v16.4.1

frappe/hrmsv16.4.1Feb 18, 2026by frappe-pr-bot

AI Summary

Security and UX improvement release preventing accidental payments for rejected expense claims and securing employee data access in roster.

Key Highlights

Removes 'Create Payment' button when Expense Claim is Rejected
Uses secure client API to load employee details in Roster shift assignments
Prevents access to private employee fields, showing only Employee Name, Company, and Department

New Features

Security improvement for employee data access
UX improvement preventing accidental payment entries

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v16.4.1 -->

## What's Changed
* Removes the "Create Payment" button when an **Expense Claim** is _Rejected_, preventing accidental payment entries for declined claims. (https://github.com/frappe/hrms/pull/4138)
* Uses the secure client API to load employee details in **Roster** shift assignments, now showing only the employee’s _Employee Name_, _Company_, and _Department_ and preventing access to other private fields. (https://github.com/frappe/hrms/pull/4148)


**Full Changelog**: https://github.com/frappe/hrms/compare/v16.4.0...v16.4.1
**Authors**: @nareshkannasln, @iamkhanraheel, @asmitahase
**Reviewers**: @ruchamahabal, @asmitahase

<details>
<summary>AI content</summary>

 For these release notes, we used an LLM (OpenAI o3) to review and summarise the code changes, along with the associated issue and PR descriptions. It may contain typical errors and inaccuracies. You can read the prompt [here](https://github.com/barredterra/pretty_release_notes). 

Changes with the following labels were excluded:
- skip-release-notes

Changes with the following types were excluded:
- ci
 - docs
 - refactor
 - build
 - test
 - chore
 - style

</details>