🐞 Bug fixes Fixed voting on published work items that had no votes yet, which previously failed without registering the vote. Fixed archiving a cycle that has no end date. Fixed work item links being re-crawled on every update even when the URL had not changed. The REST API now returns a validation error when a work item is created or updated with assignees or labels that do not belong to the proj…
What's Changed [INFRA-1089] chore(deps): switch MinIO image to pgsty/silo (v1.4.3) by @sriramveeraghanta in #9963 [SECUR-247] fix(security): require project membership to publish (v1.4.3) by @sriramveeraghanta in #10034 Full Changelog: v1.4.3-rc1...v1.4.3-rc2
Full Changelog: v1.4.2...v1.4.3-rc1
What's Changed [WEB-8632] fix(web): auto-reload on stale chunk load failure during navigation
What's Changed [WEB-8632] fix(web): auto-reload on stale chunk load failure during navigation by @codingwolf-at in #9579 Full Changelog: v1.4.1-rc2...v1.4.2-rc1
✨ Features Workspace Member Reactivation Command Self-hosted administrators can now restore a deactivated workspace member straight from the command line, without editing the database by hand. Running reactivate_workspace_member <workspace-slug> <email> re-enables the membership and reports the role the member is restored to. Validates the workspace, the user, and the existing membership before ch…
What's Changed fix: enforce FILE_SIZE_LIMIT on published Space asset upload by @sriramveeraghanta in #9242 fix(web): guard unguarded data derefs causing work-item and layout crashes by @codingwolf-at in #9546 chore: resolve dependabot security alerts (pnpm + pip) by @sriramveeraghanta in #9549 Full Changelog: v1.4.1-rc1...v1.4.1-rc2
What's Changed fix: strip control characters from sanitized filenames by @karthiksuki in #9151 [SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id (regression from #9288) by @mguptahub in #9495 [GIT-243]fix: InstanceConfiguration not created for some keys by @sangeethailango in #9303 chore: retire departed code owners (apps/live, ox configs) by @mguptahub in #9504 [INFRA-4…
✨ Features Lite List Endpoints in the REST API New lightweight list endpoints for projects, members, cycles, and modules return trimmed payloads built for pickers, dropdowns, and sync jobs that only need identifiers and display fields. They avoid the cost of the full list responses when you are populating a selector or mirroring structure into an external system, and they carry the same order_by s…
What's Changed fix: strip control characters from sanitized filenames by @karthiksuki in #9151 [SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id (regression from #9288) by @mguptahub in #9495 v1.4.0-fixes by @mguptahub in #9496 Full Changelog: v1.4.0-rc1...v1.4.0-rc2
What's Changed release: v1.2.1 by @sriramveeraghanta in #8322 release: v1.2.2 by @sriramveeraghanta in #8645 release: v1.2.3 by @sriramveeraghanta in #8717 [WIKI-874] refactor: description input component by @aaryan610 in #8544 chore(deps): bump python-json-logger from 3.3.0 to 4.0.0 in /apps/api by @dependabot[bot] in #8692 chore(deps): bump pytest from 7.4.0 to 9.0.2 in /apps/api by @dependabot[…
✨ Improvements Scrollbar in keyboard shortcuts modal Skip role & use-case steps for self-hosted instances 🐛 Bug Fixes Prevent ORM field injection via analytics segment parameter — Security fix (GHSA-93x3-ghh7-72j3). Centralizes analytics field allowlists into VALID_ANALYTICS_FIELDS / VALID_YAXIS and adds defense-in-depth validation in build_graph_plot() and extract_axis() so no caller can pass arb…
A cleaner, calmer Plane We sharpened the visual foundation of Plane so your workspace feels more composed and intentional. Spacing is tuned to guide the eye, colors work harder to signal meaning, and themes feel cohesive from one view to the next. The result is a product that reads clearly, responds predictably, and makes it easier to stay in flow as your work scales. 🎉 Improvements Added support…
🛡️ Security Added validation while saving webhooks with reserver IP addresses
Security patch Fixed arbitrary modification of API token rate limits by enforcing server-side validation and authorization checks. Mitigated SSRF vulnerability in work item link handling through strict URL validation and outbound request controls. Fixed member information disclosure via publicly accessible endpoint by applying proper access control checks. Resolved IDOR vulnerabilities in asset an…
🛡️ Security Removed underlying NextJS dependencies.
✨ Features Next.js to React Router + Vite Migration React Router + Vite now power all Plane web applications, replacing Next.js. The new stack brings faster hot reloads, clearer internals, and a consistent tooling workflow across builds and tests. Here is a blog post about the same. Introducing a new way to navigate across your workspace You'll now find a new navigation bar at the top of your Plan…
New features Filtering got richer. You could always filter in Plane—now those filters are richer and work everywhere. They let you instantly narrow down what you see—whether it’s work items, epics, or custom views—by assignee, priority, dates, labels, and more. Filters cut through that overload so every role—PM, engineer, designer—can focus on what’s important right now. That means quicker decisio…
The most awaited release is here, Introducing Plane CE v1.0.0. What does this mean? GA? Yes. Plane CE v1.0.0 is now more stable, secure, reliable and performant. This release also brings us our new branding on all your instances, marking the start of a new chapter for plane. Enhancements Added Turkish language support Improved HTML checks in editors for better security Moved Your Work to a fixed s…
⚠️ IMPORTANT When upgrading to Community Edition v0.28.0: For Kubernetes deployments, use Helm chart v1.2.0 For Docker deployments, ensure you're using the latest version of Docker Compose File. 🔗 Copy comment URLs Share specific parts of conversations with direct comment links. Click the three dots on any comment and select Copy link making it easy to reference important discussions. 📐 Collapsibl…
Bug fixes Resolved URL path generation issue causing double slashes in settings page links. Fixed UI misalignment in the top navigation bar of Work Item layouts. Fixed minor translation issues in Workspace Analytics. Fixed bug preventing event trigger for Work Item comments submitted via external APIs.