Skip to main content
L
LeopardoHR Platform
Product

Release notes

Major platform updates (curated excerpt).

Start for free
Watch demo

First public release — security, CI and quality

v4.24.0·
  • Full security hardening: SAML/OIDC SSO encrypted at rest, constrained uploads, httpOnly web auth cookie, kiosk XSS eliminated, mobile JWT outside Hive.
  • Backend coverage 71% measured in CI (per-module gate, Payroll ≥ 80% target); 1,917 tests, 424 documented API endpoints.
  • Normalized pagination and response contracts (Growth, Cameras, DeviceToken, CabinetShare).
  • CI: 69 SHA-pinned actions, blocking dependency-review, anti-stale-SHA gate, secret scan A-2 actually executed.

Production fixes — cold start, E2E and payroll

v4.23.5·
  • Render anti-cold-start warm-up for staging E2E (Playwright 15s timeout).
  • Vercel robustness: ignoreCommand with previous-SHA fallback.
  • Payroll fixes: invoice number actually persisted, Render workers/scheduler started, salary_advances FK index.

Dart compilation fixed on the 3 mobile apps + hardened CI

v4.23.4·
  • The main.dart of leopardo_employee, leopardo_manager and leopardo_hr declared main() without async while the body expects SentryFlutter.init — aligned on Future<void> main() async (was blocking the Flutter job on main).
  • CI/CD: supply-chain hardening (SHA pinning of third-party actions) and PHP/Flutter setup deduplication via reusable composite actions (~360 lines less).

34 Dependabot alerts resolved (11 high, 16 moderate, 7 low)

v4.23.3·
  • api (composer): symfony/yaml 8.0.8 → 8.1.1 (ReDoS Parser::cleanup); form-data fixed (CRLF injection).
  • Vitrine and admin: npm audit fix (form-data, ws, js-yaml), postcss fixed, vite 6.4.3 (dev-server SSRF, path traversal).
  • web-offline: Next.js 16.2.10 + ESLint 9 (SSRF, XSS, cache poisoning); npm/composer audit at 0 residual vulnerability.

CI security: workflow_run injection fixed, explicit permissions

v4.23.2·
  • deploy-main.yml: head_branch is no longer interpolated into a run: shell block (environment variable) + head_repository == github.repository check.
  • Explicit GITHUB_TOKEN permissions (contents: read) on the missing workflows; phpstan-modules.neon now loads Larastan (36 undefined method errors resolved).

Marketing Module (Phase 1): base schema and models

v4.23.1·
  • New DDD module api/app/Modules/Marketing/ with tenant migrations social_accounts and social_posts.
  • No raw OAuth token stored (encrypted reference to the aggregator profile); Eloquent models scoped by tenant, Feature tests included.

Marketing manager role accepted by the API (Marketing Module — Phase 0)

v4.23.0·
  • StoreEmployeeRequest/UpdateEmployeeRequest validated manager_role without the marketing value — added to the allowed list (POST/PATCH /employees).

Onboarding drip email: 3 automatic nurturing emails

v4.22.8·
  • SendTrialDripEmailJob sends D+1, D+3, D+7 after trial provisioning (bounded retries, trial status checked).
  • New OnboardingProgress model scoped by company_id + employee_id; mobile onboarding wizard refactored (progress bar, required/error states).

Payroll ParseError fixed + break deducted from worked hours

v4.22.7·
  • PHP ParseError in 7 CountryRules files fixed (main CI unblocked).
  • Break minutes (break_minutes) are now deducted from worked hours (AttendanceLog).

PHPStan Modules Architecture fixed (Absence Eloquent scope)

v4.22.6·
  • AbsenceService::request() and LeavePolicyController::balances() accessed unknown Eloquent scopes — types fixed, CI gate green.

Multi-tenant isolation of queued jobs

v4.22.5·
  • TenantMiddleware now sets the PostgreSQL search_path and the current_company binding correctly for jobs.
  • New App\Contracts\Queue\TenantScopedJob interface: any job requiring a tenant context declares tenantCompanyId().

CI: remaining 136 failures resolved (missing company_id)

v4.22.4·
  • Same bug class as 4.22.3 on AbsenceType: company_id (NOT NULL) absent from the canonical model's $fillable/casts — fixed, 899 green tests.

CI: remaining 160 failures resolved (canonical models)

v4.22.3·
  • The canonical Absence model (via the App\Models\Absence shim) declared neither company_id (NOT NULL) in $fillable nor the proper cast — aligned, 899 green tests.

CI: app/Models shims fixed (class_alias + generation)

v4.22.2·
  • 75 shim files app/Models/*.php generated in v4.22.0: class_alias resolved an incorrect class name — regenerated, Backend + Coverage green again.

Documentation cleanup — mojibake and consistency

v4.22.1·
  • Fixed broken encodings (mojibake) in UML diagrams and other docs — no functional change.

CI unblocked: migration with escaped apostrophes

v4.21.1·
  • Escaped PHP-style apostrophes in a SQL comment of the employee_attendance_preferences migration — the CI blocking all merges is green again.

Architectural cleanup Phase 2 — models, services, FormRequests

v4.22.0·
  • 17 orphan models moved into Core/Tenant/Domain/Models and Core/Auth/Domain/Models; services and FormRequests reorganized by module.

API architectural cleanup — legacy duplicates removed

v4.21.0·
  • 90 duplicate controllers removed from app/Http/Controllers/Api/V1 (migrated into app/Modules/*/Interfaces/Api/V1).

EdgeSync: EdgeController migrated to the DDD module

v4.17.4·
  • EdgeController and EdgeDownloadController migrated from app/Http/Controllers/Api/V1 to App\Modules\EdgeSync\Interfaces\Api\V1.
  • Modules PHPStan raised from level 3 to 5 with targeted suppressions for modules under migration.

Full history: CHANGELOG.md at the repository root.