Migrations moved out of Specivo

Specivo no longer reads other trackers itself. A separate migration tool reads the old system and writes an import bundle: a folder of plain files with projects, issues, history, wiki pages and attachments. Specivo then validates the bundle, can rehearse it with a dry run, and loads it with python -m specivo.cli.import_data --source bundle. Keeping the two apart means a tool can be fixed and released without a new Specivo, and Specivo needs nothing from the old system once the bundle exists.

The tools and the SDK live in their own repositories:

The Jira tool has its own documentation and a page that explains the move: migrating from Jira.

Bundle imports got a few additions in this release:

  • Project by project. You can load one project at a time. Relations, issue parents and text references to the other side are kept in a links file and resolve once that side is loaded.
  • Pending references. admin import-map pending, resolve-pending and purge show the references still waiting in a links file and let you finish or clear them.
  • More in a bundle. A bundle can now carry sprints, labels as tags, remaining estimates and custom field names.

The importing guide covers the Specivo side, which is the same for every tool.

If you used the built-in Redmine import

The built-in Redmine importer is removed, together with the importers extra and make import-redmine. Scripts and scheduled jobs that call them need to change. Use the Redmine migration tool to write a bundle, then load it. Nothing changes for an instance that never ran the direct import.

If you did import with the old tool and want to add to that import, move its rows to the bundle's key first. Otherwise the bundle is treated as new data and duplicates it. The upgrading guide has the exact import-map rename steps.

Versions and sprints

  • Version sorting. The roadmap and the Versions settings tab can sort by version number, due date or status. The choice is remembered per user, and a "Show completed versions" toggle hides or shows closed ones.
  • Numeric order. Versions now sort by version number, so 0.2.0 comes before 0.10.0.
  • Sprint counts. The "done" count in a sprint now uses status categories instead of status names.

Issue history that reads better

  • Names instead of ids. History shows names for statuses, versions, categories, assignees, parents and custom fields, limited to what the reader may see. Custom fields show by their defined name everywhere, and user and version values by name.
  • Files in history. Uploads and deletions appear as "File X added" or "File X deleted", and attachment history shows the file name instead of an id.
  • API and MCP. Journal details in the REST API now include old_name, new_name and field_name. The MCP tool specivo_list_comments takes include_changes. PATCH /issues/{ref}/ returns a journal_id, so an upload can join the history entry of the edit.

Access and security

This release closes several places where a person or a key could see or do more than intended.

  • Project-limited API keys. A key limited to some projects now applies that limit everywhere, in REST and MCP. Outside it, a project reads as not found, and account-wide or instance-wide actions are refused. Before, such a key could create an unlimited key for itself. That is fixed.
  • Files. Adding a file now requires the right to change the issue, wiki page or comment. Deleting someone else's file requires the right to manage that container's files.
  • Billing rates. Changing them requires manage-project, and listing them requires view-time-entries.
  • Private issues. They no longer show in sprint and version lists, MCP version and sprint issue lists, dashboard counts, velocity and autolinks for people who cannot see them.
  • History leaks. History names, parent keys and relation changes no longer reveal issues, projects or people the reader cannot see.
  • Search. It no longer reveals whether a private project exists, and semantic search snippets are now escaped.
  • Anonymous visitors no longer see the names of users outside the projects they can open.
  • Saved filters can no longer be read by id from another project.
  • Redirects after sign-in, single sign-on and page-size changes always stay on this site.
  • Bulk tag requests no longer accept unlimited names and issue ids, and a repeated issue id no longer causes a server error.
  • Agent token logs no longer accept another user's session.
  • Secrets on disk. configure.py now creates .env and .env.local readable only by their owner. Run it and docker compose as the same user.

Other fixes

  • A request's changes were committed after its response was sent, so an immediate follow-up request could still read the old data. A failed commit now returns an error instead of a success.
  • [[wiki links]] and issue keys are no longer rewritten inside code and raw HTML.
  • Files dropped on the issue edit form are no longer discarded on save.
  • Recurring pattern pages no longer link generated issues to a missing page.
  • Search pagination links no longer break when the query contains &, # or +.
  • The mcp key scope is removed from the guide. Core never enforced it.
  • The single sign-on test identity provider compose file moved to tests/fixtures/sso/, and CI workflows now run with a read-only token.

What to do when upgrading

Back up your database and data directory first. This release has no database migrations, and nothing needs configuring to keep working as before.

  • Used the built-in Redmine import? Switch to the Redmine migration tool, and update any script that called the old options. See the note above for continuing an earlier import.
  • API keys limited to some projects now stay inside those projects. Check automation that relied on them reaching further.
  • Run configure.py and docker compose as the same user. The environment files are now readable only by their owner.

The upgrading guide has the full details.

How to get it

Pull the Docker image with docker pull specivo/specivo:0.11.0. For servers without internet access, the GitHub Release includes an offline bundle. The source is at github.com/specivo/specivo. For installation and upgrade steps, see the user guide.

Jira is a trademark of Atlassian. Specivo is not affiliated with or endorsed by Atlassian.