Starstruk Logo MarkStarstruk

v3.0.0

Worklenz/worklenzv3.0.0Aug 29, 2026by chamikaJ

AI Summary

v3.0.0 introduces the open-core edition, aligning Enterprise and Open Source versioning. It consolidates six months of development, introducing a client portal, project finance tools, and Slack integration.

Key Highlights

  • Open-core restructuring with Enterprise features moved to `src/ee/` seam
  • Client portal with invoices, services, chat, and portal settings
  • Project finance features including rate cards, expenses, and per-team currency
  • Security hardening via CodeQL (SSRF, XSS, ReDoS fixes)
  • Docker images published under `ghcr.io/worklenz`

New Features

  • Client portal
  • Project finance (rate cards, finance drawer)
  • Slack integration
  • Recurring tasks
  • Guest access level
  • Phase assignees
  • Task-comment soft delete

Full Release Notes

Worklenz **3.0.0** is the first release of the **open-core edition**. The open-source and Enterprise editions now share a version scheme — the Enterprise line is at 3.x, and future open-source releases continue from 3.x. The jump from `v2.1.7` reflects this alignment, not a break in the 2.x line.

This release consolidates roughly six months of work from the `development` branch onto `main`.

## Highlights

### Open-core restructuring
- Enterprise/Business features moved behind a dedicated `src/ee/` seam (backend and frontend) with their own `LICENSE.md`
- Exposed Business Plan source removed from the public tree
- Docker / Nginx management scripts and self-hosting setup restored and documented

### Features folded in from `development`
- **Client portal** — clients, invoices, services, requests, chat, portal settings
- **Project finance** — rate cards, finance drawer/table, expenses, per-team currency
- **Slack integration** — project + settings integration, channel management
- Home dashboard rework, planner/schedule views, recurring tasks, time entries
- Guest access level, phase assignees, task-comment soft delete, project links

### Security
- CodeQL pass on the merged tree: fixed SSRF in JIRA import, regex injection in comment mentions, ReDoS in the URL extractor, parameter type-confusion, tainted format strings, DOM XSS in entity decoding, and replaced hand-rolled HTML sanitizers with `sanitize-html` / DOMPurify (#410, #412)
- Earlier SQL-injection hardening across controllers (#369)

### Database
- ~40 new migrations (client portal, rate cards, notifications, holidays, indexes) — see `worklenz-backend/database/migrations`

## Upgrade notes
- Run pending database migrations before starting the new backend
- Docker images are published as `ghcr.io/worklenz/worklenz_backend` and `worklenz_frontend`, tagged `3.0.0`, `3.0`, `3`, and `latest`
- Users pinned to `:2` should review the migration set and the `src/ee/` licensing split before moving to `:3`

**Full diff:** https://github.com/Worklenz/worklenz/compare/v2.1.7...v3.0.0