v1.4.1-rc2

What's Changed

• fix: enforce FILE_SIZE_LIMIT on published Space asset upload by @sriramveeraghanta in #9242
• fix(web): guard unguarded data derefs causing work-item and layout crashes by @codingwolf-at in #9546
• chore: resolve dependabot security alerts (pnpm + pip) by @sriramveeraghanta in #9549

Full Changelog: v1.4.1-rc1...v1.4.1-rc2

v1.4.1-rc1

What's Changed

• fix: strip control characters from sanitized filenames by @karthiksuki in #9151
• [SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id (regression from #9288) by @mguptahub in #9495
• [GIT-243]fix: InstanceConfiguration not created for some keys by @sangeethailango in #9303
• chore: retire departed code owners (apps/live, ox configs) by @mguptahub in #9504
• [INFRA-461] chore: bump nginx to 1.31-alpine in web and admin Dockerfiles by @akshat5302 in #9490
• chore: upgrade Django 4.2 → 5.2 by @sriramveeraghanta in #9325
• fix: resolve open CodeQL security alerts by @sriramveeraghanta in #9505
• fix: resolve React Doctor errors and restore its PR baseline by @sriramveeraghanta in #9488
• [WEB-8477] fix: created_at/updated_at filters return no work items by @mguptahub in #9513
• fix: cast avatar_asset to CharField to resolve mixed type errors in URL concatenation by @Program2113 in #9512
• [WEB-8477] fix(api): filter "Updated At" by updated_at column, not created_at by @mguptahub in #9514
• [WEB-8512] feat: add workspace member reactivation command by @pablohashescobar in #9520
• docs: add Zenith Hosting deploy option by @odpay in #9529
• fix(web): trailing slash on workspace notification list API by @misterkuka in #9521
• fix(api): prevent crash from null member_ids on workspace modules endpoint (was mislabeled as feat) by @codingwolf-at in #9541
• [WEB-8510] fix(web): fix clipped/overlapping LayoutDropDown button in Create View modal by @codingwolf-at in #9542

New Contributors

• @Program2113 made their first contribution in #9512
• @odpay made their first contribution in #9529
• @misterkuka made their first contribution in #9521

Full Changelog: v1.4.0-rc1...v1.4.1-rc1

v1.4.0

✨ Features

Lite List Endpoints in the REST API

New lightweight list endpoints for projects, members, cycles, and modules return trimmed payloads built for pickers, dropdowns, and sync jobs that only need identifiers and display fields. They avoid the cost of the full list responses when you are populating a selector or mirroring structure into an external system, and they carry the same order_by sanitization and scoping guarantees as the full endpoints.

Feature-Namespaced Translations

The internationalization package now runs on react-i18next with translations stored as per-feature JSON namespaces (workspace, project, work item, cycle, intake, and more) instead of a single monolithic TypeScript file. Translators and contributors can work on one feature area at a time across all 19 supported languages, and the public translation API is unchanged, so no consumer code needed to move.

⬆️ Enhancements

• Webhook delivery payloads now include workspace_slug, so receivers can route events without an extra lookup.
• Self-hosted telemetry now reports through OTLP metrics instead of OTLP traces, giving instance operators cleaner gauges for user, project, and page counts.
• Instance logs are now stored in PostgreSQL only, with per-log-type retention so log tables no longer grow unbounded.
• Accessibility pass across the God Mode admin app: labels on icon-only buttons, clearer link descriptions, corrected tab order, and keyboard-reachable dismiss controls.
• Nginx now reads the correct X-Forwarded-For header, so rate limiting and request logs see the real client IP instead of the proxy's.
• Bot user emails are derived from your configured web URL instead of a hardcoded domain.

🐞 Bug fixes

• Fixed soft-deleted states reappearing in the UI after navigation, and work items linked to deleted states surfacing through the API.
• Fixed project creation assigning the project lead incorrectly, which could leave the lead off the project member list.
• Fixed work items created or updated through the REST API sending no notifications or emails.
• Fixed the completed_at timestamp on work items being recalculated incorrectly; it is now a read-only field.
• Fixed the comment quick-actions menu rendering as an empty popover when no actions were available.
• Removed profile preference changes from the work item activity feed, where they did not belong.
• Fixed sidebar pin/unpin state leaking between users in the same workspace, or silently failing to persist.
• Fixed API error responses returning a server error instead of the intended error payload.
• Fixed the project identifier field showing no message when the value contained unsupported characters.
• Workspace and company names now require at least one letter or digit, enforced in both the UI and the API, so symbol-only names are rejected.
• Fixed the work item more-options dropdown rendering without a visible border or shadow.
• Fixed low contrast on the onboarding tour close button.
• Fixed stale user data being mutated in place after a profile update, and cover image changes returning relative URLs.
• Fixed Safari and iOS crashes caused by the missing requestIdleCallback API; a fallback scheduler now handles idle work.
• Fixed the all-in-one Docker image failing to start on Docker Engine 29.5 and later due to a malformed VOLUME declaration.
• Fixed web, admin, and space Docker builds failing at the PostCSS step with a missing Tailwind plugin.

🛡️ Security

This release closes a large batch of coordinated security advisories. Self-hosted instances should upgrade.

Access control and tenant isolation

• Scoped cross-workspace resource lookups on project updates, bulk estimate points, and workspace user profiles to close an IDOR for project member role updates, which previously evaluated the target member's role rather than the requester's).
• Scoped bulk work item operations — cascade deletes, cycle and module assignment, sub-issue and relation creation — to the caller's workspace and project.
• Scoped estimate point creation and deletion to the caller's workspace and project.
• Enforced workspace membership on the public REST API asset endpoint and the entity-search endpoint, which previously let any authenticated user reach another workspace's assets or enumerate its members .
• Scoped asset reads and writes to project membership across file assets, issue attachments, and workspace assets.
• Scoped workspace-level cycle and module listings to projects the caller belongs to, so private project metadata is no longer enumerable.
• Scoped page version reads to the project in the request URL.
• Fixed the read-only branch of the project member permission check ignoring the project, which exposed project rosters and publish configuration to non-members.
• Applied the guest visibility restriction to the work item list-by-ID endpoint, which let guests read work items they did not author.
• Required project admin rights to activate or deactivate a project member; a guest could previously deactivate any member, including admins.
• Validated project IDs against the caller's workspace when bulk-adding project members.

Authentication and invitations

• Blocked sign-in for deactivated accounts, which were previously reactivated silently on every login, and corrected the workspace owner permission check.
• Blocked interactive logins for bot service accounts across every provider; bots remain usable through API tokens only.
• Rejected API key authentication for deactivated accounts, which could otherwise keep using previously issued tokens indefinitely.
• Rejected unverified OAuth provider emails on GitHub, Google, GitLab, and Gitea, closing an account takeover path via attacker-controlled self-hosted providers.
• Rate-limited magic-code verification and bounded per-token attempts, which previously allowed brute-forcing the six-digit code within its TTL.
• Removed the workspace invitation token from the unauthenticated invite endpoint and required the invited user to be signed in with the matching email before accepting.
• Stopped the public project invite endpoint from disclosing the invitee's email and token, and required a valid token plus authentication to accept or reject a project invite.
• Eliminated a race condition in instance admin signup that could create two instance admins.

Injection and content safety

• Sanitized comment and intake description HTML with nh3 on both the app and API layers, closing stored XSS.
• Forced script-capable uploads such as SVG to download rather than render inline, closing stored XSS via attachments.
• Normalized link hrefs in the editor before the protocol check, so whitespace-prefixed javascript: URLs can no longer slip through .
• Added allowlists for order_by, group_by, and sub_group_by query parameters across work item, project, view, activity, and notification endpoints — including the unauthenticated public board — closing an ordering oracle over sensitive columns and unhandled 500s.
• Sanitized XLSX export cells so user-supplied values beginning with = are no longer written as live formulas, matching the existing CSV protection.
• Hardened SSRF protection for webhook delivery, work item link unfurling, and OAuth avatar fetching: redirects are no longer followed, and the IP guard now blocks multicast, unspecified, CGNAT, and IPv4-in-IPv6 addresses.
• Bound workflow inputs to environment variables in the feature deployment GitHub Action, removing a shell injection path.

Secrets and deployment

• Removed the publicly known default SECRET_KEY and LIVE_SERVER_SECRET_KEY from the all-in-one and CLI deployment manifests; a random key is now generated on first boot and persisted across restarts, including on upgrade from the old default.
• Made the API token rate limit read-only so users can no longer raise their own limit, and stopped persisting API keys in plaintext — tokens are now stored as SHA-256 hashes and sensitive request headers are redacted before logging.
• Rebuilt the published Docker images against patched base packages to clear outstanding image scan findings.

v1.4.0-rc2

What's Changed

• fix: strip control characters from sanitized filenames by @karthiksuki in #9151
• [SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id (regression from #9288) by @mguptahub in #9495
• v1.4.0-fixes by @mguptahub in #9496

Full Changelog: v1.4.0-rc1...v1.4.0-rc2

v1.4.0-rc1

What's Changed

• release: v1.2.1 by @sriramveeraghanta in #8322
• release: v1.2.2 by @sriramveeraghanta in #8645
• release: v1.2.3 by @sriramveeraghanta in #8717
• [WIKI-874] refactor: description input component by @aaryan610 in #8544
• chore(deps): bump python-json-logger from 3.3.0 to 4.0.0 in /apps/api by @dependabot[bot] in #8692
• chore(deps): bump pytest from 7.4.0 to 9.0.2 in /apps/api by @dependabot[bot] in #8693
• [WEB-6599] feat: instance not ready ui revamp by @anmolsinghbhatia in #8755
• [WEB-6610] Fix work item drag handle hover gap by @iam-vipin in #8759
• chore(deps): bump the actions group across 1 directory with 11 updates by @dependabot[bot] in #8741
• fix: added workspace member check in allow permission for creator by @NarayanBavisetti in #8778
• fix: unused imports by @sriramveeraghanta in #8795
• chore: remove service token endpoint which is unused by @sriramveeraghanta in #8797
• fix: add missing model_activity.delay() for API-driven issue webhooks by @ouchanip in #8792
• [WEB-6702] feat: redesign intake action buttons and use design tokens by @anmolsinghbhatia in #8801
• [WEB-6739] fix: color inside of active projects of analytics overview tab by @b-saikrishnakanth in #8803
• [WEB-6734] fix: circular progress indicator stroke color by @b-saikrishnakanth in #8802
• fix: migrate page navigation pane tabs from Headless UI to Propel by @Palanikannan1437 in #8805
• chore(deps): bump requests from 2.32.4 to 2.33.0 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8804
• fix: tsdown watch by @lifeiscontent in #8813
• [WEB-6762] fix: missing profile icons for recent activities on "Your Work" Page by @b-saikrishnakanth in #8812
• [WEB-6763] fix: date range dropdown clipped in sub-issues list by @b-saikrishnakanth in #8809
• [WEB-6783] fix: crash when deleting work item from peek view in workspace spreadsheet by @anmolsinghbhatia in #8821
• chore(deps): bump cryptography from 46.0.5 to 46.0.6 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8819
• [SILO-1087] feat: add IssueRelations external API by @Saurabhkmr98 in #8763
• [SILO-1026] feat: add estimates external API endpoints by @Saurabhkmr98 in #8664
• [WEB-6794] fix: align profile cover update with correct unsplash and upload handling by @anmolsinghbhatia in #8830
• chore(deps): update dependency overrides by @sriramveeraghanta in #8831
• chore(deps): replace dotenvx with dotenv and update overrides by @sriramveeraghanta in #8832
• fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) by @sriramveeraghanta in #8834
• [INFRA-346] chore: remove artifacts.plane.so references from community deployments by @akshat5302 in #8836
• [INFRA-351] fix: correct directory and command for space program in supervisor.conf by @akshat5302 in #8838
• [WEB-6813] fix: module not associated when accepting intake work items by @anmolsinghbhatia in #8839
• fix: prevent privilege escalation in project member role updates by @sriramveeraghanta in #8833
• fix: validate redirects in favicon fetching to prevent SSRF by @sriramveeraghanta in #8858
• chore: upgrade turbo from v2.8.12 to v2.9.4 by @sriramveeraghanta in #8859
• chore(deps): bump vite from 7.3.1 to 7.3.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #8863
• fix: update Twitter icon and links to X by @nielskaspers in #8790
• fix: prevent ORM field injection via segment parameter in analytics (GHSA-93x3-ghh7-72j3) by @sriramveeraghanta in #8864
• fix: strip whitespace from instance configuration values by @okxint in #8744
• [WEB-6784] feat scrollbar in shortcuts modal by @b-saikrishnakanth in #8872
• [WEB-6785] fix: update border for project timezone by @b-saikrishnakanth in #8870
• chore: remove Intercom integration and chat support components by @sriramveeraghanta in #8875
• chore: update dependencies (Django, cryptography, axios, lodash) by @sriramveeraghanta in #8880
• [WEB-6840] feat: skip role & use-case steps for self-hosted instances by @anmolsinghbhatia in #8890
• chore(deps): bump pytest from 9.0.2 to 9.0.3 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8891
• enhance sub-issue query performance with optimized annotations and subqueries (2.6s -> 0.07s) by @PhuongPN6689 in #8889
• fix: enforce workspace membership on V2 asset endpoints by @sriramveeraghanta in #8885
• fix: replace IS_SELF_MANAGED with WEBHOOK_ALLOWED_IPS allowlist by @sriramveeraghanta in #8884
• [SILO-1158] chore: add context for project in relations API by @Saurabhkmr98 in #8860
• fix: sanitize filenames in upload paths to prevent path traversal by @sriramveeraghanta in #8879
• chore(ci): suppress CodeQL file coverage deprecation warning by @sriramveeraghanta in #8916
• chore: update CODEOWNERS for apps and deployments by @sriramveeraghanta in #8919
• chore: add Claude Code skills for PR descriptions and release notes by @sriramveeraghanta in #8920
• chore(deps): bump lxml from 6.0.0 to 6.1.0 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8925
• chore(deps): bump axios, uuid and add security overrides by @sriramveeraghanta in #8930
• chore(deps): bump postcss from 8.5.6 to 8.5.10 in /packages/tailwind-config in the npm_and_yarn group across 1 directory by @dependabot[bot] in #8931
• fix: filter out soft-deleted states from API endpoints by @KanteshMurade in #8840
• chore(deps): remove unused pnpm overrides by @sriramveeraghanta in #8973
• fix(api): scope cross-workspace resource lookups to prevent IDOR by @sriramveeraghanta in #9008
• fix(nginx): correct real_ip_header typo X-Forward-For → X-Forwarded-For by @MinitJain in #8935
• fix(api): use requester's workspace role in project member role updates (GHSA-x63v-p7wc-47x4) by @sriramveeraghanta in #9014
• [GIT-175] fix: completed_at updation logic for work items by @sangeethailango in #9044
• fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets by @sriramveeraghanta in #9078
• fix: pnpm path for Docker builds by @sriramveeraghanta in #9079
• refactor(i18n): migrate packages/i18n from MobX to react-i18next by @sriramveeraghanta in #8898
• fix(api): pass project_lead_id (not User instance) when creating ProjectMember by @jamartineztelecoengineer84-dotcom in #8966
• [WEB-7181] fix: empty comment quick-actions menu in work item activity by @b-saikrishnakanth in #9024
• [WEB-7182] fix: remove profile preferences activity by @b-saikrishnakanth in #9025
• fix(aio): use JSON array double quotes in VOLUME instruction by @astarte75 in #9099
• fix(web): add requestIdleCallback fallback for Safari/iOS by @bubacho in #9094
• [GIT-174]chore: set completed_at as read only field for work item by @sangeethailango in #9083
• Add docker pytest runner; fix bugs the suite surfaced by @sriramveeraghanta in #9138
• chore: fix security vulnerabilities by @pratapalakshmi in #9140
• chore: restructure .claude/skills into per-skill directories by @sriramveeraghanta in #9146
• refactor: logging with retention + API token hardening by @sriramveeraghanta in https://github.com/mak...

v1.3.1

✨ Improvements

• Scrollbar in keyboard shortcuts modal
• Skip role & use-case steps for self-hosted instances

🐛 Bug Fixes

• Prevent ORM field injection via analytics segment parameter —
  Security fix (GHSA-93x3-ghh7-72j3). Centralizes analytics field allowlists into VALID_ANALYTICS_FIELDS / VALID_YAXIS and adds defense-in-depth validation in build_graph_plot() and extract_axis() so no caller can pass arbitrary field references to Django F() expressions. Also adds missing segment validation to SavedAnalyticEndpoint.
• Enforce workspace membership on V2 asset endpoints —
  Security fix (GHSA-qw87-v5w3-6vxx). Adds @allow_permission to all WorkspaceFileAssetEndpoint methods and scopes DuplicateAssetEndpoint's source asset lookup to workspaces where the caller is an active member.
• Sanitize filenames in upload paths to prevent path traversal —
  Security fix (GHSA-v57h-5999-w7xp). Server-side filename sanitization across all file upload endpoints; defense-in-depth against S3 key pollution. Handles Windows-style paths and leading-dot/whitespace edge cases.
• Replace IS_SELF_MANAGED toggle with WEBHOOK_ALLOWED_IPS allowlist —
  Webhook SSRF protection: blocks all private/internal IPs by default; only specific networks listed in WEBHOOK_ALLOWED_IPS (comma-separated IPs/CIDRs) are permitted. Re-validates URL at send time to prevent DNS rebinding, sanitizes error messages, and guards mixed IPv4/IPv6 allowlists.
• Strip whitespace and handle null values in instance configuration —
  Sanitizes patched instance config values: trims leading/trailing whitespace and converts null to "" instead of the literal string "None".
• Update border for project timezone — [WEB-6785]
• Update Twitter icon and links to X —
• Optimize sub-issue query performance —
  Adds optimized annotations and subqueries to the sub-issue listing path.

🔧 Refactor & Chore

• Remove Intercom integration and chat support components
  Intercom is no longer used. Removes all related frontend components, hooks, custom events, API config, types, and i18n keys.
• Add project context to relations API
• Suppress CodeQL file coverage deprecation warning
  Explicitly opts into the new default behavior where CodeQL skips computing file coverage on PRs for improved analysis performance.
• Update CODEOWNERS for apps and deployments
• Add Claude Code skills for PR descriptions and release notes

📦 Dependencies

• Bump axios 1.15.0 → 1.15.2, uuid 13.0.0 → 14.0.0; add pnpm overrides pinning postcss >=8.5.10 and follow-redirects >=1.16.0
• Bump Django 4.2.29 → 4.2.30, cryptography 46.0.6 → 46.0.7, axios 1.13.5 → 1.15.0, lodash 4.17.23 → 4.18.1
• Bump vite 7.3.1 → 7.3.2
• Bump pytest 9.0.2 → 9.0.3
• Bump lxml 6.0.0 → 6.1.0

v1.3.0

A cleaner, calmer Plane

We sharpened the visual foundation of Plane so your workspace feels more composed and intentional. Spacing is tuned to guide the eye, colors work harder to signal meaning, and themes feel cohesive from one view to the next. The result is a product that reads clearly, responds predictably, and makes it easier to stay in flow as your work scales.

🎉 Improvements

• Added support for Gitea Authentication.
• Enhanced CustomSelect with better dropdown context handling.
• Enhanced authentication logging with more detailed error reporting.
• Added Project Summary external API support.
• Added debounce support for mention search.
• Improved UI for workspace settings layout and members page.
• Enhanced workspace members settings UI/UX.
• Improved work item detail, list layout, sidebar, and comment UI.
• Updated work item detail properties UI.
• Added timezone selection to workspace settings, project timezon will default to workspace timezone during creation.
• Revamped the instance-not-ready UI screen.
• Updated email templates with a cleaner design.
• Enhanced component styling, design tokens, primitive tokens, headers, and breadcrumbs.
• Updated chart styling and class names to align with the design system.
• Improved theme switcher and editor color handling.
• Enhanced sidebar project list behavior.
• Prevented disabling the last enabled authentication method in god-mode.
• Added file validation to prevent malicious uploads.
• Enhanced layout loaders for smoother experience.
• Improved dropdown option hierarchy - selected will show on the top.
• Added intake count on the left nav bar in projects section.
• Added validation for project name and identifier ti disallow executable special characters.
• Added support for uploading Markdown files in attachments.
• Added language support for Ukrainian.
• Expanded Russian translation coverage.
• Added support for webhook translations .
• Updated page version save logic.

🐞 Bug Fixes

• Fixed placeholder visibility to show only on empty editor states.
• Fixed copy-to-clipboard behavior in the editor.
• Fixed left navbar item pin/unpin behavior.
• Fixed duplicate sequence generation when creating multiple work items.
• Fixed custom select selection and dropdown close behavior.
• Fixed empty state handling for deleted work item links.
• Fixed editor image fullscreen modal behavior.
• Fixed mention search on empty query.
• Fixed board layout group-by icon issues.
• Fixed logo spinner hydration and theme loading issues.
• Fixed estimate value display in analytics.
• Fixed loading state handling while fetching project cover images.
• Fixed work item peek view outside-click handling.
• Fixed CSV injection vulnerability sanitization.
• Fixed serializer updates for the module detail API endpoint.
• Fixed intake open work count.
• Fixed persistence of external cover image URLs.
• Fixed email templates for plain-text email clients.
• Fixed work item preview word-break issues.
• Fixed description input component re-render issues.

🔒 Security

• Fixed arbitrary modification of API token rate limits
• Fixed SSRF webhook URL validation for IP addresses
• Added X-Frame-Options header to Nginx configuration
• Scoped IssueBulkUpdateDateEndpoint query to workspace and project

v1.2.3

🛡️ Security

• Added validation while saving webhooks with reserver IP addresses

v1.2.2

Security patch

• Fixed arbitrary modification of API token rate limits by enforcing server-side validation and authorization checks.
• Mitigated SSRF vulnerability in work item link handling through strict URL validation and outbound request controls.
• Fixed member information disclosure via publicly accessible endpoint by applying proper access control checks.
• Resolved IDOR vulnerabilities in asset and attachment endpoints to prevent unauthorized resource access.
• Upgraded Django to 4.2.28
• Upgraded the cryptography to 46.0.5

v1.2.1

🛡️ Security

• Removed underlying NextJS dependencies.