Tuleap 17.0 (nov.2025)

  • Publié le Jan 23, 2026
  • 3 Minute(s) lue(s)
Prev Next

Tuleap 17.0: A fresh look for a solid core


New logo, new colors, and a modernized UI, Tuleap’s visual identity gets a major refresh.
The product comes first, and the website will follow soon.
You can now export linked artifacts in Cross-Tracker Search, and more legacy services are being phased out to simplify the experience.

New logo, new visual identity

Tuleap’s visual identity hasn’t changed in a while and deserved a refresh to modernize its look and feel. The orange theme now features new colors, along with a new logo and favicon.

Dashboard overview of Tuleap showing user statistics and project metrics.

Tuleap home page with the updated design

The other color schemes (blue, red, etc.) remain unchanged.

Cross-Tracker Search: export linked artifacts

In previous releases, we introduced the display of linked artifacts in the Cross-Tracker Search widget. These are now included in XLSX exports.

Overview of drone camera system requirements with statuses and links to related artifacts.

Cross-Tracker Search with expanded links

Spreadsheet displaying system requirements, statuses, and submission details for review.

Corresponding XLSX export

The export is contextual: only the links expanded in the interface are included in the XLSX file. You can still choose to export the entire list of results without the links.

The Grand Burning Parrot Migration

You may not be familiar with “Burning Parrot” and its predecessor, “Flaming Parrot”—the technical names for Tuleap’s two themes. Flaming Parrot, introduced in Tuleap 7.0 (2014), is the older theme. While most pages now use Burning Parrot (Backlog, Artidoc, Program Management, Kanban, Test Management, etc.), some areas still rely on the outdated framework.

This inconsistency affects both design and user experience and creates extra work for developers, who must maintain two versions for consistency.

We’ve begun addressing this issue in Tuleap 17.0, starting with the File Release System.

File release system page with Burning Parrot theme. It lists one package named "MyApp"

File Release System with the list of packages

Detail of "My app" package with Burning Parrot theme. It lists one release "Release 1.0 - Windows - ARM64"

Detail of a package listing all releases

Detail of "Release 1.0 - Windows - ARM64" release with burning parrot theme. It lists one file with its metadata (size, date, ...) as well as a changelog.

Release level listing all files and metadata

Other Burning Parrotifications

  • Project administration

    • Permissions request

    • Project history

    • Access logs

    • References

    • Disk usage (statistics plugin)

  • Subversion

    • Commit rules

    • Deletion

  • Continuous Integration service

  • Old « Wiki » service based on PHPWiki (it should not be an excuse to use it)

More updates on this migration will follow in future releases.

Last Station for Legacy Services

As part of our effort to ensure application consistency, some outdated services will be removed in Tuleap 17.1 (early December 2025):

  • Tracker v3 (the very old version, replaced by Tracker v5 14 years ago).

  • Old document manager (that was replaced by Document, 5 years ago)

  • Project links widget

The first two have direct replacements, and most users are already using the newer versions. The Project Links widget, however, lacks a 1:1 replacement. Upgrading it would require a full rewrite for a limited feature set, making the effort unjustifiable. If you still use it, it can be replaced by a Note widget with links written in markdown.

Legacy wiki end of life

The legacy Wiki service (PHPWiki-based) has been deprecated for 10 years. It will be removed entirely in Spring 2026. A warning message now encourages users to migrate to MediaWiki.

Bugs and requests

During the 17.0 release cycle, 48 requests were implemented. Bugs and security fixes have already been backported to Tuleap Enterprise builds. You will find below a detailed list of fixes. The most notable ones are in bold.

Security

  • #45251 Missing CSRF protection in the management of SVN commit rules and immutable tags – CVE-2025-64117 – Moderate

  • #45259 Missing CSRF protections in the File Release System – CVE-2025-64482 – Moderate

  • #45246 Webpack: 5.88.2 -> 5.102.1

  • #45254 Go: 1.25.1 -> 1.25.3

  • #45212 MediaWiki: 1.39.13 -> 1.39.15

  • #17967 Deploy a useful content security policy (still Work In Progress)

Tracker

  • #45225 Cross references DB table could benefit from indexes including the source|target

  • #45224 Searching artifacts via cross references can be slow

  • #45227 no change submission removes the artifact link field

  • #45223 Tracker CSV export breaks on recently installed instance

  • #45233 Unable to enter a numeric value in Actions automatically performed

  • #45237 unable to add a link after deleting it in new artifact links

  • #44882 GraphOnTrackers should not use open list fields

Cross-tracker search

  • #45221 Cross tracker search arrows broken when collapsing/re-expanding parent

Document

  • #45260 New version modal not displayed after drag&drop

Kanban

  • #45226 data set to 0 does not appear in the kanban detailed view

Artidoc

Timetracking

  • #45261 Align timetracking widget names

Rest API

  • #45205 Project/id/user_groups should not return legacy ugroups

Platform Administration

  • #45230 DB migrations should ran on all installed plugins

  • #44883 Add missing logrotate file for statistics plugin

Articles Liés