release: v1.3.1 by sriramveeraghanta · Pull Request #8917 · makeplane/plane

sriramveeraghanta · 2026-04-20T10:10:27Z

✨ Improvements

Scrollbar in keyboard shortcuts modal
Skip role & use-case steps for self-hosted instances

🐛 Bug Fixes

Prevent ORM field injection via analytics segment parameter —
Security fix (GHSA-93x3-ghh7-72j3). Centralizes analytics field allowlists into VALID_ANALYTICS_FIELDS / VALID_YAXIS and adds defense-in-depth validation in build_graph_plot() and extract_axis() so no caller can pass arbitrary field references to Django F() expressions. Also adds missing segment validation to SavedAnalyticEndpoint.
Enforce workspace membership on V2 asset endpoints —
Security fix (GHSA-qw87-v5w3-6vxx). Adds @allow_permission to all WorkspaceFileAssetEndpoint methods and scopes DuplicateAssetEndpoint's source asset lookup to workspaces where the caller is an active member.
Sanitize filenames in upload paths to prevent path traversal —
Security fix (GHSA-v57h-5999-w7xp). Server-side filename sanitization across all file upload endpoints; defense-in-depth against S3 key pollution. Handles Windows-style paths and leading-dot/whitespace edge cases.
Replace IS_SELF_MANAGED toggle with WEBHOOK_ALLOWED_IPS allowlist —
Webhook SSRF protection: blocks all private/internal IPs by default; only specific networks listed in WEBHOOK_ALLOWED_IPS (comma-separated IPs/CIDRs) are permitted. Re-validates URL at send time to prevent DNS rebinding, sanitizes error messages, and guards mixed IPv4/IPv6 allowlists.
Strip whitespace and handle null values in instance configuration —
Sanitizes patched instance config values: trims leading/trailing whitespace and converts null to "" instead of the literal string "None".
Update border for project timezone — [WEB-6785]
Update Twitter icon and links to X —
Optimize sub-issue query performance —
Adds optimized annotations and subqueries to the sub-issue listing path.

🔧 Refactor & Chore

Remove Intercom integration and chat support components
Intercom is no longer used. Removes all related frontend components, hooks, custom events, API config, types, and i18n keys.
Add project context to relations API
Suppress CodeQL file coverage deprecation warning
Explicitly opts into the new default behavior where CodeQL skips computing file coverage on PRs for improved analysis performance.
Update CODEOWNERS for apps and deployments
Add Claude Code skills for PR descriptions and release notes

📦 Dependencies

Bump axios 1.15.0 → 1.15.2, uuid 13.0.0 → 14.0.0; add pnpm overrides pinning postcss >=8.5.10 and follow-redirects >=1.16.0
Bump Django 4.2.29 → 4.2.30, cryptography 46.0.6 → 46.0.7, axios 1.13.5 → 1.15.0, lodash 4.17.23 → 4.18.1
Bump vite 7.3.1 → 7.3.2
Bump pytest 9.0.2 → 9.0.3
Bump lxml 6.0.0 → 6.1.0

…8863) Bumps the npm_and_yarn group with 1 update in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `vite` from 7.3.1 to 7.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 7.3.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…GHSA-93x3-ghh7-72j3) (#8864) * fix: prevent ORM field injection via segment parameter in analytics (GHSA-93x3-ghh7-72j3) Centralize analytics field allowlists into VALID_ANALYTICS_FIELDS and VALID_YAXIS constants in analytics_plot.py. Add defense-in-depth validation in build_graph_plot() and extract_axis() so no caller can pass arbitrary field references to Django F() expressions. Add missing segment validation to SavedAnalyticEndpoint. Also fixes ExportAnalytics using "estimate_point" instead of "estimate_point__value". * fix: address PR review - remove unused imports and validate stored query params Remove unused VALID_ANALYTICS_FIELDS and VALID_YAXIS imports from analytic_plot_export.py. Add x_axis/y_axis allowlist validation in SavedAnalyticEndpoint for stored query_dict values to prevent 500 errors from malformed saved analytics.

#8744) When patching instance configuration values, the raw values from request.data were used directly without sanitization. This adds: - Whitespace stripping via str().strip() to prevent leading/trailing spaces from being stored - Explicit None handling so that null values become empty strings instead of the literal string "None"

* fix: update border for project timezone * feat: added scrollbar in keyboard shortcuts modal * fix: remove unnecessary changes * fix: remove redundant overflow

Intercom is no longer used. This removes all related frontend components, hooks, custom events, API config, types, and i18n keys.

* chore: update dependencies (Django, cryptography, axios, lodash) - Django 4.2.29 → 4.2.30 - cryptography 46.0.6 → 46.0.7 - axios 1.13.5 → 1.15.0 - lodash 4.17.23 → 4.18.0 * chore: update lodash from 4.18.0 to 4.18.1

…#8890)

Bumps the pip group with 1 update in the /apps/api/requirements directory: [pytest](https://github.com/pytest-dev/pytest). Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…bqueries (#8889)

WorkspaceFileAssetEndpoint had no authorization checks beyond authentication, allowing any logged-in user to create, read, patch, and delete assets in any workspace by slug. DuplicateAssetEndpoint only authorized the destination workspace, letting users copy assets from workspaces they don't belong to. Add @allow_permission decorators to all WorkspaceFileAssetEndpoint methods and scope DuplicateAssetEndpoint's source asset lookup to workspaces where the caller is an active member. Ref: GHSA-qw87-v5w3-6vxx

* fix: replace IS_SELF_MANAGED toggle with explicit WEBHOOK_ALLOWED_IPS allowlist Instead of blanket-allowing all private IPs on self-managed deployments, webhook URL validation now blocks all private/internal IPs by default and only permits specific networks listed in the WEBHOOK_ALLOWED_IPS env variable (comma-separated IPs/CIDRs). * fix: address PR review comments for webhook SSRF protection - Sanitize error messages to avoid leaking internal details to clients - Guard against TypeError with mixed IPv4/IPv6 allowlist networks - Re-validate webhook URL at send time to prevent DNS-rebinding - Add unit tests for mixed-version IP network allowlists

* add context for project in relations API * modify issue relation serializer

) * fix: sanitize filenames in upload paths to prevent path traversal (GHSA-v57h-5999-w7xp) Add server-side filename sanitization across all file upload endpoints to prevent path traversal sequences (../) in user-supplied filenames from being incorporated into S3 object keys. While S3 keys are flat strings and not vulnerable to filesystem traversal, this adds defense-in-depth and prevents S3 key pollution. Changes: - Add sanitize_filename() utility in path_validator.py - Sanitize filenames in get_upload_path() for FileAsset and IssueAttachment models - Sanitize name parameter in all upload view endpoints * fix: address PR review feedback on filename sanitization - Remove unused `import re` - Normalize backslashes to forward slashes before os.path.basename() so Windows-style paths (e.g. ..\..\..\evil.txt) are handled on POSIX - Strip whitespace before removing leading dots so " .env" is caught - Return None instead of "unnamed" for empty input so existing `if not name` validation guards remain effective - Add `or "unnamed"` fallback at call sites that lack a name guard * fix: use random hex name as fallback in get_upload_path instead of "unnamed" * fix: resolve ruff E501 line too long in DuplicateAssetEndpoint

* chore(ci): suppress CodeQL file coverage deprecation warning Explicitly opt into the new default behavior where CodeQL skips computing file coverage information on pull requests for improved analysis performance. * Update .github/workflows/codeql.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

coderabbitai · 2026-04-20T10:10:35Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a162fc14-c074-4500-b7cb-0174a623d663

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch canary

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Release v1.3.1 updates dependencies, removes Intercom/chat-support UI/configuration, and tightens backend security around uploads/webhooks and analytics parameter validation.

Changes:

Bump key dependencies (axios, vite, lodash, Django, cryptography, pytest) and regenerate pnpm lockfile.
Remove Intercom/chat support feature surface (types, admin config UI, web sidebar/power-k entries, i18n strings).
Add/expand backend hardening: filename sanitization for asset keys, webhook SSRF protection with optional allowlist, and stricter analytics axis validation.

Reviewed changes

Copilot reviewed 63 out of 64 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Bumps workspace catalog versions for axios and vite.
pnpm-lock.yaml	Updates lockfile for bumped dependencies (axios/vite/lodash and transitive deps).
package.json	Updates lodash override to 4.18.1.
packages/types/src/instance/base.ts	Removes Intercom-related instance config fields/types.
packages/i18n/src/locales/en/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/de/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/es/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/fr/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/id/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/it/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/ja/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/ko/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/pl/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/pt-BR/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/ro/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/ru/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/sk/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/tr-TR/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/ua/translations.ts	Removes chat/support-related translation keys (incl. “chat_with_us”).
packages/i18n/src/locales/vi-VN/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/zh-CN/translations.ts	Removes chat/support-related translation keys.
packages/i18n/src/locales/zh-TW/translations.ts	Removes chat/support-related translation keys.
apps/web/core/hooks/use-chat-support.ts	Deletes chat support hook (Intercom trigger).
apps/web/core/custom-events/chat-support.ts	Deletes chat support custom event definitions.
apps/web/core/components/workspace/sidebar/help-section/root.tsx	Removes “message support” menu item and icon import.
apps/web/core/components/power-k/config/help-commands.ts	Removes “chat with us” Power-K command.
apps/web/core/components/project/form.tsx	Tweaks timezone dropdown button styling.
apps/web/core/components/power-k/ui/renderer/shortcut.tsx	Removes internal overflow scrolling (delegated to ScrollArea).
apps/web/core/components/power-k/ui/modal/shortcuts-root.tsx	Wraps shortcuts list with ScrollArea and adjusts layout/padding.
apps/web/core/components/onboarding/root.tsx	Skips role/use-case onboarding steps for self-managed instances.
apps/web/core/components/onboarding/header.tsx	Adjusts back-navigation + progress steps for self-managed mode.
apps/admin/app/(all)/(dashboard)/general/intercom.tsx	Removes Intercom configuration UI from admin.
apps/admin/app/(all)/(dashboard)/general/form.tsx	Removes Intercom section and related config update behavior.
apps/api/templates/emails/user/user_deactivation.html	Updates Twitter link to x.com.
apps/api/templates/emails/user/user_activation.html	Updates Twitter link to x.com.
apps/api/templates/emails/user/email_updated.html	Updates Twitter link to x.com.
apps/api/templates/emails/notifications/webhook-deactivate.html	Updates Twitter link to x.com in body + footer icon link.
apps/api/templates/emails/notifications/issue-updates.html	Updates Twitter link to x.com in footer icons.
apps/api/templates/emails/invitations/project_invitation.html	Updates Twitter link to x.com in footer icon.
apps/api/requirements/base.txt	Bumps Django and cryptography patch versions.
apps/api/requirements/test.txt	Bumps pytest patch version.
apps/api/plane/utils/path_validator.py	Adds `sanitize_filename` helper for path traversal mitigation.
apps/api/plane/utils/ip_address.py	Adds `validate_url` SSRF guard (DNS resolution + allowlist support).
apps/api/plane/settings/common.py	Adds `WEBHOOK_ALLOWED_IPS` parsing from env for SSRF allowlisting.
apps/api/plane/bgtasks/webhook_task.py	Re-validates webhook URL at send time (DNS rebinding mitigation).
apps/api/plane/app/serializers/webhook.py	Refactors webhook URL SSRF/domain validation using `validate_url`.
apps/api/plane/utils/instance_config_variables/core.py	Removes Intercom config variables from instance config set.
apps/api/plane/license/api/views/instance.py	Removes Intercom fields from instance config response.
apps/api/plane/utils/analytics_plot.py	Centralizes allowed analytics fields and validates x/y/segment values.
apps/api/plane/app/views/analytic/base.py	Reuses centralized analytics validation constants.
apps/api/plane/tests/unit/bg_tasks/test_work_item_link_task.py	Adds unit tests for SSRF allowlist behavior.
apps/api/plane/space/views/asset.py	Sanitizes asset “name” when generating storage keys.
apps/api/plane/app/views/issue/attachment.py	Sanitizes attachment “name” when generating storage keys.
apps/api/plane/api/views/asset.py	Sanitizes asset “name” for presigned upload endpoints.
apps/api/plane/db/models/issue.py	Sanitizes upload filenames for issue uploads.
apps/api/plane/db/models/asset.py	Sanitizes upload filenames for generic assets.
apps/api/plane/app/views/asset/v2.py	Sanitizes asset names; adds workspace-level permission decorators; scopes duplication source asset by workspace membership.
apps/api/plane/api/views/issue.py	Sanitizes attachment names; changes work-item relations response to include project_id + issue_id pairs.
apps/api/plane/api/serializers/issue.py	Updates relations response serializer to `{project_id, issue_id}` objects.
apps/api/plane/license/api/views/configuration.py	Normalizes config PATCH values (string coercion + strip).
apps/api/plane/app/views/issue/sub_issue.py	Refactors sub-issue annotations; ensures counts default to 0 and IDs aggregated via subqueries.
README.md	Updates Twitter link label/URL to X.
.github/workflows/codeql.yml	Disables CodeQL file coverage on PRs via env var.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

* chore: update CODEOWNERS for apps and deployments Assign owners per app/area so reviews are routed to the right maintainers. * chore: update the codeowners

…8920) * chore: add Claude Code skills for PR descriptions and release notes * chore(skills): update release-notes branches to canary->master and example version to v1.3.0 * chore(skills): address PR review comments - pr-description: infer base branch from PR metadata, fix Improvement wording, reference template's screenshot placeholder verbatim - release-notes: add `text` language to unlabeled fenced code block

Bumps the pip group with 1 update in the /apps/api/requirements directory: [lxml](https://github.com/lxml/lxml). Updates `lxml` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.0.0...lxml-6.1.0) --- updated-dependencies: - dependency-name: lxml dependency-version: 6.1.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump axios, uuid and add security overrides Bump axios 1.15.0 → 1.15.2 and uuid 13.0.0 → 14.0.0 in the catalog, and add pnpm overrides pinning postcss >=8.5.10, follow-redirects >=1.16.0, and routing axios/uuid through the catalog. * fix: overrides

makeplane · 2026-04-25T12:33:32Z

Linked to Plane Work Item(s)

[WEB-6785] No Border Lines / Box for Timezone Selection in Project Settings

This comment was auto-generated by Plane

dependabot Bot and others added 16 commits April 7, 2026 13:18

fix: update Twitter icon and links to X (#8785) (#8790)

7c2fc2d

[WEB-6784] feat scrollbar in shortcuts modal (#8872)

6023e8c

* fix: update border for project timezone * feat: added scrollbar in keyboard shortcuts modal * fix: remove unnecessary changes * fix: remove redundant overflow

[WEB-6785] fix: update border for project timezone (#8870)

e6b9d4c

chore: remove Intercom integration and chat support components (#8875)

c21d2c6

Intercom is no longer used. This removes all related frontend components, hooks, custom events, API config, types, and i18n keys.

[WEB-6840] feat: skip role & use-case steps for self-hosted instances (…

db3c8f2

…#8890)

enhance sub-issue query performance with optimized annotations and su…

13db2f8

…bqueries (#8889)

[SILO-1158] chore: add context for project in relations API (#8860)

45b4fc8

* add context for project in relations API * modify issue relation serializer

Copilot AI review requested due to automatic review settings April 20, 2026 10:10

Copilot started reviewing on behalf of sriramveeraghanta April 20, 2026 10:11 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Comment thread apps/api/plane/app/views/issue/sub_issue.py

Comment thread apps/api/plane/utils/ip_address.py

Comment thread apps/api/plane/api/views/issue.py

sriramveeraghanta and others added 5 commits April 20, 2026 17:17

chore: update CODEOWNERS for apps and deployments (#8919)

62b2d1b

* chore: update CODEOWNERS for apps and deployments Assign owners per app/area so reviews are routed to the right maintainers. * chore: update the codeowners

chore: bump up the package version

c62930e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: v1.3.1#8917

release: v1.3.1#8917
sriramveeraghanta wants to merge 21 commits intomasterfrom
canary

sriramveeraghanta commented Apr 20, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading

Review skipped

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

makeplane Bot commented Apr 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

sriramveeraghanta commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✨ Improvements

🐛 Bug Fixes

🔧 Refactor & Chore

📦 Dependencies

Uh oh!

coderabbitai Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

makeplane Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

sriramveeraghanta commented Apr 20, 2026 •

edited

Loading

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading

makeplane Bot commented Apr 25, 2026 •

edited

Loading