Changelog
Zulivio changelog
What changed in each release. Full details and downloads are on the GitHub releases page.
v1.12.1
security update: zod 4.6.6 (fixes a memory-exhaustion advisory). No behaviour changes.
v1.12.0
added Mobile Call History — register company phones under Settings > Mobile Devices (per-device token, shown once), sync call metadata in real time (MacroDroid) or in bulk (a future Android app, or an uploaded call-log export to back-fill old history), and browse it under Sales > Calls and on each lead. De-duplicated, tenant-isolated, role-scoped, with retention and delete controls. Also removes the DISABLE_CSP opt-out (CodeQL insecure-helmet alert).
v1.11.0
added a MacroDroid missed-call integration — a MASTER_OWNER can issue a per-device API token (Settings > Integrations) for an employee's phone, then MacroDroid's "Call Missed" trigger posts it to a new webhook that matches the caller against an existing lead or opens a new one, owned by that employee, with a callback follow-up scheduled right away so it surfaces in their queue.
v1.10.0
the Leads list can now select every lead matching your current filters, not just what's checked on the current page, and delete them all in one action. Data Hub adds a type-to-confirm "delete all leads" danger zone for clearing test/demo data in one shot.
v1.9.1
fixed lead CSV import not recognizing a "Public Phone" column (common in scraped/lead-gen exports) — those numbers used to land silently in custom fields instead of the lead's phone field. Leads can now be bulk-disqualified with a loss reason (the existing "Move to stage" bulk action), and a new "Delete permanently" bulk action removes selected leads outright for when the rows themselves need to go, e.g. a bad import — bulk-disqualify into a loss stage stays the recommended way to clear a batch, since it's reversible.
v1.9.0
added an Attendance calendar showing your own present/absent days and worked/break time for a month, plus a manager+ "Team attendance" table (days present, worked/break time, calls) for everyone in your team over a date range. Fixed a bug where a lead assigned to someone (as opposed to an Assignment) never showed up on their Overview/Start Work page. Fixed lead CSV import picking an Excel-mangled phone column over a clean fallback column (like phone_local_10d) already present in the same row. Removed the "Call next lead" button from My Day; its overdue-follow-ups count now links straight to the Follow-ups tab.
v1.8.1
fixed phone numbers getting mangled into scientific notation (e.g. "9.18605E+11") when exporting/importing leads as CSV and opening the file in Excel — exported phone numbers now stay plain text, and a phone number that already arrived in that mangled form gets reconstructed on import. Agent Assist's caller-ID lookup now matches a lead by phone number regardless of country-code formatting.
v1.8.0
leads can now be deleted (lead page and board cards). Fixed a Tasks page crash ("Cannot read properties of undefined") that could happen if the tasks endpoint ever resolved with a missing list. Pipeline cards for a lead-converted opportunity now link back to that lead's page instead of being a dead end. The per-employee report now also shows a login count. Assignments can now optionally link to a specific Lead or Opportunity, so a work item stays connected to the CRM record it's actually about — the link shows on both the Assignments list and the linked record's own page.
v1.7.1
account creation and password-change now have a show/hide toggle and a confirm-password field so a mistyped password is caught before submit. Opportunities CSV import now validates expectedCloseDate instead of surfacing a raw database error on a bad date. Leads CSV import now accepts a company-only row (no full_name) — common in scraped/B2B lead exports — falling back to the company name as the lead's identity, and the leads importer is now also available on the Data Hub page.
v1.7.0
separated employees can now be permanently deleted (once they have no lead/assignment/attendance history to lose — otherwise you're told exactly what's blocking it), fixing a gap where a SUSPENDED/ ON_LEAVE employee also couldn't even be separated in the first place. Adds a one-tap "Quick access" shortcut row to the master dashboard, a quick "Note" button right on lead board cards so a caller can log a note without opening the lead, and a copy-to-clipboard button for the phone number on the lead workspace page.
v1.6.1
fixes a Helpdesk page crash ("x.find is not a function") that could happen if a workflow query ever resolved to something other than an array — now degrades to "no workflows" instead of crashing the page.
v1.6.0
CSV lead imports now preserve any unrecognized columns (rating, category, outreach angle, etc.) into a custom-fields bag instead of dropping them, so any export shape can be imported without a schema change. Adds a forced password-change gate after an admin resets an employee's password, and one-tap call/WhatsApp/copy quick actions right on lead board cards.
v1.5.0
security and zero-config hardening, plus a large batch of CRM feature work. Closes the Critical/High findings from a full security audit: the auth guard is now global (deny-by-default — a new controller that forgets to guard itself is protected automatically instead of silently open), every duplicated role-hierarchy check was consolidated into one source of truth, a real race condition in assignment/employee number generation (two requests landing at the same instant could collide) is fixed with a bounded retry instead of a plain count-and-increment, an Origin/Referer allowlist now backs the existing CSRF defense, Helmet security headers were added, and bootstrap/password-change are now rate-limited (previously only login was). Fixes an insecure Helmet configuration flagged by CodeQL — the Content-Security-Policy is now on by default instead of opt-in. FIELD_ENCRYPTION_KEY (protects saved S3 backup / Google Sheets credentials) is now auto-generated and persisted on first run instead of requiring manual setup — matches this store's zero-config install philosophy. The S3 backup secret access key is now encrypted at rest. Employee email uniqueness is now enforced globally, not just per-organization (closing the same race at the database level, not just the app layer), closing a real data-integrity gap. Also adds local backup download/upload restore and in-app self-update, a redesigned retractable sidebar, a linked user manual and public docs page, an MCP server with personal API keys, a Google Sheets Settings integration, a Postgres healthcheck default-database fix, and a mobile accessibility/contrast fix from a Playwright/axe audit. Adds a large Sales Head / RBAC layer: scope-resolution helpers (Manager vs Sales Head vs Admin), an employee workspace UI, a sales head dashboard with drill-down, a quality audit/workflow/helpdesk module, plus a cross-tenant isolation e2e suite backing a published security audit report.
v1.4.0
the employee directory now only ever shows accounts strictly below your rank (never a peer or higher), matching what edit/reset-password/remove already enforced. Employees, Sales Dashboard, Data Hub, and Settings are now guarded even on direct URL access, not just a hidden nav link. Adds an audit log viewer (Settings > Activity log, Master Owner only).
v1.3.0
backups can now be connected entirely from Settings (Master Owner only) — endpoint, bucket, and access key are entered there, tested live before saving, and stored in the app itself. No CasaOS/ env-var editing required, though the S3_BACKUP_* fields above still work as an alternative.
v1.2.0
adds automatic S3 backups of the database and uploaded files, configured via the S3_BACKUP_* fields above, with verified rolling retention and a one-click destructive restore. Moves the default web port from 3100 to 2996 to reduce collisions with other apps.
v1.1.0
fixes login on plain-HTTP CasaOS/ZimaOS installs (the session cookie was marked Secure and silently dropped by the browser — see COOKIE_SECURE below). Adds opportunities CSV import/export, territory and capacity-based assignment routing modes, and rep-level forecast breakdown on the sales dashboard.
v1.0.0
employee lifecycle, role-based access control, work assignments, attendance tracking, knowledge base and tips, master dashboard, and CSV/Google Sheets import-export.