Darko Gjorgjijoski
03bb6f1164
A third pre-release, to verify the pipeline end to end after beta.2 exposed a hole in it: that release was published by the workflow itself, so nothing downstream ran and it reached the updater only by being registered by hand — and never got Docker images at all. This one exercises the corrected flow. The tag produces a draft; a human publishes it, which is what actually triggers registration and the image build. Contains no application changes — everything on 2.x since beta.2 is release tooling and repository housekeeping, and the changelog entry says so. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF
7.0 KiB
Changelog
Release notes for the 2.x line. Each ## heading is a released version, and the
section beneath it is what CI publishes to the updater — see
.github/scripts/changelog-section.php.
Releases before 2.4.0 are on GitHub: https://github.com/InvoiceShelf/InvoiceShelf/releases
2.4.3-beta.3 — 2026-07-29
A third pre-release, cut to verify the release pipeline end to end after the previous one exposed a hole in it. It contains no application changes.
- Releases now stop at a draft, and publishing is a deliberate act. 2.4.3-beta.2 was published by the workflow itself, and because GitHub does not start workflow runs from events raised by
GITHUB_TOKEN, nothing downstream ran — that release reached the updater only after being registered by hand, and never got Docker images. - Laravel Boost has been removed and
AGENTS.mdis now the single source of truth for contributor and agent guidance, matching the 3.x branch.
Insider channel only. 2.4.2 remains current on stable and there is nothing here you need.
2.4.3-beta.2 — 2026-07-29
A second pre-release, cut to exercise the tag-triggered release flow. It contains no application changes — the only thing on 2.x since beta.1 is the release tooling itself:
- Releases are now cut by pushing a tag. The notes come from this file, the package is attached before the release is published, and a tag with no changelog section stops the run before anything is published.
This is the first release on this branch created without anyone publishing it by hand. Insider channel only; 2.4.2 remains current on stable and there is nothing here you need.
2.4.3-beta.1 — 2026-07-29
A pre-release cut to exercise the release pipeline end to end. It contains no application changes — everything since 2.4.2 is release tooling:
- Registration on the updater is fixed, and can now be re-run for an existing tag without production access. Previously a failure there left a release published but offered to nobody.
- Re-running a registration no longer rebuilds and republishes the
:latestDocker image as a side effect. - Release notes now come from
CHANGELOG.md, so what installs are offered is written and reviewed alongside the change rather than composed at publish time.
Insider channel only. If you are on stable, 2.4.2 remains current and there is nothing here you need.
2.4.2 — 2026-07-29
Maintenance release for the 2.x line, fixing five issues reported against the Docker images. Recommended for all self-hosted 2.x installs.
Containers failing to start on mounted volumes
The entrypoint now recreates storage/framework, storage/logs and storage/app when a volume is missing them, instead of leaving the app to die with Please provide a valid cache path. Docker seeds a named volume only once, when it is empty, so a volume created by an older image never gained those directories on its own.
It also no longer aborts on a chown it has no permission to make — a single file owned by your host user was previously enough to stop the container booting. If a mount genuinely is not writable, startup now says so and names the fix rather than failing later with a stack trace.
Fixes docker#75, docker#69; improves docker#77 and docker#63.
The application timezone was ignored
APP_TIMEZONE had no effect at all, so recurring invoices and scheduled tasks always ran on UTC no matter what you configured. Setting TIMEZONE on the container now works as documented.
Behaviour change: if you have been setting TIMEZONE expecting it to work, your schedules will move to that timezone after upgrading. Fixes docker#64.
Setup wizard blank on MariaDB
A fresh install using the shipped docker-compose.mysql.yml could not get past the database step, because that file sets DB_CONNECTION=mariadb and the wizard had no form for it. Fixes docker#79.
Gotenberg on a private network
The SSRF guard added in 2.4.0 rejected http://pdf:3000 — its own shipped default — which made the standard sidecar setup impossible to configure. Name the host you trust to permit it, and only it:
GOTENBERG_ALLOWED_PRIVATE_HOST=http://pdf:3000
Every other private address stays blocked, so the setting cannot be repointed at an internal service. Fixes #688.
PHP 8.5 compatibility
PDO::MYSQL_ATTR_SSL_CA is deprecated in PHP 8.5; the correct constant is now resolved per version. No change on PHP 8.4.
Docker: invoiceshelf/invoiceshelf:2.4.2 (also :latest, :2, :2.4).
2.4.1 — 2026-06-14
Security patch for the 2.x line.
Fixes a multi-tenant authorization issue in user management where a company owner could access user accounts belonging to another company. All self-hosted 2.x installs should update.
Docker: invoiceshelf/invoiceshelf:2.4.1 (also :latest, :2, :2.4).
2.4.0 — 2026-06-12
2.x is entering feature freeze
InvoiceShelf 2.4.0 marks the feature freeze for the 2.x line. New feature development now moves to the next-generation 3.x branch. From here, 2.x will receive security patches only, through September 1, 2027 (2027-09-01) — no new features, but it stays supported and safe to run. We recommend planning your upgrade to 3.x before then; the in-app updater path to 3.x is being prepared.
This release rolls up the final round of 2.x work: security hardening, dependency updates, groundwork for a clean v2 → v3 upgrade, a move to pnpm for the frontend toolchain, and a couple of contributor features.
Security
- Enforce company scope on notes, estimate→invoice conversion, and user bulk-delete — GHSA-85wc, GHSA-j2vg, GHSA-wxrv (#661)
- Harden public EmailLog token endpoints — GHSA-73q7 (#662)
- Validate
ORDER BYinput on list endpoints — GHSA-cp8p (#663) - Restrict the Gotenberg renderer host to public addresses — GHSA-mfxg (#664)
- Recompute document totals server-side so client-supplied totals aren't trusted — GHSA-8c69 (#665)
- Update dependencies to patched versions (#674):
laravel/framework(CVE-2026-48019),symfony/*,guzzlehttp/psr7,vite - Patch frontend dependencies — axios, vite, postcss, follow-redirects (#653)
Improvements
- Add duplicate expense action (#617) — @mchev
- Support 3-decimal tax percentages, e.g.
6.625%(#616) — @mchev - Updater: manifest-based stale-file cleanup + cache clearing, preparing a clean v2 → v3 in-app upgrade path (#659)
Build & Tooling
- Migrate the frontend toolchain to pnpm and pin a stable Vite build (#666, #674)
Translations
- New Crowdin translation updates across many locales (#615)
ℹ️ The CSV export work (#649) was reverted before this release and is deferred.
Full Changelog: https://github.com/InvoiceShelf/InvoiceShelf/compare/2.3.3...2.4.0