What go-vikunja/vikunja shipped

Vikunja 2.8.0 is out: 19 security fixes, a trash bin with undo for tasks and projects, and SSO account linking. Also this week: linked accounts settings, bulk webhook event selection, and code block copy buttons.

Vikunja 2.8.0 is out, fixing 19 security issues, so updating soon is recommended. It adds a trash bin with undo for tasks and projects, and lets you link your SSO account to your local one. This week also completed the trash UI with delete dialog counts, added project trash that keeps deleted projects for 30 days, and allowed time entries without a project or task. OIDC account linking now spans the data model, v2 endpoints and a Linked accounts settings page. Webhook forms gained select-all and per-group event toggles, and code blocks in preview mode got copy buttons.

This week: reminders follow subscriptions only, CalDAV UID lookups return the matching task, unsupported calendar uploads answer 403 instead of 500, backdated timers no longer create overlaps, legal links are configurable, and MPTCP is disabled on listen sockets.

This week's changes to Vikunja focus on fixes people run into daily. Reminders and overdue reminders now go only to task subscribers, so unsubscribing finally stops them for creators and assignees. CalDAV calendar-query applies prop-filter and text-match to tasks, so looking up a task by UID returns that task rather than the whole project, and uploads of VEVENT, VJOURNAL or unparsable files get a 403 instead of a 500 that made clients retry forever. Starting a timer with a past start time now ends overlapping entries. Legal links can be configured as any number of entries, with the old imprint and privacy settings still working but deprecated. Bot user objects show who created them, veans login works on headless machines via a pasted redirect URL, and MPTCP is disabled on listen sockets to

Vikunja 2.7.1 is out with 41 security fixes, reworked attachment previews and signed Docker images. This week also adds accent-insensitive Postgres search, spelled-out relative dates in quick add, per-user time entries with dates, and jpeg previews kept in file storage. Please up

Vikunja 2.7.1 is out, with 41 security fixes from community reports and an audit, reworked attachment previews and signed Docker images. Please update as soon as you can. Also shipped this week: accent-insensitive search on Postgres using unaccent, quick add magic now understands spelled-out dates like in two weeks, time entries show who tracked them and include the date, image previews are persisted as jpeg in file storage instead of keyvalue, a Shift+T shortcut marks a task done and returns to the list, table view has a quick-add input, and packaged installs now persist a service secret so restarts no longer log everyone out.

Bulk task updates now change only the fields you name, so descriptions, dates and priority are not wiped. Monthly tasks set on the 31st clamp to the last valid day. CSV imports decode UTF-16, and starting a timer uses the start time you picked.

This week the project got fixes for several common workflow problems. Bulk task updates now write only the fields you name, so a missing or empty fields list no longer replaces descriptions, dates or priorities. Monthly repeating tasks set on the 31st now clamp to the last valid day of shorter months. CSV imports decode UTF-16 and drop NUL bytes, fixing failures on Postgres. Starting a timer uses the start time chosen in the Log time form. MCP read tools accept an optional fields parameter to return only requested paths. Kanban auto-scroll works on mobile during drags, and the datepicker jumps to minutes after typing the hour.

Vikunja 2.7.0 is out. Security fixes, a new date picker, settings save only what changed, and an MCP server for AI assistants. Postgres connection fix for special-character passwords included.

Vikunja 2.7.0 released with six security fixes addressing credential exposure, token leakage, and authentication issues. New features include a date picker respecting time format preferences, smarter settings that only save changes, and an MCP server for AI assistant integration. Important fix: Postgres passwords with special characters now work correctly.

This week: rich text paste works, quick-add sets due dates, timers sync across tabs, Gantt drag crashes fixed, and HTTP proxies work.

Week highlights: pasting rich text now preserves formatting, repeating tasks get a first due date, timers synchronize across browser tabs, and drag operations in Gantt and sidebar no longer crash. We also added proxy support for corporate networks and fixed OIDC email linking.

MCP tools now available via /api/v2/mcp. Set up in Settings → MCP with a token. Vikunja tasks, projects, labels, and more are now discoverable and callable from MCP clients.

Vikunja now supports Model Context Protocol (MCP), allowing external tools and clients to interact with tasks, projects, labels, comments, and more through typed REST actions. Users can set up MCP connections in Settings and generate tokens with suitable permissions. The v2 API continues its frontend migration with query-owned tasks and direct mutations, while fixes address feeds, caldav timestamps, and import reliability.