Fork Sync Branch develop

.env.docker.example

@@ -77,6 +77,17 @@ ATTACHMENT_EXPIRES_MINUTES=60
 # REDMINE_AUTOFILL_REQUIRED_CUSTOM_FIELDS=false
 # REDMINE_REQUIRED_CUSTOM_FIELD_DEFAULTS={}
 
+# --- legacy-per-user auth (advanced; Redmine too old for OAuth) ---
+# Each user's MCP client sends its own Redmine API key in an
+# X-Redmine-API-Key header. The server cannot verify TLS itself, so you MUST
+# attest that it sits behind a TLS-terminating proxy and that the proxy does
+# not forward client X-Forwarded-Proto. Firewall the app port. Prefer
+# dedicated limited-permission Redmine accounts. Revoke a user by
+# regenerating their API key in Redmine.
+# REDMINE_AUTH_MODE=legacy-per-user
+# REDMINE_PER_USER_TRUST_PROXY=true
+# REDMINE_PER_USER_AUDIT_IDENTITY=false
+
 # SSL options (optional)
 # REDMINE_SSL_VERIFY=true
 # REDMINE_SSL_CERT=/path/to/ca-bundle.crt

.env.example

@@ -96,6 +96,11 @@ CLEANUP_INTERVAL_MINUTES=10
 # Default expiry time for downloaded attachments (in minutes)
 ATTACHMENT_EXPIRES_MINUTES=60
 
+# OS path separator (os.pathsep) separated extra directories allowed as `file_path` upload
+# sources for create/update issue and upload_file. ATTACHMENTS_DIR is always
+# allowed. Leave unset to restrict uploads to ATTACHMENTS_DIR only.
+REDMINE_MCP_UPLOAD_FILE_ROOTS=
+
 # Read-only mode (optional)
 # When enabled, write operations (create/update/delete) are blocked
 # REDMINE_MCP_READ_ONLY=false
@@ -145,6 +150,17 @@ ATTACHMENT_EXPIRES_MINUTES=60
 # REDMINE_AUTOFILL_REQUIRED_CUSTOM_FIELDS=false
 # REDMINE_REQUIRED_CUSTOM_FIELD_DEFAULTS={}
 
+# --- legacy-per-user auth (advanced; Redmine too old for OAuth) ---
+# Each user's MCP client sends its own Redmine API key in an
+# X-Redmine-API-Key header. The server cannot verify TLS itself, so you MUST
+# attest that it sits behind a TLS-terminating proxy and that the proxy does
+# not forward client X-Forwarded-Proto. Firewall the app port. Prefer
+# dedicated limited-permission Redmine accounts. Revoke a user by
+# regenerating their API key in Redmine.
+# REDMINE_AUTH_MODE=legacy-per-user
+# REDMINE_PER_USER_TRUST_PROXY=true
+# REDMINE_PER_USER_AUDIT_IDENTITY=false
+
 # SSL Certificate Configuration (Optional)
 # Enable/disable SSL certificate verification (default: true)
 # WARNING: Only set to false for development/testing environments!

CHANGELOG.md

@@ -7,15 +7,38 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [2.5.0] - 2026-07-04
+### Added
+- `create_redmine_issue` and `update_redmine_issue` now accept an `uploads`
+  parameter to attach files to an issue (and to a journal note when combined
+  with `notes`), resolving each file from `content_base64`, `source_url`, or a
+  new on-disk `file_path` source.
+- `upload_file` gains a `file_path` source for files already on the server.
+- New `REDMINE_MCP_UPLOAD_FILE_ROOTS` setting to allowlist `file_path` upload
+  directories (defaults to `ATTACHMENTS_DIR`).
+- `legacy-per-user` auth mode: per-request Redmine API key via an
+  `X-Redmine-API-Key` header, for Redmine instances too old for OAuth. Opt-in
+  and fail-closed (`REDMINE_PER_USER_TRUST_PROXY` required); keys are redacted
+  from logs; optional identity audit via `REDMINE_PER_USER_AUDIT_IDENTITY`.
+- `tracker` field in issue serialization and the `fields` selector for issue listing/search tools.
+- `list_project_trackers` tool for project-scoped tracker discovery.
+- `create_checklist_item` tool (RedmineUP Checklists) and `is_section` in checklist output.
+
+## [2.4.0] - 2026-06-27
 ### Added
 - Promotional demo page under `pages/`, deployed to GitHub Pages on version tags via a new `deploy-demo.yml` workflow. It is a scripted, client-side walkthrough of an AI agent triaging a sample Redmine sprint backlog (list, read, reassign, comment, log time, close), with tool-call request/response JSON that matches the server's real response shapes, a Kanban board that updates as the agent works, and a light/dark theme toggle. No live Redmine is connected.
 
 ### Fixed
 - `get_redmine_issue` now returns journal field-change `details` (status, assignee, custom-field edits) and no longer drops journals that have no note text. The `_journals_to_list` helper previously skipped any journal whose `notes` was empty via `if not notes: continue` and never serialized the `details` array, so field-only history was lost and `details` was missing even on journals with notes. Journals are now kept when they have a note **or** field-change details, and each entry includes `details` (`property`, `name`, `old_value`, `new_value`) plus `private_notes`. `get_private_notes` exposes `details` as well. ([#161](https://github.com/jztan/redmine-mcp-server/issues/161))
 
 ### Security
+- Add a direct `joserfc>=1.6.7,<2` floor to clear CVE-2026-48990 (CWE-400 uncontrolled resource consumption). `joserfc` 1.3.4 through 1.6.5 fails to apply `JWSRegistry.max_payload_length` to RFC 7797 unencoded (`b64=false`) JWS payloads, allowing oversized payloads to be deserialized; the fix landed in 1.6.6. `joserfc` is a transitive dependency via `authlib` and `fastmcp`, so the direct floor ensures the fix reaches PyPI installs, not only the pinned lockfile. The lock now resolves `joserfc` 1.7.1.
 - Free-form journal field-change values now receive the same prompt-injection wrapping as journal notes. Custom-field values (`cf`), `description`/`subject` edits, and attachment filenames in `details` are wrapped in `<insecure-content-{boundary}>` tags, so the newly surfaced field-change history cannot smuggle injected instructions past an LLM consumer. Structured values (status, assignee, priority IDs, dates, numbers) are left raw to avoid bloating output with boundary tags. ([#161](https://github.com/jztan/redmine-mcp-server/issues/161))
 
+### Tests
+- `test_scope_advertising_subset_of_sandbox_scopes` now asserts the introspected test token is active before checking scope overlap. A stale `REDMINE_OAUTH_TEST_TOKEN` introspects with an empty scope, which previously made the test fail with a misleading "name drift between oauth_scopes.py and live Doorkeeper config" message; the active-token guard surfaces the real cause (re-mint the bearer) instead.
+
 ### Contributors
 - @martindglaser — fix missing journal field-change details in `get_redmine_issue` ([#163](https://github.com/jztan/redmine-mcp-server/pull/163))
 
@@ -919,6 +942,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Comprehensive authentication support (username/password and API key)
 - Docker containerization support
 
+[2.5.0]: https://github.com/jztan/redmine-mcp-server/releases/tag/v2.5.0
+[2.4.0]: https://github.com/jztan/redmine-mcp-server/releases/tag/v2.4.0
 [2.3.1]: https://github.com/jztan/redmine-mcp-server/releases/tag/v2.3.1
 [2.3.0]: https://github.com/jztan/redmine-mcp-server/releases/tag/v2.3.0
 [2.2.0]: https://github.com/jztan/redmine-mcp-server/releases/tag/v2.2.0