Everybody loves automation, isn’t it ?
Check out the release note of Tuleap hereunder to see what’s new.

Execute your own code at artifact update

Would it be possible that all the task I create are automatically assigned to me ?

One fellow user

In my requirement, I need to compute a risk that is a product of Severity and Probability

Another fellow user

Workflow is awesome and when there is a transition I would like that …

As users we are more creative than as developers

There are tons of things that would be very convenient to automate when a user story, a task, a requirement is updated. But the flip-side of the Tuleap Trackers flexibility is that developing all those features is way more work that you would expect because of the hundreds of configurations that can happen in the wild. Sometimes we are stuck between the devil and the deep blue sea: should we implement a highly specialized « Risk computation » field, well defined, easy to build but not flexible or should we implement a « 3 or 4 levels field dependencies », way more flexible but nightmarish complex to do and configure ?

Introduce Tuleap Functions

There is another way: Tuleap Functions. Tuleap Functions are code, your code, that is executed on your artifacts at creation and update. If you already know Tracker Webhooks, it’s similar except that Tuleap Functions remove all needs for infrastructure: no need for another server to run them 🤩.

You might be thinking « Ok, they provide some kind of crappy Domain Specific Language with even more crappy tooling around it » and you would be… wrong. You can write Tuleap Functions in (almost) any language you love (Rust, Go, Typescript, …) because we rely on WebAssembly.

In short, WebAssembly is a platform and language independent runtime with very strong security requirements thanks to sandboxing provided by Wasmtime.

How does it work ?

You need to upload your Tuleap Function (a WASM module) in the new section of Tracker’s Workflow

This Function will:

  • receive at each artifact update (or creation) a JSON representation of the artifact
  • and is expected to output another JSON representation that corresponds to the the result of the transformation you want to apply.

For instance, let’s imagine you want to compute a Risk based on Severity and Probability (Risk = Severity x Probability). In your tracker you have:

  • One select box called Severity with values from 1 to 4
  • Another select box called Probability with values from 1 to 4
  • A third select box called Risk with values from 1 to 16

The Tuleap Function will receive a JSON object that corresponds to the artifact

  1. extract the two need values (eg. Severity = 2 & Probability = 3)
  2. make the product of them
  3. look for the Risk value that have a label equal to « 6 »
  4. output a JSON object with the select box value found at step 3.

Tracker administrators have a dedicated space to trace execution of Functions, to track success / failures, get input payload and produced output so they can improve their test suites.

Share your Functions

Starting now, the limit is your imagination (as long as your imagination executes in less than 10ms and 4MB) and we are thrilled to open a repository dedicated to code samples. Please share your use cases and how you solved it so other users can re-use and improve.

Better history in Document

Document got a more usable and modern view for history of changes as well as history of access.

Subversion and EL9 platforms

EL9 stands for Enterprise Linux 9, it’s our way of describing RHEL, RockyLinux, AlmaLinux in their 9 flavor. It’s production ready since a while but there was still a blocking migration point for fellow users with EL7 deployment: Subversion behavior change between 1.7 (version of Subversion on EL7) and 1.14 (version of Subversion on EL9). To make it short, Subversion 1.10, change the way it handles permission definitions. Unfortunately, there is not much we can do with that, Subversion administrators will have to review their permission scheme to ensure it’s still consistent after upgrade.

However before doing that, there was one thing that Tuleap needed to support: let subversion administrators decide if they want default permissions (on repository root) managed by Tuleap or not. This choice is now in administrators hands in the permission screen.

Golang lib & CLI

After inital release showcased in the previous release note, Guillem Bonnefille has continued his work go-tuleap and tuleap-cli. It is now possible to attach a file to an artifact, create any element of the FRS plugin and even upload a file to a release. Even better, with the support of TUS protocol to support large files.

Welcome PHP 8.2

You don’t see all constant gardening that is done on all development dependencies (libraries, tools, etc) because it’s transparent for the end users. Some of those updates (bump as we call them) are more significant than others, like our main backend language PHP. At upgrade, Tuleap will automatically switch to PHP 8.2, nothing to worry about.

Bugs and requests

There were 48 bugs fixed and requests implemented during the 15.5 release cycle. Bugs and security fixes were already back-ported on Tuleap Enterprise builds. You will find below a detailed list of fixes. The most notable ones are in bold.


  • #35862 Content of artifacts might be readable by unauthorized users – CVE-2024-23344 – Impact Moderate (5.3)
  • #35865 Adjust SSHd crypto settings to prevent Terrapin attack / CVE-2023-48795


  • #35860 Add Add syntax highlighting for .ipp and .tpp files in Git UI
  • #35841 Add syntax highlighting for .hpp files in Git UI
  • #35828 Crash when handling a malformed PR cross ref


  • #35495 Do not allow suspended or deleted user in REST SVN notifications
  • #35810 Removing last group member does not comment group in access files

Full text search

  • #35872 Possible indexing issues when quickly updating the same artifact field
  • #35864 Meilisearch: 1.5.0 -> 1.6.0

Site administration

  • #35870 SSRF siteadmin warning message must only be displayed one day
  • #35856 Drop rsyslogd from container image
  • #35851 SSHd process does not start in container images
  • #35846 Created Gerrit temporary folder is never deleted
  • #35833 Drop the `–update` option from the `tuleap import-project-xml` command
  • #35815 Make sure locale needed for the internationalization are presentunder

Receive once a month the latest Tuleap updates