Gingerbread
Home/Changelog
● Latest: v0.0.1

Every ship, receipts and all.

Every release since we started keeping this log. What we added, what broke, what we quietly deleted because nobody was using it. If you're self-hosted, the update note tells you if the migration is safe to run at lunch or better after coffee.

11
Releases tracked here
1,847
Commits
3.8 days
Median release cadence
0
Major outages
Filter
April 2026
Apr 14
v0.0.1

Initial release. Hello world end-to-end.

Walking skeleton
December 2025
Dec 4
v4.18.2

Cosmetic but embarrassing. The 'issued' date was being re-serialized at render time instead of stored. It matched, unless you printed a very old invoice on a Sunday, in which case it definitely didn't.

FIXInvoice PDFs now use the stored issued_at, not the render-time stamp
FIXRetainer widget no longer double-counts if you refresh mid-fetch
FIXiOS Safari: the status-bar color on the portal actually matches dark mode now
12 files+94 / −156self-hosted: safe to update anytime
November 2025
Nov 28
v4.18

The most-requested feature of 2025 (612 votes). Clients can leave a comment inline on any line item before paying. Threaded, notifies you by email, resolves when you respond. Built by two people over four weeks.

NEWInline client comments on invoice line items, with email notifications
NEW'Awaiting your reply' filter on the invoice list view
NEWPortal comment notifications: digest or realtime, per client
FIXMentions in internal notes now autocomplete team members
v4.1824 PRsMigration: 40-second DB alter, do it off-hours
Nov 17
v4.17.3

A reporter on our disclosure program found a reflected XSS in the password-reset link if you hand-crafted the email query param. No evidence of exploitation. Bounty paid. All hosted workspaces patched within 3 hours.

SECSanitize email param on /auth/reset
SECTighten Content-Security-Policy on /portal/*
FIXSession cookie now SameSite=Strict on the portal subdomain
Reported by@hauke on our Bugcrowd programSelf-hosted: update ASAP
Nov 10
v4.17.2

Both directions, finally. If you ran cloud and self-hosted side-by-side (some agencies do), expense categories now match across both. We also fixed the three places the UI called them 'tags' instead of 'categories'.

NEWTwo-way expense category sync across workspaces
NEWBulk re-categorize from the expense table
FIXConsistent terminology: it's 'category' everywhere now
v4.17.2self-hosted + cloud4 issues closed
Nov 6
v4.17.1

Swapped Puppeteer for a custom Chromium pool. Nothing changed visually. Big invoices used to time out at 60s on slow hosts. They don't anymore. Self-hosted Docker image is 120 MB smaller.

PERFPDF generation p95: 4.2s → 1.3s
PERFDocker image: 480 MB → 360 MB
FIXLong invoice totals no longer clip on the last page
InternalNo UI change
October 2025
Oct 30
v4.17

Clients can see how many retainer hours they have left without emailing you. We expect this to remove about 200 'how much is left?' emails per month across our customer base. Please do tell us if it removes more.

NEWRetainer balance widget, visible only when a retainer is active
NEWPer-client retainer alert when balance drops below 20%
NEWRetainer auto-renewal toggle with a human-readable preview of the next invoice
v4.17Community requestfrom Katerina W. + 31 others
Oct 22
v4.16.4

It shipped in beta in August, had a 31% adoption rate, a 12% retention rate after two weeks, and a 0% rate of anyone emailing us to say they liked it. We pulled it. If you used it, we're sorry, and we'd love to hear why via bruno@gingerbreadapp.com.

RMAI suggested reply in the invoice composer
RMThe corresponding OPENAI_API_KEY env var on self-hosted (ignored, won't crash)
Killed featurefrom Settings → Labs
Oct 12
v4.16

Previously a CSV slog. Now a one-screen connector. OAuth, select date range, go. Brings over clients, invoices, payments, expenses, and, if it was ever correctly tagged, categories.

NEWFreshBooks OAuth connector with date-range selection
NEWPreserves original invoice numbers and statuses
NEWOptional: keep reading from FreshBooks for 30 days during your transition
v4.16Migration250+ customers waiting since July
September 2025
Sep 29
v4.15.2

SHA-1 has been deprecated for a while. We left it in for a year to let everyone migrate. That year is up. Old signatures stop being sent on December 1. If you haven't updated your receiver, now's a great time.

BRKWebhook X-GB-Signature header now uses HMAC-SHA256
BRKX-GB-Signature-v1 (SHA-1) header will be removed Dec 1, 2025
NEWWebhook settings page shows a 'last 10 deliveries' log for debugging
Breaking change60-day noticeAffects webhook consumers only
Sep 15
v4.15

For retainer work. Block out every Tuesday 9a–11a, it auto-logs. Skip a week from the widget without editing the schedule. Under the hood this is 40% of what we need for a full calendar view, which is coming.

NEWRecurring time entries with skip / edit-once / edit-all
NEWWeekly timesheet view (beta, in Labs)
FIXTimer doesn't double-log when the tab sleeps and wakes
Roadmap pickVoted 377 times
Don't miss a ship

Get the changelog in your inbox.

One email per release, never more than two a week. Self-hosted folks get the upgrade notes a day early. Subscription endpoint is on the way — for now, follow along on your channel of choice.