Vikunja

Vikunja

@vikunja.io

The open source to-do app to simplify your life. Built by @kolaente.de Check out vikunja.io to learn more.

253 followers1 following49 posts

Vikunja
@vikunja.io

📢 Tomorrow we'll release Vikunja v2.7.1, with fixes for a whopping 44 Security issues of different severities (only 2 high, most medium and low).

Vikunja
@vikunja.io

🚀 Vikunja 2.5.0 is out! Small release, 203 commits of cleanup. 🔒 One security fix: a share link could act as another user. Please update. ⚡ Pasting a list into quick add magic now creates every task in one request, in the order you wrote them. Plus a lot of CalDAV, notification and import fixes 🦙

vikunja.ioVikunja 2.5.0: A security fix, faster multiline task creation, and a lot of bug fixesVikunja 2.5.0 fixes a security issue with share links, makes creating many tasks at once fast and reliable, and spends the rest of its 203 commits on bug fixes across CalDAV, notifications, imports, f...
Vikunja
@vikunja.io

In 2020 the EU's open-source strategy was a memo about its own code. Today's wants Europe to build open alternatives to US software. Good, and overdue. But it's non-binding and underfunded. The lever it keeps ignoring: its own ~€264B/year procurement budget. vikunja.io/changelog/eu...

vikunja.ioFor EU Open Source, the Budget Is the PolicyThe EU's new Open Source Strategy is a real step forward, but it still has no procurement teeth. Here is what changed since 2020, what hasn't, and why the budget Brussels already controls is the polic...
Vikunja
@vikunja.io

cal.com's argument for going closed source is that AI has made it too easy for attackers to find bugs in open code. It's security-through-obscurity dressed for 2026. It doesn't hold up, and the view from the receiving end looks nothing like the headline.

View full thread
Vikunja
@vikunja.io

Concrete case in Vikunja: CVE-2026-28268. Password reset tokens weren't cleaned up after use. The bug had been there since v0.18.0, shipped September 2021. Almost 5 years. It got caught because the code was public, and a researcher (probably with AI) could look at it and report it responsibly.

Vikunja
@vikunja.io

Transparency trades "bugs found later by the wrong people" for "bugs found earlier by the right ones." The full argument, including why Vikunja staying open is more than a personal promise: vikunja.io/changelog/vi...

vikunja.ioOn Cal.com, AI security reports, and why Vikunja can't easily closeA response to Cal.com going closed source: why security-through-obscurity doesn't hold up, what AI-assisted security reports actually look like from the receiving end, and the structural reasons Vikun...
Vikunja
@vikunja.io

cal.com's argument for going closed source is that AI has made it too easy for attackers to find bugs in open code. It's security-through-obscurity dressed for 2026. It doesn't hold up, and the view from the receiving end looks nothing like the headline.

Vikunja
@vikunja.io

Hiding the code doesn't hide the bugs. AI fuzzes binaries, runs static analysis on anything shipped to a customer, and probes the API surface directly. Closed source just means whoever finds the bug has no obligation to tell you first.

Vikunja
@vikunja.io

Anthropic's Project Glasswing, announced earlier this month, is partnered with open-source maintainers. Linux Foundation is a founding participant. That 27-year-old OpenBSD bug Cal.com cited as AI-era evidence was found by Glasswing, which exists because the source was open.

Vikunja
@vikunja.io

cal.com closed their source this week, citing AI bug-hunters as the reason. Every time a project does this, someone asks if Vikunja could too. Not easily. AGPL-3, no CLA, no investors, and anyone can fork today's code. More on why: vikunja.io/changelog/vi...

vikunja.ioOn Cal.com, AI security reports, and why Vikunja can't easily closeA response to Cal.com going closed source: why security-through-obscurity doesn't hold up, what AI-assisted security reports actually look like from the receiving end, and the structural reasons Vikun...
Vikunja
@vikunja.io

PSA: there will be a release tomorrow (April 8th) or the day after that with a bunch of security fixes

Vikunja
@vikunja.io

(2.2.1 has been released as well but did not fix the issues fully, therefore I went and pushed 2.2.2 right after)

Vikunja
@vikunja.io

PSA: Because of the great recent success, there will be ANOTHER release later today or tomorrow fixing 9 more security vulnerabilities.

Vikunja
@vikunja.io

🔒 Vikunja 2.2.0 is out! 10 security fixes (update now!), plus task duplication, an improved Gantt chart with subtask hierarchy & dependency arrows, and user-level webhooks. 237 commits of goodness 🚀 vikunja.io/changelog/vi...

vikunja.ioVikunja 2.2.0: Ten security fixes, Gantt overhaul, and task duplicationVikunja 2.2.0 fixes ten security vulnerabilities including three critical Desktop Electron issues, adds task duplication, a Gantt chart overhaul with subtask hierarchy and relation arrows, user-level ...
Vikunja
@vikunja.io

PSA: The next Vikunja release will fix 10 (!) CVEs. If all goes well, later today or tomorrow.

Vikunja
@vikunja.io

🎉 Just two days after the last release, Vikunja 2.1.0 is now released! 🔒 Fixes a security issue with password reset tokens and adds a nice touch: checklist indicators now turn green when all items are done! Check out the full release post on the website: vikunja.io/changelog/vi...

vikunja.ioVikunja 2.1.0: One security fix and some improvementsVikunja 2.1.0 fixes a security issue where password reset tokens were not cleaned up after use (CVE-2026-28268) and includes quality of life improvements like a green checklist indicator when all item...
Vikunja
@vikunja.io

🚀 Vikunja 2.0.0 is out! 🔒 4 critical security fixes 🔑 rebuilt session management 📊 improved Gantt charts with partial dates 💬 comment sorting and more! Please update ASAP! Check out the full release notes: vikunja.io/changelog/vi...

vikunja.ioVikunja 2.0.0: Many security fixes and a few breaking changesVikunja 2.0.0 includes four critical security fixes, rebuilt session management, Typesense removal, and new features like comment sorting, improved Gantt charts, and LDAP anonymous bind support.
Vikunja
@vikunja.io

PSA: Vikunja 1.2.0 will be released tomorrow or the day after. It will fix four (!) critical security vulnerabilities.

Vikunja
@vikunja.io

🦙 Vikunja 1.0 is here! After 8 years of development and 1,400+ commits of new features and fixes, this milestone release brings LDAP authentication, @user mentions, a completely rebuilt Gantt chart, and S3 storage support. Check out the full release post to learn more: vikunja.io/changelog/wh...

vikunja.ioWhat's new in Vikunja 1.0.0The long-anticipated 1.0 release is finally here! LDAP authentication, S3 storage, user mentions, improved Kanban, ParadeDB search, and much more.
Vikunja
@vikunja.io

Also new: drag-and-drop tasks between projects, comment tracking, better keyboard navigation, auto-save drafts, and dozens more UX improvements.

Vikunja
@vikunja.io

🦙 And now, the 5th rc of the 1.0 release! 272 commits have been made, many bug fixes and a few new features sneaked in as well. I think this time, this was a release without any known bugs at release. Please test as much as you can and report all the bugs! github.com/go-vikunja/v...

github.comRelease v1.0.0-rc4 · go-vikunja/vikunjaThis is the 5th release candidate of v1.0.0. 272 commits have been made, most of them bug fixes and refactors but also many dependency updates. Some small new features as well, most notably: Valid...
Vikunja
@vikunja.io

🦙 And now, the fourth rc of the 1.0 release! 399 commits have been made, many bug fixes and a few new features sneaked in as well. Please test as much as you can and report all the bugs! Getting closer to the actual 1.0 release. github.com/go-vikunja/v...

github.comRelease v1.0.0-rc3 · go-vikunja/vikunjaThis is the fourth release candidate of v1.0.0. 399 commits have been made, most of them bug fixes but also many dependency updates. Some new features as well, most notably: Support for S3 storage...
Vikunja
@vikunja.io

Vikunja Cloud was just down for about one hour due to a maintenance upgrade gone wrong. We had to restore from backup and as a result, you may have lost any changes made since 18:00 UTC today.

Vikunja
@vikunja.io

First, I'm really sorry about this. Second, this should not have happened. The whole incident showed the holes in the backup and restore process, and we took notes and will improve this.

Vikunja
@vikunja.io

If you have any questions about this, please reach out here or via any of the other channels. Yours, Konrad ~ Founder

Vikunja
@vikunja.io

Because of the great success of 1.0.0-rc1, we proudly present rc2! 🚀 Over 145 commits have been made, most of them bug fixes but also many dependency updates. 🐛 Find all the bugs! Report them so that we can go on and fix them. github.com/go-vikunja/v...

github.comRelease v1.0.0-rc2 · go-vikunja/vikunjaThis is the third release candidate of v1.0.0. Over 145 commits have been made, most of them bug fixes but also many dependency updates. Please test this release thoroughly and report any issues yo...

Vikunja reposted

Konrad
@kolaente.de

🏳️‍🌈🏳️‍🌈🏳️‍🌈🏳️‍🌈🏳️‍🌈 It's pride month, which means I get messages like this again:

Vikunja
@vikunja.io

This means the Vikunja n8n node is now available on n8n Cloud as well!

n8n@n8n.io

Community nodes are now becoming available on n8n Cloud! Starting today instance owners can install a curated and growing list of community nodes on both Cloud and self-hosted instances from the Nodes panel. Learn all (including how to get YOUR node added) 👉 buff.ly/iAKxq97 #n8n #lowcode #nodes

Vikunja
@vikunja.io

Looks like the forum will be down for a while until I've fixed that.

Konrad@kolaente.de

Me, after wondering why nixos-infect didn't seem to work using cloud-init, looks like I hit the wrong server with it 🫠

You are up to date.