v5.0.0-rc3 Release Notes

Release Date: 7 November 2026

Note: The primary goal of this release was closing the v5.0 milestone: permission checks on dosql/do_* handlers, task moves and task logs, unguessable calendar feed tokens, English fallback for missing language packs, and upgrades that work on MySQL 8's default strict mode (including dotProject conversions). Changes that affect upgrades or Add On modules: migrations 072, 073 and 074 run on upgrade (074 drops contacts.contact_updatekey and contact_updateasked); upgrades now stop at the first failed statement and report it in full, and the failed migration is not recorded, so a fixed database can simply be re-run; index.php runs a dosql or a=do_* handler only when its module is active and the user can access it, so Add On handlers that relied on being reachable without module access will be refused (own preferences, own user record and own feed token stay self-service); existing calendar feed tokens keep working until regenerated, but a feed stops as soon as its user can no longer log in; the contact self-update feature (updatecontact.php / do_updatecontact.php) is removed; Carbon moves to 3.x and ircmaxell/password-compat is removed, so run composer install after upgrading; w2p_Exception_FileSystem is now w2p_Exceptions_FileSystem, and CAppUI::readFiles(), checkFileName() and loadCalendarJS() stay until v6.0 with deprecation notices naming their replacements.

Downloading & Installing

The only official distribution site is Github. Check out the Installation page to get started.

Reporting Problems

For more information, support, or to discussion upcoming features, please visit our Support Forums.

Any and all issues discovered should be added to our our Issue Tracking System. Feature requests should be marked as such and not described as issues. Please remember to mark Feature Requests as requests and not bugs.

If you’re not familiar with submitting a bug, please read my post: How To Submit a Bug

Fixes/Bugs Closed

Security
- Compare legacy MD5 passwords with hash_equals() (#474)
- Calendar feeds: random tokens, and no feed for users who can’t log in (#436); only the user or a Users editor can see or replace a feed URL
- index.php refuses dosql and do_* requests for modules the user can’t access (#463), and refuses unknown or malformed handlers instead of failing
- CAppUI::isActiveModule() loads the module list once per request instead of interpolating the name into SQL (#457)
- Tasks: check permissions before moving a task to another project (#472)
- Inactive tasks tab filters by project and task permissions in SQL (#476)
- Task logs: edit and delete rights are checked against the stored log, not the posted creator
- Files: stop including the HelpDesk add-on’s config.php (#466)
- Translation save requires the form token and a POST
- History: other users’ logins and logouts only for Users viewers; forum-message entries checked against the message’s forum
- Projects: qualify project_id in the permission filter
Authentication and sessions
- LDAP: fail the login when the local user can’t be created (#440)
- Sessions: session_user is set on insert, and the cron only removes stale anonymous sessions (#445)
- CUser::getIdByContactId() reads the user id from the list’s key (#441)
- Signup compares the e-mail address as it will be stored, so jane_doe@ and janedoe@ no longer collide
Upgrades and migrations
- Stop at the first failed statement and report the migration, statement, MySQL error, versions and next steps
- MySQL 8 strict mode: migrations before 056 and dotProject conversions run without the strict date modes; fixes to migrations 002, 004, 046, 056, 059, 070 and 071 (#532)
- dotProject conversions: add the 001 columns and sessions.session_user that dotProject lacks; 006, 012, 060 and 072 skip optional tables that don’t exist; 022, 023, 025 and 031 leave missing dates empty
- Migration 072 backfills history_project; 073 fills task_log_project; 074 drops the contact update-request columns
Dates, calendars and reports
- w2p_Utilities_Date::format() parses %-codes and copies other text (#519)
- getBeginWeek()/getEndWeek() return the ISO week of the date (#520)
- subtractSeconds(), getPrevDay() and getNextDay() work; addDays() moves by calendar days across DST
- isWorkingDay() ignores the Holiday add-on when its files are missing (#452)
- “Non-working day” translated in all locales (#454)
- Calendar feed lists events and tasks again and starts its hook buffer empty
- Events: getRecurrentEventforPeriod() is static, so recurring events no longer crash the day view and Events tabs (#530)
- Allocated User Hours lists the users and counts them (#524); weekly totals fixed; no static Date_Calc::weekOfYear() call
History, tasks, projects and custom fields
- History list filters by permission and paginates in SQL (#477)
- History records each entry’s project and lists it on the project tab (#525)
- Task logs fill task_log_project and follow their task between projects; deleting a task’s last log sets progress to 0; no undefined $extra read
- Custom fields are only saved when a store() was given them (#473, #527)
- Tasks: save an edited task once; dynamic parents’ percent complete updates again
- Projects: no nested saves for the budget total or a new project’s parent columns
Mail and forums
- Mail: Q-encode headers without preg_replace()’s removed /e modifier, so accented subjects aren’t blank (#523); read receipts and the Organization header fixed
- Forum BBCode renders on PHP 8 (#531)
Language packs (#495)
- Fall back to English when the user’s or host language isn’t installed (#501)
- locales/core.php checks that common.inc exists (#502)
- Installed languages are read once per request, not once per session (#503)
- English locale declares utf-8 (#504)

Misc Changes/Improvements

Remove the contact self-update request: updatecontact.php, do_updatecontact.php, the “Awaiting Update” UI and its locale strings
Remove ircmaxell/password-compat (#479); move nesbot/carbon to 3.x; tidy composer.json
Rename w2p_Exception_FileSystem to w2p_Exceptions_FileSystem (#467); the autoloader skips names with no file (#468)
Keep readFiles(), checkFileName() and loadCalendarJS() until v6.0 (#465)
Move the stray unit_tests/src/Web2project tests under unit_tests/classes/w2p (#469)
Add a PHPStan level 10 config and fix what it found: w2PformSafe() on objects, Resources typeSelect(), Query::loadList() on failure, unchecked file reads, preg_split() failure, fileviewer.php, and arguments that functions never accept
Remove the Scrutinizer config
Version set to 5.0.0 rc3

Open/Known Issues

The add-on upgrade guide doesn’t yet cover the __nonce form token, the #463 module check or the #473 custom-field rule (see web2project/manual#4 and web2project.github.io#9)
#533 Forum message bodies and titles are output without escaping (low: safe today only because bind() encodes on save)
#535 / #536 Converted dotProject sites lack some module rows and keep dotProject column types
#392 The PDF libraries and fonts are still in lib/ (planned for v6.0)
The unit test suite has not been re-run on the rc3 tag; the last run before it (541 tests) showed no new failures.