What's New in Frappe

Restore hover tooltip on Profit and Loss dashboard chart

Restores hover tooltip functionality on P&L dashboard charts.

Show actual outgoing rate in ledger preview

Displays actual FIFO outgoing rates instead of average valuation rate and formats as currency in stock ledger preview.

Check write permission in whitelisted document methods

Adds `check_permission("write")` to whitelisted document methods that mutate data, preventing unauthorized modifications.

Let an app mount its own UI inside a desk page

Enables apps to mount Vue UI with frappe-ui in shadow roots within desk pages, isolating styling and dependencies from the framework.

Constrain captured image size in camera preview

Constrains preview image dimensions in camera upload dialog to prevent overflow and stacking across grid columns.

Make capture preview remove control readable over photos

Updates camera preview close button styling to remain visible over dark backgrounds.

Accept a numeric workbook name on insert

Handles legacy numeric workbook names from old fixtures to prevent `bench migrate` failures when syncing.

Add disk throughput and IOPS limits

Adds disk throughput and IOPS limit controls for metal VMs.

Add support for traffic bandwith limit and ip attach/detach

Adds traffic bandwidth limits for public and private internet, cleans up egress options, and enables public IP attach/detach without VM restart.

Integrate Atlas WG Mesh

Integrates WireGuard mesh for private tenant networking, builds metald and wg-mesh binaries locally, and auto-configures machines from warm snapshots.

Add query and index analysis to the DB analyzer

Adds read-only performance analysis covering time-consuming queries, full table scans, unused indexes, and redundant indexes via Performance Schema.

Re-evaluate slot-derived computeds when a slot toggles

Fixes TextInput prefix and suffix icons rendering incorrectly when toggling visibility.

Ignore a file dropped on a read-only editor

Prevents file uploads and image insertion into read-only editors, which were incorrectly mutating document content.

Remove backtick notation from order_by

Removes invalid backtick notation that was returning HTTP 417 errors across multiple page routes, blocking site access.

Disabled marker and cost center parity in tree views

Shows disabled status as badges in Account and Cost Center tree views; makes Account Type visible in previews and adds cost center parity.

More sidebar improvements

Adds general sidebar enhancements.

Draw a navigation item's authored icon

Renders authored navigation item icons that were defined and shipped but not drawn in the UI.

Keep the reader in the panel they are already in

When a navigation destination exists in multiple panels, keeps the reader in their current panel instead of always switching to one panel.

Open a shut section the address is standing in

Fixes sidebar section expansion so a section automatically opens when the address points to an item within it, even if keep_closed is set.

Weigh each boot key and log the ones over budget

Implements boot budget checking by logging each key's size and flagging those exceeding the 40 KB budget.

A history entry carries the sidebar it was read in

Fixes back button navigation for items that appear in multiple sidebars by storing which sidebar the page was opened in.

Typecast ref_name and docname

Updates autoincrement doctypes with correct typecasting for ref_name and docname fields.

Give parent docs identity to link child table with attach field

Fixes file attachment linking in child table fields by ensuring parent documents have proper identity.

Quote boolean literals so they work as conditions too

Quotes boolean literals in SQL conditions to fix postgres type errors when booleans are used in WHERE clauses.

Keep the right column aligned across rows

Fixes list view layout where timestamps, comment counts, and avatars had variable widths, misaligning columns.

Duplicate intro messages on first save of new document

Deduplicates intro messages that were being shown multiple times on first document save.

CSV conversion of prepared report fails when report has total row

Handles list-format total rows in CSV conversion that was expecting only dict rows.

Escape in get_csv_bytes too

Escapes special characters when exporting CSV files to prevent formatting issues with leading characters.

Translated doctype search repeats rows across pages

Fixes pagination for doctypes with translated fields, which previously repeated rows across pages due to filtering translated values in Python after SQL offset.

Add client_secret in blocklist of traceback_sanitizer

Masks client_secret credentials when they appear in error tracebacks to prevent credential leakage.

Set print_format_for to doctype in standard formats

Makes bundled print formats (Salary Slip variants) visible in the print dropdown by setting the print_format_for field.

Clear unused dates when Is Recurring is toggled

Clears hidden date fields in Additional Salary when toggling recurring mode to prevent false duplicate/overlap validation errors.

Exclude cancelled Job Offers in JobApplicant.onload

Filters out cancelled job offers from job applicant UI to prevent linking to dead records.

Write portal defaults without saving the whole document

Fixes migration failures by writing portal settings without validating broken link references in unrelated menu rows.

Stop mail loops from bounces and autoresponders

Prevents inbound mail loops by screening machine-generated messages and blocking replies to bounces and out-of-office responses.

Native SQL queries with a CTE fail with "Duplicate query name"

Fixes ibis query compilation which was writing CTEs twice, causing sqlglot to reject duplicate names.

Use parsed GitHub url when adding app in new app dialog

Parses GitHub URLs correctly when adding apps to prevent format-related errors.

Allow a pull update on a site with a large database

Enables app pull updates on large databases (108 GB+) without requiring a full physical backup.

Don't archive a site when the archive step was skipped

Prevents accidental deletion of a site's backups and metadata when the archive step fails or is skipped, which was mistakenly treated as success.

Standardize app page metadata

Standardizes document titles and favicons across Suite apps with dynamic, workbook-aware metadata.

Retain html formatting when pasting text content

Preserves rich text formatting (lists, inline styles) when pasting between slides instead of stripping to plain text.

Scroll table horizontally when columns exceed width

Allows horizontal scrolling of tables when added columns exceed viewport width instead of shrinking all columns.

Number card target and delta prefix

Adds optional `target` field to show target value and `deltaPrefix` for units in NumberCard; removes per-series emphasis on axis chart hovers.

Introduce Project

Adds a new Project feature to the billing module.

QOL sidebar shortcut

Adds Cmd+B keyboard shortcut to toggle the sidebar across the app.

Storage cluster stage handling

Adds state toggles at every storage cluster stage for better recovery from failed deployment states.

Ask how far a recurring change reaches

Unifies the dialog for recurring calendar event changes (edit, drag, delete, RSVP) with consistent UI asking whether to modify one instance or the entire series.

Drive the pictures sidebar from the Theme doctype

Makes theme categories configurable via the Theme doctype with Show in Pictures Sidebar and Sidebar Order fields, eliminating hardcoded sidebar lists.

Stop task detail blanking on server-scoped tasks

Fixes task detail page going blank for server-scoped tasks by removing undefined route reference.

Contribute the Default Company navigation item kind

First navigation item kind from a non-frappe app; demonstrates that extensibility is first-class with a two-file, one-hook contribution.

Ship ERPNext's module-primary rail and its module sidebars

Ships one Rail record (20 items) and 18 module Sidebar records (317 rows); ERPNext navigation arrives as JSON with no navigation code.

Skip zero quantity items in production plan material requests

Backports v16 behavior to v15: zero-quantity rows stay in Production Plan for bin reservation but are skipped when creating Material Requests.

Allow creating stock closing balances

Non-Administrator users were getting permission failures when generating Stock Closing Balance records.

Rearrange fields in BOM Operation

fix: rearrange fields in BOM Operation

Check read permission on lead in add_lead_to_prospect

The method wasn't checking whether the user could read the lead before converting it to a prospect.

Prorate landed cost charge into transaction currency

Landed cost charge GL entries were using the entire item net amount instead of the applicable charge when posting in transaction currency.

Use company-currency change amount when netting pos gl entries

Multi-currency Sales Invoices were netting POS change amount in invoice currency instead of company currency, producing incorrect GL entries.

Include payment deductions in sales/purchase register ledger bal…

Sales Register ledger view incorrectly showed discounted amounts as outstanding customer balance when payment entries posted discounts to Sales Discount accounts.

Filter cancelled BOMs in BOM Stock Analysis

The BOM selector was including submitted but now-cancelled BOMs.

Filter fully ordered items when creating RFQ from Material Request

RFQ creation was copying all items including those fully covered by POs; now filters on pending qty like the PO flow does.

Use item warehouses in production plan work orders

Work orders from a production plan were using the sub-assembly target warehouse as source for all raw materials instead of respecting each item's defaults.

Validate contact email before saving an email campaign

Email campaigns for contacts with no primary email were saving and silently failing to send; now validates email presence first.

Subtract stock qty of same-document rows from batch availability

Batch filtering was subtracting transaction-UOM qty from stock-UOM quantities, allowing assignment of batches that can't cover alternate-UOM rows.

Assign batch_no only when the first batch covers the full qty

Auto-pick was assigning a batch that couldn't fulfil the full quantity when qty spanned multiple batches; now leaves batch empty so the auto-created bundle splits it correctly.

Preserve exchange gain loss journals in lcv

Submitting a Landed Cost Voucher was cancelling the exchange gain/loss Journal Entry it was meant to work with.

Check write permission in whitelisted document methods

`run_doc_method` was only checking read permission; writes via `db_set`, `db_update`, and direct SQL were accessible to any read-permitted user.

Resolve desk v2 navigation into boot

New `frappe/shell/navigation.py` resolves rails and sidebars into boot, implementing the design settled by "Where does desk v2 resolve navigation layers?"

Let an app extend another app's rail, and drop mount_on

One app can now extend another app's rail while keeping its own; resolves the mounting and ordering question for multi-app navigation.

Render every navigation item kind, through the contribution door

All eight Navigation Item Type records now render in AppRail.vue instead of silently dropping seven of them; implements the contribution pathway.

Filter desk v2 navigation on the bucket each item type declares

Builds the single navigation filter designed for "Filter an authored rail"; applies the bucket each item type declares.

Draw the sidebar a linked rail item opens

Renders the sidebar panel that opens when clicking a linked rail item; implements charter point 1 of the rail/sidebar design.

Save a navigation arrangement as anchors, not positions

Desk v2's first user-state write: saves navigation arrangements (which items are pinned/hidden) as anchors rather than screen positions for consistency across devices.

Print format onboarding follow-ups

Print format builder had several follow-up fixes: unified empty-header check, restored letterhead margin in PDF, and copy-from-New-dialog fix.

Give the IMAP sync rule test account a unique email id

Test was reusing an email already owned by another test account, causing backports to v15 (where email_id is unique on its own) to fail.

Changing the file private/public should not throw FilealreadyExists error

fix(file): Changing the file private/public should not throw FilealreadyExists error

Correct typo. in cache invalidation key

User `allowed_in_mentions` changes weren't invalidating the cache because the handler checked the typo'd field name `allow_in_mentions`.

Populate footer parent_label options on page load

Footer Items' Parent Label select stayed empty on page load and only populated after editing; mirrors the fix already applied to Top Bar Items.

Open workspace by slug in Workspaces tab

Workspace routing was using raw names instead of slugs, causing lookups to miss and show 404s.

Apply the module veto to a sidebar addressed at that module

`block_modules` was gating Module items but missing Sidebar items addressed at blocked modules; now applies the veto consistently.

Force render_safe_globals context

Web pages no longer need to parse `exec_safe_globals` — `render_safe_globals` is sufficient for the use case.

Remove request completely

fix(safe_exec): remove request completely

Use query builder for contact search

PostgreSQL couldn't execute the Contact link query's MySQL IF function; rebuilt with the query builder to work across databases.

Read app data files as UTF-8, not the locale default

Fixes `UnicodeDecodeError` that blocked all site migrations when running under C/POSIX locales with ASCII encoding.

Keep json payloads parseable

Ensures JSON payloads remain parseable, preventing data corruption during serialization.

Dim assignee, timestamp and favourite columns for visited rows

Visited-row dimming was only applied to text columns; now extends to assignee avatar, timestamp, and favourite heart columns, plus adds data patch for existing records.

Manual backport of visited records dimming (#2693, #2767)

#2693 was never backported due to a merge commit; manually applied #2693 and #2767 to main-hotfix and fixed a subsequent migrate failure.

Add fetch_from support in fields

feat: add fetch_from support in fields

Add chart options API and update AddChartModal component

Moves chart definitions from hardcoded frontend to a backend API, providing an extension point for apps to contribute custom dashboard charts.

Ship CRM's rail and its four doctype sidebars

CRM's rail is now authored in source as standard rows instead of derived at runtime; implements the doctype-primary half of the navigation design.

Prevent IntegrityError when syncing items without a standard rate

Item sync was writing NULL to the NOT NULL currency column when an item had no Item Price; now coerces the rate with `flt()`.

Make website column clickable in Leads and Deals list views

Website field now opens URLs in a new tab instead of showing as plain text.

Dedupe vue-router and dompurify for the linked @framework/ui

Building against frappe/ui source was failing because vue-router wasn't installed next to that source; added deduplication.

Move agents off an agent status when it is disabled

Disabling an HD Agent Status left agents stuck on it because the picker hid disabled statuses; now auto-moves them to the default status.

Read the condition off the whole expression

Drill down on conditions with commas was parsing only up to the first comma; switched to a full-expression parser that respects nesting.

Find sites with outdated framework in n days

Introduces a daily audit job that snapshots the aggregate count of sites with outdated framework versions.

Warning for outdated framework version

Shows a banner in bench and site dashboards if the Frappe Framework is more than 30 days old.

Print each site that loses its rate limit

The rate-limit removal patch was silent on success; now prints the site name after each successful config update.

Align writer and sheets navbars

Adds the shared app switcher, theme control, and account action to Writer and Sheets; aligns navbar chrome with Slides and adds editable Sheets breadcrumbs.

Better password set

feat: Better password set

Build golden images

feat: Build golden images

Atlas controller - Phase 1

Bare metal provisioning with Scaleway and Route53; adds server provider and DNS provider abstraction, HTTP proxy build, and automates wireguard + metal daemon setup.

Warm snapshots + image promotion

VM snapshots, promotion to images, and cloning from warm snapshots; refreshes VM metadata on clone.

Feat/timetable generation

Automated timetable generation for schools; administrators describe rules once and the generator builds conflict-free weeks, replicates across terms as Course Schedule records, and reports unplaceable items.

Keep the broken-file-log compensation test off stderr

Test captured stderr printing, which made CI runners look like failures even though the test passed; now redirects stderr to a StringIO.

Time edits the event modal wouldn't take

Three issues: recurring event times were overwritten on save, DST transitions weren't handled, and date validation was missing.

Delete the site's push subscriptions when a user is disabled

Disabling a user now cleans up push subscriptions on the mail server so they can't accumulate orphaned entries.

Let the account switcher keep its rows

The account submenu closed when moving the pointer toward the list; fixed by using a proper list component instead of hand-built slots.

Self-heal push subscriptions and seed missing sync state

Mail realtime wasn't working because push subscriptions were never created, only renewed; added auto-creation and sync state seeding.

Triage that reaches the end of a list keeps going

Triaging the last thread in a list closed the reading pane and deselected it; triaging from the bottom now wraps to the top to keep the flow going.

Actions that stopped at a removed toast call

Mail and Calendar actions were calling the removed `toast.removeAll()` from a frappe-ui bump; replaced with guard checks.

Restore the mobile gap above a poll in the timeline

Polls sat flush against post bodies on mobile; restored the mobile padding that was inadvertently removed.

Repayment schedule dates stop advancing when schedule type is blank

When schedule type was empty, `get_next_payment_date` was returning the same date every loop iteration instead of advancing.

Track supplier quotation order status

Supplier Quotation now tracks whether items have been ordered, reusing the status field and adding ordered_qty.

Round party balances to currency precision in Trial Balance for Party

GL balances rounded to currency precision eliminate floating-point residuals that bypassed the Exclude Zero Balance filter.

Handle BOM price list currency update

New BOMs no longer error when selecting an item triggers price list currency updates.

Ignore cancelled batch entries in valuation

Batch quantity calculations during manufacture exclude cancelled outward entries.

Add permission checks on payment entry whitelisted methods

fix: add permission checks on payment entry whitelisted methods

Add missing perm checks on various whitelisted methods

Enforce permission checks on multiple whitelisted methods that were previously bypassed.

More improvements for the editor

Sidebar editor now supports item deletion and direct app shipping.

Author Rail and Navigation Item on desk-v2

New Rail and Navigation Item doctypes for desk v2's navigation model.

Extend Sidebar for desk v2 with an address, layers and Navigation Item rows

Desk v2's sidebar gains link_doctype, layers, and Navigation Item row support.

Better message for migrate

Framework errors during migrate now display less scary messages.

Make RQ job id creation idempotent

fix: make RQ job id creation idempotent

Use postgres-compatible quoting in SQL strings and aliases

Postgres no longer rejects double-quoted string literals and aliases; uses SQL-standard single quotes.

Cast boolean values to strings for PostgreSQL compatibility

fix: cast boolean values to strings for PostgreSQL compatibility

Use Redis heartbeat for process health

Containerized deployments now correctly detect scheduler status via Redis heartbeat instead of file locks.

Allow export when report exceeds max_report_rows

Reports over the row limit can now be exported (which the UI recommends).

Rounding inflates exactly representable values at high precision

Float rounding epsilon now scales with precision to prevent inflating exact values.

Calendar all day fallback

fix: calendar all day fallback

Render the doc passed by the caller

Print rendering now handles unsaved preview documents correctly via `frappe.get_print()`.

Filter User fields based on perms instead of ret. unconditionally

User fields now respect normal permission checks instead of returning all fields regardless of access.

Make `after_response` callbacks reliable

One failing callback no longer skips database cleanup; failures are logged with tracebacks.

Ignore reindexed uids when building IMAP sync rule

IMAP sync handles UIDVALIDITY changes without getting stuck on invalid sync requests.

Allowed file extensions setting not enforced for files with an unknown mimetype

File upload validation now checks extensions directly instead of relying on mimetype table lookups, preventing unintended accepts when OS/Python versions don't recognize extensions.

Harden public signup against enumeration and abuse

Rate limit public signups to 500 per IP per minute and return generic failure messages to prevent email enumeration.

Email template selection break

fix: email template selection break

Allow custom values for autocomplete fields

Combobox fields now allow custom values like Frappe's Autocomplete field.

Bulk edit reports failures and supports lost reason

Bulk edit now reports which records failed to save and supports required lost reason on status changes.

Prevent 'Document not found' error flash on lead delete

Delete success is now silent instead of showing a misleading error before navigation.

Show filter date fields in the system date format

Date/date-range filters now display in the configured system date format.

Blank empty states, always-visible Update Account, false typing indicator

Settings screens (Agents, Email Accounts, Saved Replies, Field Dependencies) now render empty states instead of blank.

Avoid improper reply box closing for Grammarly suggestions

Grammarly's suggestion card no longer triggers reply box closure.

Strip unwanted fields from save

Dashboard forms no longer reject saves over computed fields returned by the resource read.

Add error states for notif panel & server name in incidents card

fix(ui): Add error states for notif panel & server name in incidents card

Apply dynamic rate limits to all public endpoints

All public meeting endpoints (join, approval, etc.) protected with configurable rate limits seeded on install.

Delete and a legible title in the event modal

Event modal gains delete from a ⋯ menu and editable title with visual affordance.

Project recorded shared stage

Record the ordered shared stage from SFU; gate FFmpeg capture on frame commits and media attachment.

Separate recorder health and admission

Recorder deployment health separate from atomic admission decisions with typed policy/capacity/recovery contracts.

Left right layout

feat: left right layout

Stop the delete shortcut eating Backspace

Popover isOpen state no longer swallows Backspace/Delete keypresses from the page.

Broken expresisons in custom field

fix: Broken expresisons in custom field

Give composer errors and checkbox options room to breathe

fix(polls): give composer errors and checkbox options room to breathe

Vote in a single-answer poll with radios

Single-answer polls now render radio buttons instead of checkboxes.

Table toolbar, header columns, click-to-select, wrap and auto-fit

Table toolbar unified; adds cell fill/border, text color, font selector, header controls.

Delay tooltips for two seconds

Tooltip hover delay now consistent across toolbar and teleported popovers.

Label elbow corner style and provide clear tooltips

fix: label elbow corner style and provide clear tooltips

Render fill and border on text box shapes

fix: render fill and border on text box shapes

Mirror shape rotation and connector geometry in SVG thumbnails/exports

fix: mirror shape rotation and connector geometry in SVG thumbnails/exports

Compact Fill and Border popovers

fix: compact Fill and Border popovers

Smooth laser trail spine points

Laser pointer trails eased to follow fluid gestures instead of hand jitter.

Smooth freehand stroke capture

Freehand strokes retain intended shape by filtering low-amplitude samples.

Drop the 10 MB cap on inserted images

Removed client-side image size check; limits now enforced below the app layer.

Empty-canvas nudge stays gone once a tool is armed

fix: empty-canvas nudge stays gone once a tool is armed

Language migration and sync race

fix: language migration and sync race

Show meet avatar fallback in join/leave toasts

Join/leave notifications now display themed avatar initials instead of a generic user icon.

Crash when amount paid check runs before payable amount is set

Loan repayment validation moved after payable amount is set to prevent crashes on "Validate Payments" enabled products.

A mail to yourself reads once in its thread

Self-addressed messages no longer appear twice (Sent copy and delivery copy collapsed into one).

A scroll never pages the thread

Swipe-to-page now tracks touch movement along its path instead of just endpoints, preventing accidental thread pagination during scroll.

Stop double charge debit on write off recovery payment account

Write-off recovery payments no longer double-charge the bank account when covering a charge with its own invoice.

Verify Digio webhook using X-Digio-Checksum header

Digio webhooks now verified with correct HMAC-SHA256 checksum header instead of rejected plaintext secret.

Valuation method for BOM secondary items

BOM Secondary Item gets a Valuation Type select with three modes: % of FG Cost (existing), Valuation Rate (pre-v16 method: bin-average valuation), and AQ (average qty).

Production plan visualizer page and summary report fix

Fixes Production Plan Summary report (finished good rows emitted after work order rows, Order Qty showed remainder chain) and adds production plan visualizer page.

Add multi-currency support to Blanket Orders

Blanket Orders now support transaction currency, exchange rates, and selling/buying price lists with price list currency conversion.

Enhance tree view functionality for accounts and cost centers

Builds on Frappe tree redesign with accounting-specific actions: account-number badge, freeze indicator, row actions for Add Child, View Ledger, Convert, Move, Delete.

Close individual transaction items

Adds a `closed` flag on Purchase Order, Sales Order, Delivery Note and Purchase Receipt item tables to close individual rows instead of the whole document.

Skip tax addition for invoice created from opening invoice tool

Opening invoices automatically fetched taxes when enabled in Account Settings, but opening entries are inclusive and should not auto-add.

Restore isolated loyalty and subcontracting tests

Loyalty Program test module failed in isolated process; Skip-transfer Manufacture Stock Entries replaced Work Order item warehouses incorrectly.

Prevent update_doctypes from exporting files

Utility test called update_doctypes against real schema, saving standard child DocTypes to the app checkout and breaking later migrations.

Translate label in party validation

Party validation label in error messages was not wrapped for translation.

Widen item name in stock projected qty

Stock Projected Qty report allocated only 100 pixels to Item Name while Description had 200, truncating longer names.

Correct BOM sorting and stock translations

BOM item sorting used an invalid comparator for equal item codes; two stock validation messages had formatting issues preventing translation or silently discarding arguments.

Keep closed rows out of Update Items

Closed rows remained editable in Update Items dialog and reachable via the whitelisted method; server now excludes them.

Handle duplicate root BOM items

Adding the same raw material twice under a root BOM Creator raised `StopIteration` instead of a duplicate validation error.

Compare updated item quantities in stock UOM

Update Items compared quantities stored in different UOMs, rejecting valid updates or accepting invalid reductions when conversion factors differed.

Correct reservation and pick list quantities

Only the final batch had its delivered quantity updated; picked quantities spanning multiple locations were deducted repeatedly; allocated serial numbers were not removed from leftover locations.

Do not map the same row twice in "Get Items From"

Selecting the same Delivery Note twice in a Sales Invoice added two sets of lines for the same rows; button now enforces idempotence.

Explain missing fields when loading party details or taxes

When Company, party, or date was missing, the form cleared user input and showed a vague "Mandatory" message; now explains what was cleared and what must be set first.

Add permission checks on get_invoices

POS invoice endpoint was accessible without permission checks.

Add permission checks on get_available_payment_schedules

Payment schedule endpoint lacked permission validation.

Check read permission on source in create_duplicate_project

Project duplication did not verify read access to the source project.

Add missing permission validation on get_contract_template

CRM contract template endpoint was accessible without permission checks.

Validate POS Settings invoice and search fields on the server

API requests could store invalid fields or excluded items in POS Settings, bypassing browser validation.

Validate serial batch bundle company

A stock voucher could retain a Serial and Batch Bundle from a different company after the voucher company was changed.

Cleaner tree view UI

Tree view redesign with improved layout and visual hierarchy.

Add connect timeout for requests to Frappe Cloud

Frappe Cloud integration lacked timeouts, allowing network issues to block gunicorn workers indefinitely.

Log lock path on filelock timeout

Diagnostic log in `filelock()` used a plain string, logging literal `Filelock: Failed to aquire {lock_path}` instead of the actual path.

Apply field level permission on attachments in right pane

Field-level permissions were not applied to attachments in the right pane.

Add link for partner discovery

Billing card now links to partners page.

Make "rows selected" toast readable in dark mode

Datatable selection toast was hard to read in dark mode.

Disabled reports still appear in desk search

Disabled Reports appeared in Desk search, List View dropdowns, and recent routes when linked through Custom Roles or with no roles.

2FA login says the code was emailed when nothing was sent

`send_token_via_email` returned `True` even when `frappe.sendmail` did not queue; login page showed false success on unsubscribed or muted emails.

Don't advise deleting the lock file on lock timeout

Lock timeout message incorrectly told users to delete the file; deleting while held allows concurrent database operations.

Show print format field only for query/script reports

Print Settings dialog rendered Print Format field in doctype report view and treeview where it does not apply.

Escape docname used as default link text in get_form_link

Removes dependency on docname validation by escaping fallback link text.

Add roles table to SMS Settings

System Managers can now configure which roles are allowed to send SMS.

Add icons for Update Progress and Mark as Completed

Goal tree row actions now display icons for Update Progress and Mark as Completed.

False Exchange Gain/Loss on Expense Claims in base currency

Expense Claims booked false gains/losses when linked advance's exchange rate was missing/zero; now skips calculation when no real rate exists.

Update system date format for password in salary slip

Date fields in password policy template stringified as ISO regardless of System Settings format; employee told password is their date of birth in dd-mm-yyyy tries 08-05-1990 and cannot open PDF.

Dim visited deals/leads in list view using frappe's _seen field

Dims deal and lead rows in list view once opened, using Frappe's built-in `_seen` tracking instead of client-side store.

Wrap hardcoded user-facing strings in __() for translation

Error banners, modal fallbacks, and validation messages on Deal/Lead pages were not wrapped for translation extraction.

Typos in user-facing messages and parameter names

Fixed intergration→integration (Exotel error), charaters→characters, seperate→separate, and extention→extension parameter.

Cannot read properties of null in quickfilters

Quick filters failed on cold list-view loads when list.params was null.

Download attachments the browser cannot preview

Attachments with unrenderable mime types (`.dwg`, `.avi`) got stuck in preview dialog without download links; preview eligibility is now an explicit allowlist.

Migrate v2 dashboards to v3 workbooks

Adds a migrator copying v2 dashboards into new v3 workbooks; v2 queries, expressions, charts and dashboards are translated, with post-migration validation comparing results.

Give the SQL column operation the same contract as develop

Migrator wrote `sql_column` field but develop reworked it to `raw_sql`, causing data loss on upgrade.

Finish the sql_column rename to raw_sql

Tests still referenced the old `sql_column` field name after rename to `raw_sql`.

Carry a SQL column expression through an ibis query

Migrator writes `sql_column` operation for v2 constructs; ensures the operation contract matches develop so columns are not lost on upgrade.

Report failures and rerun script queries on input changes

Script query failures were not published to the Logs panel; Force Run and variable changes did not rerun due to persistent code cache.

Clamp MSS

MSS clamping for NAT to prevent fragmentation.

Say drop bench, not archive bench

Bench action menu was the only place that said "archive" instead of "drop" like other destructive actions.

Fix TypeError in OCI attach_to_firewall

Virtual machine OCI attachment had a type error.

Pre-tag surface trims, the toast contract, and the type errors that reach consumers

Eight breaking changes for 1.0.0 tag: `ThemeSwitcher` moves to experimental, DatePicker stops re-exporting utils, `Button` drops exposed `rootRef`, `HoverCard` declares side/align/portalTo, Toast compat shims removed, Toast `description` becomes required.

Multi-company India Payroll

Adds multi-company mode to Payroll Settings with a child table holding statutory registration details per company, supporting multiple ESIC employer codes and EPF establishment codes.

Pre-filled default reminders, all-day alert fixes

New events open with default reminder pre-filled as an editable row; all-day swaps respect defaults; flipping All Day swaps an untouched row between defaults.

Refactor HTTP Proxy

HTTP proxy implementation refactored with token-authenticated control endpoints for maps, certificates, health, readiness, and targeted PATCH/DELETE operations for site and custom-domain mappings.

Restrict cross-tenant access to privileged VMs

Adds controller-managed privileged VM whitelist for tenant 0, permitting cross-tenant traffic only when either endpoint is whitelisted.

Replace LVM with ZFS — snapshots, resize, restart

Storage infrastructure refactor from LVM to ZFS.

Better field mapping for actions and support for all WhatsApp languages

WhatsApp integration improvements for field mapping and language support.

Add Frappe app scaffold at repo root

Scaffolds atlas Frappe app with monorepo coding and documentation guidance.

Lay the submission details page out as a ledger

Outbox submission details redesigned as one narrow column with subject, merged delivery state, state actions, activity list, and message facts.

Make the undo send period configurable per user

User Settings gets a Compose section with `undo_send_period` select (5, 10, 20, 30 seconds, default 5).

Add shortcuts for undo send, schedule send and the outbox

Cmd/Ctrl+Shift+Enter opens Schedule Send; Cmd/Ctrl+Z undoes sent mail while server holds it.

Separate recording budgets and storage reservations

Adds explicit Drive storage reservations for recording budgets, growing them from durable cumulative segment progress.

Version recording contracts

Versions recording commands, callbacks, browser lifecycle, and Recording Grant proof seams with immutable v1 semantic vectors.

Finalize recording artifacts durably

Adds durable Frappe finalization state and authenticated status protocol for recording artifacts, making artifact validation, Drive publication and owner notifications recoverable and idempotent.

Event reminders that reach the browser

Calendar alerts now publish a realtime event to open suite tabs and become toasts with an Open action plus system notifications when permitted.

Fix Restore PF wage aggregation in EPF register

Version-16-hotfix merge into develop left `_aggregate_salary_detail` in half-merged state with undefined `company_by_slip` references, causing NameError on every call.

Give the mail actions menu its options back

Mail ⋯ menu showed "No options"; frappe-ui menu groups changed to `{ group, options }` but code still used `items` key.

Keep a selected image ring under the pinned author row

Full-width image selection ring in discussions scrolled above and was visible behind the pinned author row; now masked with z-index.

Tolerate the root-redirect race in open_root

E2E test `test_logs_into_admin` failed intermittently with navigation interruption race; added tolerance for root → /sites redirect.

Uploaded image overwrites an earlier one with the same filename

Pasted clipboard images all saved as `image.png`, with WebP versions overwriting previous images to the same URL; now generates unique names via `generate_file_name`.

Preserve active media attachments

Media element manager replaced unchanged srcObject streams after 60 seconds, interrupting playback with brief black frames on routine Vue updates.

Keep the drafts list in the doctype store

New drafts did not appear in the list and deleted drafts persisted until page reload; moved bare useCall into listStore for sync.

Stop failing a publish over an edit that arrived mid-save

User could not publish a draft on first attempt; post body never reached the server and publication refused to proceed.

Work Order picks wrong Delivery Date when Sales Order has the same item in multiple rows

Backport to version-16-hotfix.

Work Order picks wrong Delivery Date when Sales Order has the same item in multiple rows

Backport to version-15-hotfix.

Use packed row delivery date

Work Orders for packed items now correctly pick delivery dates from their corresponding Sales Order rows instead of the first matching item, fixing wrong date assignments when the same item appears multiple times.

Scoping whitelisted methods output to projects and timesheets that are accessible to users

Restricts whitelisted method output to user-accessible projects and timesheets, preventing unauthorized data exposure.

Address every doctype under every prefix, with a module segment

Moves slug table out of boot to serve per-bench routing with module-name mapping, allowing doctypes to be addressed under every prefix via a module segment.

Enforce one primary contact per party

Prevents multiple contacts from being marked as primary on the same party, eliminating ambiguity in transaction contact selection.

Don't break job system on invalid workers config

Guards queue timeout retrieval to fall back to defaults instead of crashing when workers config is malformed, preventing entire background job system failure.

Copy applicant data when creating an Employee

Creating an Employee from a Job Applicant now uses mapped document creation, copying name, email, phone, designation, salary currency, and job opening details instead of opening a blank form.

Permission error on toggle

Adds missing editable field declaration so users can enable/disable firewalls without permission errors.

Private multicast network mesh

Establishes a private multicast network mesh with a reserved tenant ID for cross-IP connectivity on private networks.

Add unicast discovery relay

Adds a discovery relay for environments without multicast support, forwarding WHO_HAS and NOW_HERE messages over UDP unicast to configured peers with automatic reload and logging.

Make recording startup durable

Persists recorder startup milestones before recording begins and replays/retries startup callbacks until capture launch is acknowledged.

Recover recording interruptions

Recovers transient FFmpeg capture failures within a fixed 60-second recovery window, persisting omission bounds, callbacks, and retry state; shows participants the interrupted state and recovery countdown.

Advertise routable local SFU address

Respects WebRTC bind address in development and advertises the detected local IPv4 for local media transport.

Load available serial no report

Fixed inventory-dimension helper referencing wrong report name, which left filters undefined. Backports: [#58561](https://github.com/frappe/erpnext/pull/58561), [#58562](https://github.com/frappe/erpnext/pull/58562)

Added permission checks on multiple payment entry whitelisted methods

Added permission checks on multiple payment entry whitelisted methods

Add ConditionBuilder, a nested and/or condition editor

New UI component for building nested boolean condition trees, built on Filter's operator and value-control logic.

Calendar view breaks for users in a different timezone than the system

Converts date range explicitly: start to start-of-day, end keeps its time to avoid excluding records on the last day. Backports: [#42255](https://github.com/frappe/frappe/pull/42255), [#42256](https://github.com/frappe/frappe/pull/42256)

Quiz proctoring with violation tracking

Instructors can enable proctoring per quiz and set violation tolerance; learner camera is monitored during attempt with full event history for review.

Draw a reference line where the data says

Reference lines can now follow plotted data (average, median, min, max) instead of only fixed values, and update with filters or new periods.

Litmus prepare opts the user in; matcher handles CR lines

WebDAV compliance setup now creates Drive Settings with webdav_enabled; ledger matcher handles carriage-return progress lines.

Bulk-add members with a searchable picker

Replaced single-person picker with searchable multi-select list and "add everyone" one-click for communities with hundreds of members.

Add currency details for Georgia in countryInfo.json

Added missing `currency` and `currency_name` fields; fixed `currency_symbol`.

Fix horizontal scroll, off-center page, and dynamic rescaling (ReportPrintView)

Page preview had horizontal clipping, was offset right, and scale didn't update on window resize.

Foreign currency invoices incorrectly marked as "Partly Paid" on submit

Payment status checked were comparing base currency amounts instead of invoice currency amounts.

General Ledger Ref Name filter dropdown empty & Accounting Entries navigation broken

General Ledger Ref Name filter dropdown empty & Accounting Entries navigation broken

Link field search stops working after clearing selection

Component cached database results; clearing the field didn't invalidate cache, so subsequent searches returned stale results.

German translations broken by corrupted CSV quoting

Three lines had mismatched quotes breaking RFC 4180 parser; fixed quoting to restore German translations.

SalesQuote list view shows 'Paid' status incorrectly

Switched from invoice status column (which shows payment states) to document status, and removed misleading outstanding amount column.

Force Latin digits in number formatting for all locales

Arabic locales defaulted to Arabic-Indic numbering; now forced to Latin digits globally.

Sum outstanding amounts across all references in payment validation

Multiple invoice payment validation was using assignment instead of accumulation, keeping only the last value.

Use startsWith('Sales') for party labels in print templates

Hard-coded `entryType === 'SalesInvoice'` caused non-invoice sales types to show wrong labels ("Supplier" instead of "Customer").

Fix negative tax rate adds to grand total instead of reducing it

Tax amounts were passed through `.abs()` which stripped the sign from negative taxes like withholding tax.

Alternative finished goods conversion against work order

Work orders can now regrade/convert to alternative finished goods during QC; remains linked to original work order.

Batch split operation to produce child batches per piece

BOM Operations gain Batch Split checkbox and Weight Per Piece field to auto-create child batches per unit during production.

Erpnext sidebars and workspaces

ERPNext adopts Sidebar fixtures replacing workspace sidebars for curated navigation.

Sum item and its alternate transferred qty on work order

fix: sum item and its alternate transferred qty on work order

Persist redistributed additional costs during stock entry repost

fix: persist redistributed additional costs during stock entry repost

Check write permission in edit_note

fix(crm): check write permission in edit_note

New creation flow

Print format creation now starts with builder as the front door; new dialog for format type selection; HTML-only report formats route to form.

Run the record-page engine's tests from the shell

Adds vitest harness to run 14 record-page unit test files from the frappe shell, closing test infrastructure gap.

Run contributed record customizations through the engine

Record-page engine accepts contributed customizations (fields, sections, buttons) and runs them against the live form.

Host the SPA shell at /apps from one bench-wide build

Central SPA shell now hosts contributed record-page customizations through a seam; one build per bench instead of per-app.

Serve apps by declared prefix under /apps

Routes apps by declared URL prefix instead of hardcoding paths, unifying app hosting policy across the framework.

Read doc and field-level permissions from the client

Adds useUserRoles and enhanced useDoctypeMeta for SPA frameworks to check permissions without boot data.

Add a way for non desk apps to go desk page of the app

feat: add a way for non desk apps to go desk page of the app

Add the missing get_current_user_roles endpoint

Record pages were failing to fetch user roles due to missing server endpoint.

Use espresso tokens in sidebar and dock

fix: use espresso tokens in sidebar and dock

Add help and menu items back

fix: add help and menu items back

Report PDF export clips columns beyond the page width

fix: report PDF export clips columns beyond the page width

Web form save fails when the form has a currency field

fix: web form save fails when the form has a currency field

Attach files linked by url to attach fields

Extends attach_files_to_document to handle http/https URLs and properly create File records on duplication.

Honour ignore_if_duplicate on a unique key violation

SQLite `bench new-site` was failing during frappe install; db_insert now honors ignore_if_duplicate flag consistently.

Email dialog ignores document's print language

Print language defaulted to system language despite document's setting; now respects guess_language() logic.

Validate group_by args before saving report

Validates `group_by` arguments against a strict whitelist before persisting report definitions.

Revalidate redirect targets in get_web_image()

fix(utils): revalidate redirect targets in get_web_image()

Escape Attach/Img./Sign./Barcode field values in print format temp.

Escapes field values to prevent XSS in print templates.

Check perm. before unzipping file

fix(file): check perm. before unzipping file

Enforce permission checks on list and delete

fix(virtual): enforce permission checks on list and delete

Module sidebars

HRMS navigation moves from workspace sidebars to per-module Sidebar fixtures, with nine semantic navigation-only modules.

Support custom attendance calendars

Attendance calendars now pass sorting through to queries and respect custom view status colors.

Error message in html to text

fix: error message in html to text

Migrate write TextEditor instances to frappe-ui/editor

Migrates TextEditor, comment areas, email templates, and panels to reusable RichTextField component wrapping frappe-ui/editor.

Align sidebar icon spacing with CRM and Helpdesk

fix: align sidebar icon spacing with CRM and Helpdesk

Show volume slider on lesson video player

Volume control now visible on both embedded and uploaded lesson videos.

Keep the signup form independent of frappe develop

Signup form broke on released frappe versions; now defines banner macro locally instead of importing from frappe develop.

Published status across dashboard and editor

Grid dashboard cards and editor toolbar now display publish status; heading truncation and pb-10 fixes applied.

Block traversal segments in standard page export paths

Developer-mode exports now reject `..` segments to prevent writing outside the app directory.

Add an end-to-end test suite

Adds 61 browser-based E2E flows across eight areas (query, workbook, charts, etc.) with zero quarantined tests.

Require JSON config values to be an object or array

fix(site-config): Require JSON config values to be an object or array

Require JSON config values to be an object or array

fix(site-config): Require JSON config values to be an object or array

Skip rate limit on all dedicated server plans

Rate limiting now correctly skipped for all nine dedicated server plans, not just two.

Add press_otp and press_otp_sent cache to persistent cache keys

fix: Add press_otp and press_otp_sent cache to persistent cache keys

Replace the automatic table restore with a button

Site updates that fail recovery now offer a manual restore button instead of attempting automatic recovery.

Unify appearance preferences

Consolidated theme preference to User.desk_theme; removed divergent Mail, Calendar, Writer, and Meet theme implementations.

A user with no Gameplan role sees onboarding instead of a 403

SPA now correctly renders 403 errors instead of showing onboarding; permission queries fixed to check user roles before returning empty list.

Draft and declined events, and a week-aware header

Calendar events now distinguish draft (saved, unsent) from declined state; primary button adapts to Send/Save based on invitation status.

Draft and declined events, plus follow-up fixes

Adds isDraft and isDeclined flags to calendar events with dashed/struck-through rendering; fixes Tabs and related UI components.

First-class WebDAV server

Drive now runs as an RFC 4918 Class 1+2+3 WebDAV server at `/dav/`, compatible with Windows Explorer, Finder, rclone, MS Office, and mobile file managers.

Don't hardcode studio file access to System Manager, check has perm directly

fix: don't hardcode studio file access to System Manager, check has perm directly

Frappe-ui update fallout — tabs, mobile search, and the details chevron

Migrated tabs to value-based selection, fixed mobile search, and restored chevron in details pane after frappe-ui v1 update.

Improve message formatting and translation for validation issues

Improves message formatting and translation for validation issues.

Preserve job card qty in mr transfer

Keeps Job Card completed quantity through Material Request mapping instead of resetting to zero via Work Order logic.

Reset bin when a repost finds no stock ledger entries

Zeros bin stock_value and valuation_rate when a repost finds no ledger entries, preventing bin totals from drifting.

Sum item and its alternate transferred qty on work order

Fixes transferred quantity calculation for items with alternates on work orders.

Set pos profile on invoices respecting user permissions

Respects user permissions when setting POS profile on invoices.

Ignore cancelled invoices in timesheet portal

Excludes cancelled Sales Invoices from timesheet portal access checks.

Translate doctype in map msg

Translates doctype names in map validation messages.

Classify MRP items without a BOM as Purchase

Sets type_of_material for items without a BOM so they appear and dispatch correctly in MRP reports.

Validate frozen accounts in period closing voucher

Restores frozen-account validation that was being skipped due to argument order in version 15.

Check quotation write permission before marking lost

Validates write permission before the `declare_enquiry_lost` endpoint modifies a Quotation.

Check sales order permission before work order creation

Blocks unauthorized Work Order creation by users without read access to the Sales Order.

Refactor!: allowing page_length argument for controlling amount of fetched linked items

Introduces `page_length` argument with default 0 (all linked records) for `frappe.db.get_link_options`. Breaking change.

Support none filter to avoid stricter type validation

Supports `none` filter to skip stricter type validation.

Module sidebar

Introduces module sidebars that will map 1:1 with module definitions.

Allow null filters in custom html block link query

Accepts `None` for the filters parameter in custom block link search.

Removing unusable button that appears on clicking checkbox

Removes an unusable button that appeared when clicking a grid checkbox.

Allow non-system managers to print report with print format

Allows non-System Manager users to print reports with custom print formats by skipping full Print Format read-permission checks.

Translate field labels in bulk edit dialog

Builds translated field labels from parts so the Bulk Edit dropdown shows correct language labels.

Let the v16 sidebar conversion survive real v16 data

Fixes v16 migration failure caused by bad data during sidebar conversion.

Keep a filtered sidebar item, and land on a doctype

Allows a DocType to be the first item in a sidebar.

Apply consistent HTTP method validation to whitelisted callback dispatch

Ensures callback dispatch validates HTTP methods consistently, closing a permission bypass.

Pin primary contact to top of Deal contacts list

Orders CRM Contacts by is_primary before idx so primary contact always appears first.

Preserve scroll position in grouped list view

Preserves scroll position when reopening a record in a grouped list view.

Kanban three-dot click — In Task Page

Fixes kanban task card menu to open dropdown without the edit modal and adds delete confirmation.

Keep deal activities visible when the lead is not readable

Skips lead history when not readable instead of failing the whole activity load.

Truncate long recipient names in the popover

Truncates long contact names so option rows fit within the email recipient popover width.

Stop an unrelated comment from cancelling a review

Moves iris review concurrency group to job level so unrelated comments don't cancel running reviews.

Run a public execution as its publisher, not with checks off

Runs public executions as their publisher instead of as Administrator with checks disabled.

Let the client reach get_site_info, and land an invitee in Insights

Changes `get_site_info` from GET-only to allow POST so frappe-ui's `call` succeeds.

Check the referenced document, not the one that names it

Fixes five permission-check defects where endpoints read/wrote a second document without validating access.

Remove duplicate countries in local compliance dropdown

Filters duplicate countries from the local compliance dropdown.

Reuse team prefix validation

Reuses team prefix validation for remote files.

Use --dev flag instead of --serve-assets for frappe runner

Uses `--dev` flag for frappe runner and installs dev extras on dev benches.

Mark fully discounted order lines as free items

Marks 100% discounted Shopify order lines as free items so ERPNext keeps the zero rate.

Keep the remembered position when leaving the tray

Stops overwriting remembered panel position when expanding out of the tray.

Integration for S3 service

Adds garage service backend for object storage with bucket creation on demand and pilot integration.

Serve site storage from a six-hourly report

Serves site storage sizes from a cached six-hourly report instead of computing inline on every request.

Add open presentation link to desk form

Adds "Open Presentation" web link on Presentation Desk form.

Size month rows to their events instead of hiding them

Month view rows grow to fit their events instead of using fixed 5–6 row grids with "n more" buttons.

Multi-day spans, a sidebar mini month, and upcoming events

Draws multi-day events across their date spans, adds a sidebar mini-month calendar, and lists upcoming events.

Let the add-app dialog accept a typed branch

Extends the add-app dialog's branch picker to accept typed custom branches.

Accept a custom frappe branch in the setup wizard

Allows typing a custom Frappe branch in the setup wizard alongside the curated list.

Encode presentation slug and fix statement terminators

Encodes presentation slug with `encodeURIComponent` and adds missing semicolons for style consistency.

Ignore xss filter for block & route fields

Ignores XSS filter for block and route fields since the framework now sanitizes JSON fields.

List every branch via one git ls-remote

Lists all branches using `git ls-remote` instead of paginated REST API, ensuring version branches like `version-16-hotfix` appear.

Open sites on their served origin and hint when the host cannot resolve

Opens sites on their actual served origin (handles http/non-default ports) and clarifies errors when the host cannot resolve.

Exclude the app-update poller from task listings server-side

Hides the `fetch-all-app-updates` poller from task listings by adding an `is_listed` flag.

Expand chat composer to four lines

Raises chat input max-height from 44px to 88px to prevent long messages from being clipped.

Reduce mobile camera workload

Requests lower-resolution, lower-frame-rate camera on mobile and uses distinct simulcast layers to reduce encoding load.

Render search palette content

Binds Mail's search content to the dynamic overlay's default slot so the desktop palette renders.

EPF calcualtion logic

Fixes EPF wage calculation to use basic wages plus dearness allowance per EPF Act 1952, not gross minus allowances.

Fix!: tax net_amount and not_applicable

Adds net_amount fields to tax rows and 'Not Applicable' marker for Item Tax Template Detail.

Fix/payment-request-subscription-plans-population

Payment Request now populated with subscription plan details when created from subscription-based invoices.

Option to skip delivery note for service items in sales order

New Selling Settings checkbox skips delivery note creation for service items (opt-in, off by default).

Filter sales and purchase analytics by entity

Adds Entity multi-select filter to Purchase and Sales Analytics.

Skip missing checkbox columns in asset type patch

Asset type migration handles v15 upgrades by checking which checkbox columns exist.

Carry accounting dimensions from Landed Cost Voucher charges

Mandatory accounting dimensions now properly carried to Taxes and Charges rows on Landed Cost.

Added missing filters for cost_center and projects

Party Ledger Summary now filters by cost center and projects.

Keep source rate on re-fetch when maintain same rate is enabled

Skips price list fetch for rows mapped from source documents when "maintain same rate" is on.

Split bank charges from exchange gain/loss on multi-currency transfers

Multi-currency transfers can now have both bank charges and exchange gain/loss on separate rows.

Resolve subscription plans for any reference doctype in Payment Request

Payment Request now resolves subscription plans for Purchase Invoice, not just Sales Invoice.

Reset hardcoded letter head on Incorrect Serial and Batch Bundle report

Removes hardcoded letterhead from report configuration.

Clarify duplicate internal party messages

Error message now identifies which existing internal party blocks creation.

Grant select on link targets to roles with write access

Grants `select` permission on link targets to roles that have `write` access.

Keep pick list links when refetching stock entry items

Preserves pick list link when user re-fetches stock entry item details.

Preserve LCV quantity across stock reconciliation

Stops filtering next Stock Reconciliation by legacy batch number, preserving LCV repricing.

Guard serial batch editor grid lookup

Prevents grid lookup errors when form validation delays table initialization.

Prevent child table doctypes as accounting dimensions

Hides child table/single doctypes from Accounting Dimension picker and blocks them server-side.

Validate serial inventory dimensions

Validates serial item availability at the inventory dimension level, not just warehouse.

Work Order picks wrong Delivery Date when Sales Order has the same item in multiple rows

Work Order now uses the correct Delivery Date when created from rows with duplicate items.

Account for pending job card qty

Excludes pending quantity from Job Card validation to allow follow-up cards.

Respect zero currency precision

When Currency Precision is set to 0, amounts now display without decimal places.

Validate items against source Sales Order in Material Request

Blocks Material Request from deviating from source Sales Order items.

Add support to serve socketio and wsgi app through uvicorn single process

Adds support to serve socketio, wsgi, and rq in single uvicorn process.

New control "Attachment Gallery"

Adds Attachment Gallery form control for viewing, uploading, previewing, and deleting attachments.

Composer — intuitive API, host extensions, real-life stories

Composer API refactored for intuitive prop handling with host extensions support.

Add post_fixture_sync patch section for migrations

New PatchType.post_fixture_sync runs patches after fixture and customization sync.

Install mariadb client tools from ubuntu archives

Removes dependency on external mariadb repo, uses ubuntu archives for client tools.

Quote tabSingles during DocType rename

PostgreSQL now finds tabSingles with quoted identifiers during Single DocType rename.

Align the timeline gutter line with the icon axis

Timeline gutter icon now centered on line; even white space around comment/email avatar.

Handle workspace rendering

Makes workspace rendering robust against bad JSON.

Data validation as guest in web forms

Validates form data for guest users in web forms.

Key link title lookups by doctype and value

Report view now correctly resolves link titles when multiple Link columns contain same value.

Scope child item selection to filtered parents

Scopes child item selection table to filtered parents instead of leaking all parent rows.

Avoid duplicate DROP INDEX for accent/case-colliding fields during schema sync

Handles case/accent-colliding column names on MariaDB during schema sync.

Escape backslashes in filter condition values on MariaDB

Prevents backslash injection in filter condition values.

Apply parent's row-level permissions to child table queries

Enforces parent doctype's row-level permissions on child table queries.

Validate request trace ID format

Validates X-Frappe-Request-Id format before use in queries to prevent injection.

Validate redirect target against parsed origin

Adds validation layer to redirect target to prevent open redirect vulnerabilities.

Skip reference field patch if payment_entry column is missing

fix(expense_claim): skip reference field patch if payment_entry column is missing

Show employer contribution in salary slip

Employer contributions now shown on salary slip doc for transparency.

Backport Forms to main-hotfix

Backports Forms feature from develop to main-hotfix branch.

Validate form field mappings on save

Form builder now re-validates field mappings against allowed catalog on save.

Treat an unset profile field as empty, not as a change

Clearing a never-set profile field no longer latches the "Not Saved" badge.

Read the PR thread, answer questions, review the delta

Iris review now reads PR thread, tracks settled findings, and reviews delta from prior commits.

Tighten permission and input handling

Expression context isolation, invitation key hashing, and permission boundary hardening.

Mark an email alert as one, and check its recipients at save

Validates alert recipients at save time and bounds them to site accounts.

Rendered output, exported files and database connections

Eight independent fixes including credential permlevel, SSL certificate handling, and connection security.

Link chart cards to the docs

feat(dashboard): Link chart cards to the docs

Open advanced analytics by default

Advanced analytics section now open by default; toggle still available to collapse.

Allow renaming a press role