
- General settings form no longer reverts changes made elsewhere in the interface when saving. Pull request #4076
- Due reminders now show in the notification bell menu even when the mailer is disabled. Pull request #4085
- Rate limit errors on boot now show a helpful message instead of suggesting the API URL is incorrect. Pull request #4086
- Loading spinners now only appear after 100ms, preventing fast operations from flashing the spinner briefly. Pull request #4083
- Frontend typecheck errors reduced from 183 to zero with strict checking enabled in CI. Pull request #4069
- Sentry event scrubbing now removes plaintext credentials and one-time tokens from forms and query strings. Pull request #4074
Why it matters
Version 2.7.0 brings significant improvements to reliability, security, and user experience. The security fixes address authentication, credential handling, and data exposure issues, while fixes to settings persistence and UI responsiveness make the interface more stable. The database connection fix resolves a critical issue introduced in 2.7.0 that prevented startup with certain PostgreSQL passwords.
Changelog entry
- Fixed Postgres startup failures with passwords containing @ or: characters Pull request #4092
- Due date picker now respects 12/24-hour time format and Enter key confirms time input Pull request #4078
- Settings now send only changed fields as JSON Merge Patch instead of full replacement Pull request #4087
- Settings form no longer reverts changes made by other parts of the interface Pull request #4076
- Due reminders now display in notifications without requiring email delivery enabled Pull request #4085
- Boot screen now shows rate limit message instead of generic API URL error Pull request #4086
- Loading spinners only display after 100ms to prevent flashing on fast operations Pull request #4083
- Failed token refresh no longer logs user out on transient errors or network issues Pull request #4075
- Notification inbox now fetches only once after websocket subscription completes Pull request #4077
- Sentry no longer receives plaintext credentials or one-time tokens from forms and URLs Pull request #4074
- All 183 frontend typecheck errors resolved; CI now enforces zero typecheck violations Pull request #4069
- Admin project list now supports filtering by title and owner, plus column sorting Pull request #3926
Vikunja 2.7.0 is out. Security fixes, a new date picker, settings save only what changed, and an MCP server for AI assistants. Postgres connection fix for special-character passwords included.
Vikunja 2.7.0 released with six security fixes addressing credential exposure, token leakage, and authentication issues. New features include a date picker respecting time format preferences, smarter settings that only save changes, and an MCP server for AI assistant integration. Important fix: Postgres passwords with special characters now work correctly.
Week of September 21, 2026
What shipped
- Timer and task-comment events now reconcile through QueryClient, completing cross-tab timer synchronization. Pull request #3963
- Quick add with repeat now sets first due date to today at the user's default due time instead of leaving it unset. Pull request #4011
- Pasting rich text from webpages or other Vikunja descriptions now preserves formatting instead of converting to markdown. Pull request #4021
- Dragging tasks in Gantt view no longer crashes from recursive cache updates when related tasks are involved. Pull request #3968
- Dragging projects in the sidebar no longer breaks the sidebar layout with null reference errors. Pull request #3970
- Outgoing requests now respect HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables and support private proxies. Pull request #4015
- OIDC users are now linked by verified email when username matching fails, preventing duplicate accounts. Pull request #4012
- API v2 list endpoints now respect the service.maxitemsperpage configuration instead of hardcoding limits. Pull request #3977
- Broken images in user content no longer spam error reports to Sentry. Pull request #3969
- Loading buttons remain focusable for keyboard navigation instead of being disabled. Pull request #3972
Why it matters
This week completed a major refactor of data synchronization across tabs and fixed critical regressions in drag operations, pasting, and quick-add workflows. The stack also adds proper proxy support for corporate environments and improves error reporting.
Changelog entry
- Fix(editor): keep formatting when pasting rich text Pull request #4021
- Fix: support HTTP_PROXY and private proxies for outgoing requests Pull request #4015
- Fix(auth): link OIDC users by email when username fallback misses Pull request #4012
- Feat(quick-add): set first due date for repeating tasks without a date Pull request #4011
- Refactor(websocket): reconcile task and timer query caches Pull request #3963
- Refactor(time-tracking): move timers and entries into QueryClient Pull request #3962
- Refactor(subscriptions): finish generated subscription migration Pull request #3961
- Refactor(comments): migrate comments and paging to v2 queries Pull request #3960
- Refactor(reactions): migrate task and comment reactions to v2 Pull request #3958
- Refactor(attachments): migrate uploads and previews to v2 Pull request #3957
- Fix(api): respect service.maxitemsperpage in v2 list endpoints Pull request #3977
- Fix(frontend): hold sidebar project list updates until a drag ends Pull request #3970
- Fix(tasks): stop related task cache updates from recursing forever Pull request #3968
- Fix(frontend): don't report broken images inside user content Pull request #3969
- Fix(frontend): stop dropping DOMExceptions before they reach sentry Pull request #3971
This week: rich text paste works, quick-add sets due dates, timers sync across tabs, Gantt drag crashes fixed, and HTTP proxies work.
Week highlights: pasting rich text now preserves formatting, repeating tasks get a first due date, timers synchronize across browser tabs, and drag operations in Gantt and sidebar no longer crash. We also added proxy support for corporate networks and fixed OIDC email linking.
Week of September 14, 2026
What shipped
- Expose Vikunja's v2 REST API actions to MCP clients through /api/v2/mcp, deriving 24 typed tools from the OpenAPI document including projects, tasks, labels, comments, assignees, and user search. Pull request #3860
- Users can now discover the MCP endpoint in Settings → MCP, create a token with suitable permissions, and follow connection instructions for their client. Pull request #3864
- Replace the useTaskActions facade with direct mutations, breaking up the deleted Pinia task store into a quick-add composable and direct mutation calls. Pull request #3950
- Activate query-owned tasks and boards with navigation query scopes, date/form boundaries, and quick-add orchestration. Pull request #3941
- Gantt bars narrower than their title now show a tooltip with the full task name on hover. Pull request #3917
- About dialog now shows 'Pro active' when the server advertises enabled pro features via /info. Pull request #3925
- Fix atom feed returning 500 on task assigned notifications by setting Target to feed owner instead of dereferencing nil. Pull request #3916
- Store queued import uploads in the file storage backend (local or S3) instead of temp directory, allowing any instance to run the import job. Pull request #3889
- Parse Z-suffixed timestamps as UTC in caldav instead of server timezone. Pull request #3883
- Add /.well-known/change-password redirect to password change page for password manager support. Pull request #3897
Why it matters
MCP support opens Vikunja to external tools and clients, while the v2 API refactor continues consolidating the frontend onto a modern data layer. Multiple bug fixes resolve issues with feeds, migrations, caldav, and UI stacking.
Changelog entry
- Feat(mcp): expose v2 API tools over streamable HTTP Pull request #3860
- Feat(settings): add MCP connection setup Pull request #3864
- Refactor(tasks): replace the useTaskActions facade with direct mutations Pull request #3950
- Refactor(tasks): activate query-owned tasks and boards Pull request #3941
- Feat(gantt): show full title tooltip on bars too narrow for their label Pull request #3917
- Feat(frontend): show pro license status in about dialog Pull request #3925
- Fix(feeds): don't panic on task assigned notifications in atom feed Pull request #3916
- Feat(migration): store queued import uploads in the file storage Pull request #3889
- Fix(caldav): parse Z-suffixed timestamps as UTC Pull request #3883
- Feat: add /.well-known/change-password redirect Pull request #3897
- Fix(admin): show project owner with user component Pull request #3955
- Fix(frontend): bucket dropdown stacking and close-on-select in task detail Pull request #3947
- Fix(user)!: give colliding TOTP and account-locked error codes unique values Pull request #3901
- Fix(migration): stop file imports from timing out and locking the migration slot Pull request #3827
- Fix(restore): convert numeric bools when restoring into postgres Pull request #3898
- Fix(restore): restore empty json column values as NULL Pull request #3896
MCP tools now available via /api/v2/mcp. Set up in Settings → MCP with a token. Vikunja tasks, projects, labels, and more are now discoverable and callable from MCP clients.
Vikunja now supports Model Context Protocol (MCP), allowing external tools and clients to interact with tasks, projects, labels, comments, and more through typed REST actions. Users can set up MCP connections in Settings and generate tokens with suitable permissions. The v2 API continues its frontend migration with query-owned tasks and direct mutations, while fixes address feeds, caldav timestamps, and import reliability.