Compatibility & security

Supported versions

• Redmine 6.1.x is the primary baseline.
• Redmine 6.0.x is supported with guarded API calls.
• Redmine 7.0.0 and Rails 8.1 are validated.
• Redmine 5.x is not supported from UX Toolkit 4.0 onward.

Before a Redmine or plugin update

1. Confirm that the target Redmine version is listed as supported or validated and review the plugin changelog.
2. Back up the Redmine database, files directory, plugin directory, and configuration using your normal operational process.
3. Install the plugin files with the unchanged directory name redmine_ux_toolkit, run plugin migrations, and restart every application process.
4. Review the settings Overview, then test login, issue creation and editing, project menus, attachments, and scheduled-task status with both an administrator and a normal user.
5. For versions newer than the validated baseline, perform this validation in a staging environment before production rollout.

Security principles

• Redmine visibility, roles, workflows, safe attributes, and attachment checks remain authoritative.
• Notices are sanitized or escaped; logs render as escaped plain text.
• Custom landing pages accept validated internal Redmine paths only.
• Scheduled operations use fixed entrypoints, database locks, stale-lock recovery, and bounded cleanup.

Security review checklist

• Treat hidden navigation as presentation only; verify route access with Redmine roles and permissions.
• Keep login notices free of private information because unauthenticated visitors can read them.
• Grant checklist editing, workload, project-health, and recurring-rule permissions only to intended roles.
• Restrict Custom CSS/JS, logs, attachment storage, and global plugin settings to trusted administrators.
• Review scheduler recipients and stored status messages without placing credentials in configuration text.

Graceful degradation

When a supported Redmine API is unavailable, the plugin hides optional UI or skips the optional action instead of weakening access checks.

If an optional control disappears after an upgrade, first verify the global switch, project module, role permission, and workflow. Then check the plugin and Redmine logs for a compatibility message; do not work around the absence by broadening permissions.