openDesk 1.20.0 - More Security and first Release Candidate

Portal

Features

With Nubus for Kubernetes 1.24.0, the security and management of the portal have been further improved. The self-service portal now supports the scanning of uploaded files, such as profile pictures, for malware via a connected ICAP server. In addition, Keycloak has been updated to version 26.8.1.

Further improvements relate to user management and the 2FA helpdesk. The helpdesk’s management interface has been optimised for performance. Furthermore, the handling of deactivated user accounts has been adjusted to provide clearer error messages during login.

Bug fixes

Various bugs relating to user management and background services have been fixed. The self-service portal now displays an error message if profile changes cannot be saved. Furthermore, the registration of services in the Provisioning Service has been made more robust, so that further registration attempts are made even if a single one fails.

Security fixes

Numerous known security vulnerabilities have been addressed through updates to Keycloak and other components. In addition, container images have been optimised and unnecessary software packages removed to reduce potential attack surfaces.

Projects

Features

The update to OpenProject 17.9.4 includes numerous improvements for project planning and collaboration. Work packages can be created directly from documents. Notifications regarding upcoming start and end dates, as well as overdue work packages, support project management and are now also available in the Community Edition.

New filters for backlogs and the additional ‘Observed in versions’ field for documenting the versions in which an issue was observed make organisation easier. The MCP interface offers enhanced options for time tracking and searching for work packages. In addition, the Jira migration process has been accelerated and the management options for PDF exports, single sign-on and work packages have been expanded.

Bug fixes

Numerous bugs relating to the display and editing of work packages, documents and backlogs have been fixed. Further fixes improve the stability of SSO login, the Jira import, the processing of attachments and time tracking. Issues with PDF export, calendar changes and moving board cards have also been resolved.

Security fixes

Several security vulnerabilities relating to access permissions, file uploads, active user sessions and PDF export have been resolved. In addition, Ruby and Node.js have been updated to address known vulnerabilities, including a security flaw in the built-in Brotli decoder.

Email & Calendar

Features

With Open-Xchange 8.53, multiple calendars can be created and managed within a shared account. Appointments can be moved between these calendars, whilst taking existing permissions into account.

Furthermore, collaboration across different user contexts has been enhanced. Email and calendar folders can be shared across contexts, out-of-office replies can be set up, and emails can be sent on behalf of other people. These functions can be enabled separately.

Files

Features

Collabora Online 26.04.4.3 has expanded the options for document editing. In Impress, slides from other presentations can be imported and linked to their source, allowing changes to be synchronised. Calc offers new table formatting options, structured cell references and improved Excel compatibility.

In addition, Writer, Calc and Impress now support organisation-specific security classifications. New chart types, improved editing of slide notes and optimisations to pivot tables and formulas make day-to-day work easier. Performance has also been improved for collaborative document editing and PDF export.

Bug fixes

Various bugs relating to document editing and collaboration have been fixed. These include issues with Excel formulas, filters and pivot tables, as well as display errors in Word documents. Further fixes improve stability and the editing of presentations, animations and slide notes.

Security

Review of the Brotli vulnerability

As part of a security review of CVE-2026-111497, also known as Broccoli2Shell, the potentially affected components were examined. All components reviewed were either classified as unaffected or the vulnerability in question had been rectified.

Release Candidate

With openDesk 1.20.0, we have released the first release candidate, 1.20.0-rc1. This marks a further step in implementing our revised release strategy. The release candidate enables our partners, in particular, to prepare in advance for the upcoming release rollout and allows the community to provide us with valuable feedback where necessary, as has already been the case with 1.20.0-rc1.

From this release onwards, release candidates will be published one week before the official release, as planned. These will then appear as separate releases in our release overview.

Any differences from 1.20.0-rc1 are due to the security fixes for the Brotli vulnerability.

Deployment & Migration

When updating to openDesk 1.19.0, manual migration steps are required. You can find the necessary adjustments in our migration notes.

Changelog

You can find the full changelog on openCode.