Security issue with local storage in YouTrack Workflow Editor

As you may already know, a security vulnerability was found in the YouTrack Workflow Editor. Here is a detailed overview of what happened.

What happened
On March 7, 2017, we discovered a security issue in the YouTrack Workflow Editor. When using your YouTrack credentials or JetBrains Account credentials to submit an exception report from inside the Workflow Editor (anonymous reports would not be affected by this), or authorise the Workflow Editor to connect to your YouTrack instance, the supplied credentials would be stored in the user directory in unencrypted format. While this does not pose an imminent security risk as the user folder is accessible only by the specific user, those that would be able to access this file could see the credentials exposed.

What actions we have taken
Latest version of YouTrack Workflow Editor resolves this issue. It doesn’t store user credentials in the configuration folder any longer. This version will delete the file containing unencrypted data on first execution. From there on it will prompt for credentials on every connection.

What actions you should take
Please update your installation of YouTrack Workflow Editor using the instructions and launch the application.
If you believe that someone may have accessed your local home folder and potentially seen your credentials, we’d recommend changing these.

We are very sorry for any inconvenience that you might have experienced. If you need any further assistance, please contact our Support Engineers.

The Drive to Develop
YouTrack Team

Posted in events, newsletter | Tagged , | 4 Comments

YouTrack 2017 Roadmap

Hi everyone!

Today we are going to share our vision for YouTrack development in 2017.
Last year was pretty productive. We fully reworked the Agile Board and released it in YouTrack 7.0. This year, we plan to continue making YouTrack better.

You might have noticed that we recently switched to a new release scheme, for example, YouTrack 2017.1. Our primary goal is to deliver useful features as soon as they are ready, so we plan to release more often. If you are a YouTrack InCloud customer, your instance is automatically upgraded according to our Maintenance calendar. And if you use YouTrack Standalone, you can follow our blog and Twitter feed to get the latest builds.

We also want to try a new approach — to enable experimental features for venturesome users who want try them first. At this point, EAP won’t exist anymore, so you will be able try new features right in your instance. This approach means that you won’t have to install an unstable EAP build and risk your data to try new features. Also, many users who tested new features in our sandbox instance found it difficult to test new functionality without real data. We also hope this helps us to fine-tune the functionality before the feature is officially released. You feedback is highly appreciated, as always.

Let’s have a look at the features we plan to develop in 2017.


As you know, the MPS-based workflow editor has been around for a while. We decided to retire it and implement a built-in web-based workflow editor. The new editor will support JavaScript instead of custom DSL, which simplifies the process of writing and customizing workflows. This new feature lets you write a workflow from scratch right in YouTrack. You can also write a workflow in any IDE that supports JavaScript (for example, WebStorm), pack it to a zip file and upload it to YouTrack. Attach the workflow to your projects and you’re ready to go.

Here is a list of the most popular workflow-related feature requests:

JT-17984 — Implement a built-in web-based workflow editor
JT-18128 — Provide operations on the period field in workflow
JT-10337 — Implement an ability to require a comment/tag
JT-13856 — Allow to create and add shared tag in workflow

We don’t want to over-promise, but we hope to knock them all out of the park.

Issues List and Full Page View

Now, when the new Agile Board looks so fresh and bright, the issues list and full page view issue pale by comparison. They need a little polishing, a fresh look and a better user experience.

Changes are coming to almost all of the elements in full page view: the toolbar, summary and description, linked issues, image editor, custom fields, comments section, attachments, voters and watchers.


We plan to replace the tabbed UI (comments, linked issues and so on) with an activity stream. With this new functionality, you will be able to filter the activity stream to show specific types of activity. This includes the option to display only VCS changes, comments, or work items. We plan to remove the Similar Issues tab and replace it with a link that shows these items in the issues list.


We’re not just redesigning the page, but are also improving the functionality, so we plan to add some new features to the full page view, such as:

JT-23673 — Formating issue descriptions as a checklist
JT-22752 — Adding reactions to comments with emoji
JT-11189 — Downloading attachments as a ZIP archive
JT-21112 — Supporting Markdown syntax
JT-5163  — Sorting comments from newest to oldest

Many users are anxiously waiting for the following minor update. Currently, the option to copy the issue ID and summary to the clipboard is located just to the right of the issue ID. In the redesigned page, this icon will be moved to the left and you will be able to copy either the issue ID or ID and summary from the UI.

copy ID

As for the issue list, we don’t have any detailed drafts, but the general idea is to make improvements to the sidebar, enhance preview modes, and apply some general changes to make it look marvelous.

User Profile

Very soon, you will see a new and improved user profile. The updated interface lets you manage your general settings, notifications, plus tags and saved searches. On the new General tab, you will be able to change your personal information, view connected profiles, manage your time zone and date format. We consolidated all of the notification settings, including notifications that are sent by the TeamCity integration. We added a new tab that lets you view and manage your personal list of tags and saved searches. Here, you will be able to view all tags and saved searches that are shared with you and update your subscriptions.

Current Sprint

This feature is among the most wanted in YouTrack. The fix is in and we have released it recently. With this feature, you can filter for issues that are assigned to the current sprint when you create reports, search for issues and use commands on the board. You can also use current sprint feature to assign issues to the ongoing sprint instead of using the sprint name.

Screen Shot 2017-03-13 at 19.17.59

YouTrack Mobile

We continue working on YouTrack Mobile and plan to make the following improvements in 2017:

YTM-234 — Agile Board enhancements
YTM-202 — Push notifications implementation
YTM-232 — Comments draft support
YTM-128 — Votes and Stars support
YTM-114 — Multiple YouTrack instances support

By the way, YouTrack mobile is an open source project, so you are very welcome to participate. The source code is available under the JetBrains Repository on GitHub.

Other enhancements

One month ago, we published the 10 most wanted features in YouTrack to our blog. We have already fixed some of them, and will continue working on the others during this year. We are also keep improving the current functionality for Agile Board and Reports. For example, we will add an ability to change the Board Owner on the Agile Board, and will make some improvements to Kanban board, custom fields, and cards on the board.

We really appreciate your feedback, so please share your thoughts about our roadmap in the comments below. You are also welcome to vote for existing features, or to create new feature requests. To get the latest updates, subscribe to our blog and follow us on Twitter.

Posted in features, news, newsletter | Tagged | 13 Comments

YouTrack 2017.1 bug fix is out (build 31650)

Please welcome a fresh bug fix for YouTrack 2017.1 (build 31650).

This minor release brings a number of usability and performance fixes and improvements, and some features, including current sprint feature and a new apply command dialog on Agile Board.

With a new current sprint feature, you can assign issues to the ongoing sprint instead of using the sprint name. You can reference the current sprint in search queries and commands.

Screen Shot 2017-03-13 at 19.17.59

This feature is especially useful in reports. When you reference the current sprint in the search query, you can create reports that track your current efforts automatically. The name of the current sprint is shown in bold in the sprints drop-down list.


We also released a new version of the Apply Command dialog for the agile board. In this version, the Silent Apply button is replaced with the option to Notify subscribers. To apply a command silently in the new dialog, deselect this option, then apply the command. Please note that you can only see the option to apply commands silently if you have the Update Project permission in each project for all selected issues.


For more details, please refer to the Release Notes.
If you use YouTrack 2017.1 InCloud, your server was upgraded today, on March 13, 2017 according to our Maintenance calendar.

Get a a fresh build and enjoy the improvements!

Posted in features, newsletter, release | Tagged | 2 Comments

YouTrack 2017.1 bug fix is out (build 31322)

A fresh bug fix for YouTrack 2017.1 is here (build 31322).

This minor update brings a fix for time tracking settings.
Please check the Release Notes for details.

Download YouTrack 2017.1 (build 31322) and enjoy the latest version today.

If you use YouTrack 2017.1 InCloud, your instance was upgraded according to our Maintenance Calendar.

Posted in newsletter | Tagged | Leave a comment

YouTrack 2017.1 bug fix is out (build 31260)

Please welcome a fresh bug fix for YouTrack 2017.1 (build 31260).

This update brings a number of fixes and improvements for the Agile Board, workflows and usability and performance fixes. For more details, please refer to the Release Notes.

Download YouTrack 2017.1.31260 and enjoy the latest version now.

If you use YouTrack 2017.1 InCloud, your instance was upgraded according to our Maintenance Calendar.

Posted in newsletter | Tagged | Leave a comment

Bug fix for YouTrack 2017.1 (build 30973) is out

A fresh bug fix is out (build 30973).

This minor update includes usability fixes. For details, please check the Release Notes.

Download a new version and enjoy the latest improvements now.

Posted in uncategorized | Tagged | Leave a comment

Our Sprint Retrospective

You’ve made it to our last episode in the How We Scrum series. In this installment, I’ll walk you through our sprint retrospective. To catch up on older posts in this series, check out the Introduction, Our Scrum Roles, Our Backlog, Our Approach to Estimation, Our Sprint Planning, The Sprint, and Our Sprint Demo Session.

We consider the Sprint Retrospective to be a very important part our Scrum process. The Sprint Retrospective happens at the end of each sprint, normally on Friday, after the Sprint Demo. This one-hour session helps us to get both positive and negative feedback from the team about the past sprint. By collecting, prioritizing, and discussing feedback from each member of team, we continue with activities that have a positive impact and eliminate negative behaviors.

One day before the Sprint Retrospective, our Scrum Master sends a form to collect the following feedback from each member of the team:

  1. Two things you liked about this sprint.
  2. Two things you didn’t like about this sprint.
  3. Two suggestions for improving our process going forward.

Everyone who wants to share feedback fills in the form at least 15 minutes before the Sprint Retrospective. The Scrum Master tries to combine feedback from different members of the team if it looks similar or related. When done, the Scrum Master prints the answers and pins them to a physical board, grouping them by pluses, minuses and suggestions.
Retrospective board
The whole team gets together and cast votes in support of each piece of feedback. Depending on the number of answers and people attending, each team member can cast two to four votes. Normally, everyone gets three votes.

Retrospective voting

We combine the total number of votes cast in both St.Petersburg and Munich. When the voting is over, the Scrum Master calculates the totals and ranks the feedback from the most voted to the least voted.
Retrospective dots
Starting with the piece of feedback that received the most votes, we discuss each item as a team. The Product Owner normally moderates the discussion, so it doesn’t take too long and stays focused. When all the opinions are shared, the Scrum Master summarizes the action items we need to take in the next sprint in order to keep what’s working well (for positive feedback) or resolve the issue (for negative feedback).
Retrospective discussion
The Sprint Retrospective is over when all of the items (or items that received at least two votes) are discussed. Afterwards, the Scrum Master adds the action items to the Retrospective page and shares it with the team. This helps the team stay focused on these action items during the next sprint and lets anyone who missed the Sprint Retrospective stay up to date.


That was a pretty long story about How we Scrum inside the YouTrack team. I hope you found something to borrow and practice in your team, or just saw something that sparked your imagination and helped you reinvent your process. However, the main idea of the whole series is to share our experience. We believe that the key to a successful development process is not in following any strict guidelines and methodologies, but rather in adopting good practices to our specific needs and goals. Be agile in your own way!

Posted in how-to, newsletter, tips | Tagged , , , | Leave a comment

Bug Fix for YouTrack 2017.1 (build 30867) is out

Please welcome a fresh bug fix for YouTrack 2017.1 (build 30867).

This minor update brings a number of bug fixes and usability problem improvements. For more details, please check the Release Notes.

Download a new version and enjoy the latest improvements now.

JetBrains YouTrack Team
The Drive to Develop

Posted in newsletter | Tagged , | Leave a comment

Our Sprint Demo Session

In this, our seventh episode, I’ll give you a backstage pass to our sprint demo. Previous posts in our How We Scrum series include an Introduction, Our Scrum Roles, Our Backlog, Our Approach to Estimation, Our Sprint Planning, and The Sprint.

At the end of every sprint, we have a sprint demo session. We normally schedule the demo on the last Friday of the sprint. We book one hour for the demo, however, it takes about 40 minutes on average. All team members are required to participate. As always, we connect the St. Petersburg and Munich offices by video conference and start our online show.

The sprint demo is one of the most exciting Scrum activities for us, as every presenter feels like a rockstar on stage, whose goal is to make an interesting and entertaining presentation.
Sprint demo
We announce the set of user stories we are going to demo in advance. The demo is performed by the author of a user story, which is normally a developer, or sometimes a Quality Assurance Engineer, who tested this functionality. The author demonstrates various usage scenarios on a large shared screen and explains how the new functionality works. If the audience wants to see some missed use cases, they ask for it during the demo. Otherwise, all the questions are held to the end of the demo.
Demo Presenter
The presenter answers the questions and Scrum Master records any missing use cases, bugs, and small improvements that come to mind during the demo. Most of the comments and feedback come from the Product Owner, who basically determines whether a new feature meets the acceptance criteria.
When the discussion is over, we list the tweaks we need to finish the feature, and try to fix them in the next sprint. If we realize that it requires too many changes to implement immediately, we can postpone the user story. At the end, the presenter receives a round of applause and joins the audience with all the honors.


Then the next presenter introduces his or her user story. Normally, we do about four demos. Uncompleted user stories demos are moved to the next sprint. The public demo is a very motivating activity. We try to involve all the developers, so they each present a demo in turn. It takes time to prepare and test a user story for several use cases and prepare the test data, but each presenter enjoys the challenge. But that’s not all. Demos are very important for the whole team, as they keep everyone on the same page and give everyone a chance to share feedback immediately.

The last episode Our Sprint Retrospective is coming on Thursday. Watch for updates!

Posted in how-to, newsletter, tips | Tagged , , | 2 Comments

YouTrack 2017.1 is released!

Please welcome YouTrack 2017.1!


YouTrack 2017.1 introduces search based on time tracking, attachments on Agile Board and many other improvements.

Key New Features

  • Search based on time tracking
  • Attachments on Agile Board
  • LDAP bind to a fixed account
  • Permanent access token
  • Credentials management


  • Revised access tab
  • Description for banned users
  • Enhanced Auth Modules

Sounds good? Get YouTrack 2017.1, register a new InCloud instance or download a standalone version today.

Search based on time tracking

You can now filter issues based on the work item type, author and date. For example, if you want find all the issues that you’ve been working on during the last week, use a query work author: me work date: {last week}.


Attachments on Agile Board

In YouTrack 2017.1, you can add and edit attachments directly on the agile board. Simply drag one or more files to any card on the board. This option also works when you open a card in view mode. You can also download all of the attachments, edit the visibility, and attach files privately.


LDAP bind to a fixed account

YouTrack 2017.1 lets you send LDAP bind requests to a fixed user account. This option lets you set up a standard two-step LDAP authentication. With this model, you use a dedicated account for the LDAP bind request and search for the user you want to authenticate on behalf of the bind user.
With this feature, you can set up an LDAP authentication module and still use logins that are not part of the Distinguished Name (DN), like an email address or token. This is also similar to the login configuration that is used by TeamCity, so administrators can use a single model for LDAP integration in all JetBrains team tools. Please check the documentation for more details.


Permanent access token

You can now use permanent tokens to strengthen security for YouTrack integrations with external services. Simply create a new token with a specific access scope, and use it for authentication in API calls.


Credentials management

In YouTrack 2017.1 users can add additional credentials to their user profiles. You can merge existing credentials with your YouTrack account or create a new login. Also, if you accidentally delete your credentials, you can restore your profile with the additional ones.


In addition to the features mentioned above, we have added some useful improvements regarding access management.

Revised access tab

Please welcome a fully redesigned access tab that gives you full control over access management. Grant or revoke roles, see the permissions set, and filter roles per users, projects or groups.

Access tab

Description for banned users

When you ban a user in YouTrack 2017.1, you can enter a reason for performing this action. This description is added next to the user name and is visible to other users who have the necessary permissions.


Enhanced Auth Modules

In YouTrack 2017.1, you can now create and configure a custom OAuth 2.0 module. We also improved the interface for new authentication modules and added pre-sets for the following services: Facebook, Yandex, Microsoft Live, PayPal, Azure AD and Amazon.


To get more details about the release, please check the Release Notes.

Give YouTrack 2017.1 a try, download it today to enjoy all the features!

If you are using a cloud-based version, your instance will be upgraded to the latest version automatically according to our Maintenance Calendar.

Posted in features, news, newsletter, release | 2 Comments