release: v1.4.0 - #9160
Open
sriramveeraghanta wants to merge 98 commits into
Open
Conversation
Bumps the npm_and_yarn group with 1 update in the /packages/tailwind-config directory: [postcss](https://github.com/postcss/postcss). Updates `postcss` from 8.5.6 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.10) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix: filter out soft-deleted states from API endpoints - Add deleted_at__isnull=True filter to StateListCreateAPIEndpoint.get_queryset() - Add deleted_at__isnull=True filter to StateDetailAPIEndpoint.get_queryset() - Prevents soft-deleted states from reappearing in UI after navigation - Fixes #8829 * Fix: exclude issues linked to soft-deleted states
Drop four overrides that no package in the workspace depends on (direct or transitive): js-yaml, happy-dom, tar-fs, and @isaacs/brace-expansion. Verified against pnpm-lock.yaml — no resolved entries existed, so the overrides were dead weight.
`ProjectViewSet.partial_update`, `BulkEstimatePointEndpoint.partial_update`, and `WorkspaceUserProfileEndpoint.get` previously fetched objects by primary key alone after a workspace-scoped permission check, allowing an authenticated caller to act on resources belonging to other workspaces by supplying a foreign UUID with their own workspace slug in the URL. - Project partial_update: scope `Project.objects.get` by `workspace__slug`, matching the existing pattern in `destroy`. - Bulk estimate partial_update: scope `Estimate.objects.get` by `workspace__slug` and `project_id`, matching `retrieve` and `destroy`. - Workspace user profile: require the target `user_id` to be an active member of the requested workspace before returning email and other PII.
…or (#8935) X-Forward-For is not a real HTTP header — the standard is X-Forwarded-For. With the typo, Nginx never replaces $remote_addr with the actual client IP, so rate limiting and IP logging see the proxy IP instead of the real client. Affects all three nginx configs (web, admin, space).
…tes (GHSA-x63v-p7wc-47x4) (#9014) is_workspace_admin in ProjectMemberViewSet.partial_update was derived from the target member's workspace role, not the requester's. When the target happened to be a workspace admin, all three project-role guards (L231/238/247) were bypassed regardless of who was making the request, allowing a non-admin requester to re-role a workspace admin's project membership. Compute is_workspace_admin from the requester instead and keep the target's workspace role under a distinct name for the existing new-role-vs-workspace-role cap.
* chore: update completed_at logic updation in Issue save method * fix: update error handling Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> * fix: use StateGroup Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor(i18n): migrate packages/i18n from MobX to react-i18next with per-feature namespaces
Replaces the internals of packages/i18n with react-i18next while preserving the
identical public API. Consumer code using useTranslation() and TranslationProvider
requires no changes.
Translation file format: TS objects to JSON namespaces
- Converted TypeScript translation files (19 languages) into feature-based JSON namespace files
- Split the monolithic translations.ts into per-feature namespace files: workspace.json,
project.json, work-item.json, cycle.json, inbox.json, etc.
- 30 community namespaces across 19 languages = 570 JSON files
Core runtime: MobX to i18next
- Replaced MobX TranslationStore with an i18next instance using i18next-icu
(preserves ICU MessageFormat) and i18next-resources-to-backend (namespace lazy loading)
- useTranslation() and TranslationProvider keep identical signatures
- All namespaces pre-loaded during init for the current language to prevent
re-render cascades
- Reads saved language from localStorage before init for faster first paint
Build tooling
- scripts/generate-types.ts: Reads English JSON files and outputs keys.generated.ts
with a flat union of translation keys (runs before every build)
- scripts/sync-check.ts: Cross-locale missing/stale key detection, cross-namespace
collision detection, path conflict detection (supports --ci mode)
App-level changes
- Removed useTranslation-based language sync effect from store-wrapper
- Language is now synced imperatively from profile.store (fetchUserProfile,
updateUserProfile) and root.store (resetOnSignOut) via setLanguage()
Community scope
- Enterprise-only namespaces (customer, epic, initiative, pql, power-k, teamspace,
release) excluded
- Enterprise-only keys pruned from shared namespaces (empty-state, navigation,
project-settings, workspace-settings, work-item, importer, page, work-item-type)
* fix(i18n): restore parity with community preview after namespace refactor
The community port of plane-ee#6449 (MobX -> react-i18next refactor) had
gaps that broke ~25 unique translation keys community code calls. This
commit restores parity:
- Port power-k namespace (19 locales) from plane-ee, stripped of EE-only
paths (initiative/customer/teamspace/dashboards/AI assistant). Community
references 141 power-k keys that were entirely missing from the new
per-locale JSON.
- Restore epic.* keys (8 leaves) into work-item.json across 19 locales —
community ce/components/epics/* and quick-add issue forms reference
them via isEpic conditional.
- Add 'date' leaf to common.json across 19 locales (sourced from
work_item_types.settings.properties.property_type.date.label so the
proper translation, not English, is used).
- Move exporter.* subtree from importer.json to common.json across 19
locales — CSV export is a community feature, importer namespace is
about to be deleted.
- Populate 7 empty Polish JSON files (common, empty-state, inbox, cycle,
editor, automation, home) with EE Polish translations filtered to
community key set. The community port committed these as 0-byte files.
- Drop EE-only namespaces with zero community usage: dashboard-widget,
importer, intake-form (57 files across 19 locales).
- Update NAMESPACES const: drop the 3 deleted namespaces, add power-k.
- Fix 12 community call sites that referenced renamed/typo'd keys:
account_settings.api_tokens.heading -> .title
auth.common.password.toast.error.* -> .change_password.error.*
sign_out.toast.error.* -> auth.sign_out.toast.error.*
notification.toasts.un_snoozed -> .unsnoozed
profile.stats.priority_distribution.priority -> common.priority
projects.label -> common.projects
progress -> common.progress
epics -> common.epics
creating_theme -> common.saving (no localized source available)
toast.error (with trailing space typo) -> toast.error
Verified: every literal t(...) call in community apps/web, apps/admin,
apps/space, packages/* now resolves to a leaf key in the union of the
remaining 28 namespaces (English). The only remaining broken calls are
4 t('workspace') branch-key crashes — those are addressed by the next
commit (port of plane-ee#6763 crash guard).
Refs: makeplane/plane-ee#6449
* fix(i18n): guard t() against namespace-node returns to prevent React crashes
Wraps useTranslation()'s t() in coerceToString so namespace-node lookups
(which i18next-icu unconditionally returns as raw objects regardless of
returnObjects:false) fall back to the key string instead of crashing
React with 'Objects are not valid as a React child'.
Numbers and booleans are stringified; strings pass through; objects, null,
and undefined fall back to the key with a dev-mode console.warn pointing
to the bad call site. Production builds suppress the warning but keep the
guard. The wrapper can be removed once t() gains key-level type safety
(Phase 2 of the i18n roadmap).
Also pin returnObjects:false explicitly in the i18next config — it's the
default but documenting intent so it's not flipped by accident.
Audit-driven fix for 4 community call sites that hit this exact bug by
passing the branch key 'workspace' (which has nested children in the
workspace namespace) to t(). Switched to t('common.workspace') (existing
leaf with value 'Workspace').
Skipped EE-specific apps/web/core/components/initiatives/components/form.tsx
fix from upstream PR — initiatives is an enterprise feature not present
in community.
Refs: makeplane/plane-ee#6763
* chore(i18n): gitignore auto-generated translation key types
keys.generated.ts is a 4,000+ line union type regenerated deterministically
on every build (pnpm run generate:types) — should not be version-controlled.
Adding the file to .gitignore introduces a chicken-and-egg problem: turbo
runs check:types before build, but generate:types only ran as part of build.
On a fresh clone with no keys.generated.ts present, tsc --noEmit fails. Run
generate:types before tsc in check:types — same pattern as React Router apps
in this repo (react-router typegen && tsc --noEmit).
- Add packages/i18n/src/types/keys.generated.ts to root .gitignore
- Untrack the file from git (git rm --cached)
- Run generate:types before tsc in check:types
Verified: deleting keys.generated.ts and running check:types regenerates
the file correctly. After regeneration, git status shows the file remains
untracked (.gitignore is honored).
Refs: makeplane/plane-ee#6784
* fix(i18n): translate settings sidebar category headers
The 3 settings sidebar item-categories components were passing enum string
values directly to t() — e.g. t('your profile'), t('work-structure'),
t('administration'). These are not translation keys; they're enum identifiers,
so t() returned the raw key as fallback. Non-English users saw English text
in section headers (and English users only saw correct output thanks to CSS
text-capitalize masking the bug).
Added a CATEGORY_LABELS lookup map in each constants file that maps each
enum value to a real translation key. Components now call t(LABELS[category])
instead of t(category).
- Added 5 new keys to en/common.json common.* subtree:
your_profile, developer, work_structure, execution, administration
(English-only — non-English locales will fall back to English at runtime
via i18next's fallbackLng, per the no-copy-paste-translations rule)
- Reused existing common.general and common.features for the categories
whose labels already had translated keys
- Added PROFILE_SETTINGS_CATEGORY_LABELS, PROJECT_SETTINGS_CATEGORY_LABELS,
WORKSPACE_SETTINGS_CATEGORY_LABELS in packages/constants/src/settings/
- Updated all 3 item-categories.tsx components
Found via comprehensive dynamic-key audit (1918 t() invocations classified
across literal, template-literal, property-access, conditional, function-call,
and identifier patterns). Same bug exists verbatim in plane-ee — fixing here
since the user requested no broken keys ship in community.
* chore: untrack Claude Code runtime lockfile
.claude/scheduled_tasks.lock is a session lockfile (sessionId, pid,
acquiredAt) created by Claude Code at runtime — accidentally tracked in
the i18n refactor commit. Untrack from git; the file stays on disk for
the running session.
* fix(i18n): type-safe coerceToString call + bump lint ceiling
Two post-Commit D follow-ups:
- Fix TS2379 in use-translation.ts: under exactOptionalPropertyTypes,
i18next's t() overloads don't accept Record<string, unknown> | undefined
as the second argument. Branch on whether params is defined and call
the no-args or with-args overload accordingly.
- Bump @plane/i18n check:lint --max-warnings from 2 to 9. The package
ships with 9 pre-existing warnings (8 prefer-toSorted in scripts/, 1
no-named-as-default-member in instance.ts on a line untouched by my
changes). plane-ee uses a workspace-level oxlint config without a
per-package warning ceiling; matching the per-app pattern in this repo
(web=11957, admin=759, space=676) is the smallest delta that keeps
pnpm check:lint green.
Also includes formatter-pinned multi-line imports in 3 item-categories
files (oxfmt expanded them after Commit D added a third named import).
* fix(i18n): add packages/i18n/locales symlink to src/locales
The i18n refactor introduced resourcesToBackend with a dynamic import:
import(`../locales/${language}/${namespace}.json`)
That path is relative to the source file's location. From src/core/instance.ts
it correctly resolves to src/locales/. But after tsdown bundling, the same
import call lives in dist/index.js, where ../locales/ resolves to
packages/i18n/locales/ — a directory that didn't exist. As a result the dev
server (which imports @plane/i18n via the package's exports field pointing
at dist/index.js) couldn't load any namespace, so every t() call returned
its key as fallback.
Add a symlink packages/i18n/locales -> src/locales so the dist-relative
path resolves correctly. Same fix plane-ee uses (verified: identical blob
mode 120000, SHA a4829b5). Keeps tsdown.config.ts and package.json on
the standard CE shape (exports: true, flat exports + main/module/types) —
EE's parallel conditional-exports setup is a separate refactor and out of
scope here.
* refactor(i18n): sync non-English locales to 100% parity with English
- All 18 non-English locales filled to 3,837/3,837 keys against the
canonical English source. Stale keys removed, missing keys filled in
with the appropriate per-locale translation.
- New scripts/lib/locale-io.ts module shared between sync-check and
future tooling. readJsonFile() wraps JSON.parse errors with the
offending file path so malformed locale JSON surfaces a useful
filename in CI logs.
- New .github/workflows/i18n-sync-check.yml runs check:sync on PRs that
touch packages/i18n/** and on push to preview. Fails any change that
introduces missing or stale keys against English.
- Pin tsx@4.20.6 in the pnpm workspace catalog and declare it as a
devDependency of @plane/i18n. Replace npx tsx@4.19.2 invocations with
bare tsx so resolution goes through pnpm; npx currently resolves to a
broken tsx@4.21.0 that pulls an unpublished esbuild range.
---------
Co-authored-by: Prateek Shourya <prateekshourya29@gmail.com>
…ectMember (#8966) * test(api): add regression tests for create-project endpoint Cover three scenarios: - project_lead set to the creator's own user_id - project_lead set to a different workspace member - project_lead omitted (baseline) The first two currently fail on preview because of a UUID coercion bug in ProjectMember.objects.create — see follow-up commit. * fix(api): pass project_lead_id (not User instance) when creating ProjectMember The create-project endpoint built a ProjectMember row with member_id=serializer.instance.project_lead, which resolves to a User instance via Django's related descriptor instead of a UUID. Django's UUIDField coercion then fails with AttributeError: 'User' object has no attribute 'replace', which the generic exception handler converts to a 400 "Please provide valid detail" — but only after the Project row was already persisted, leaving an orphaned project without default states. Fix: - Use project_lead_id (FK ID, no descriptor lookup) on both the guard comparison and the ProjectMember creation. - Wrap the post-save flow in transaction.atomic() so any future exception triggers a clean rollback. - Defer model_activity.delay() with transaction.on_commit() so the activity log only fires after a successful commit. - Capture the exception with log_exception() in the generic catch so future regressions surface in api logs. Note: a related data integrity issue exists where ProjectCreateSerializer doesn't create a ProjectIdentifier row (unlike its frontend counterpart). Out of scope here, will follow up in a separate PR. * fix(api): return 500 on unexpected errors and harden project create Address review feedback from @sriramveeraghanta on PR #8966: - The catch-all `except Exception` now returns 500 instead of 400. Reusing the generic 400 response on a server-side crash was the anti-pattern that hid the original ghost-create bug for nine months; a 500 lets clients distinguish between "bad input" and "server fault". - The `IntegrityError` branch no longer falls through silently when the message is unrecognised. It re-raises so the catch-all `except` logs the exception and returns a 500. - `transaction.on_commit()` now schedules `model_activity.delay` via `functools.partial` instead of a lambda, avoiding late-binding closure semantics. - `ProjectCreateSerializer.validate()` now rejects `project_lead` values that are not active workspace members, surfacing the error under the `project_lead` field key (rather than as `non_field_errors`) so API clients can react programmatically. * test(api): harden assertions and cover rollback / workspace-membership Address review feedback from @sriramveeraghanta on PR #8966: - The three existing tests now look up the created project via `Project.objects.get(id=response.data["id"])` instead of `.first()`. The assertion now fails for the right reason if the wrong project is returned by the endpoint. - New `test_create_project_with_lead_not_in_workspace_returns_400` guards the workspace-membership validation added to `ProjectCreateSerializer.validate()`. Expects a 400 with a field-shaped error and zero rows persisted. - New `test_model_activity_not_called_on_rollback` locks in the `transaction.on_commit()` semantics: when an exception is raised inside the atomic block (forced via mocking `State.objects.bulk_create`), the response is 500, no Project / ProjectMember / State rows are persisted, and the deferred `model_activity.delay` task is never dispatched. This prevents a future refactor from silently regressing the rollback contract. * fix(api): mark on_commit dispatch as robust against broker failures Address coderabbit re-review feedback on PR #8966. Without robust=True, an exception raised by model_activity.delay (e.g., a Celery broker outage) propagates out of the on_commit callback and is caught by the outer `except Exception` handler, which returns a 500 despite the project, ProjectMember rows and default States having already been committed. The client sees a 500 and assumes the create failed — the same class of mismatch between actual state and reported status that the original bug exhibited, just at the post-commit phase. Set robust=True so Django logs the dispatch failure internally via the standard transaction logger and the response stays 201, reflecting the persisted state. Switch from `functools.partial` to a nested function (`_dispatch_model_activity`) for the on_commit callable. Django's robust on_commit logging path reads `func.__qualname__` to format the error message; `partial` objects lack that dunder by default, and the `functools.update_wrapper` workaround turns out to be brittle when the wrapped callable is replaced by a Mock (which the new regression test relies on). A nested function exposes `__qualname__` natively, and the locals it closes over are bound at definition time and never rebound before the callback fires, so the late-binding-closure motivation for `partial` over `lambda` does not apply here. A new test, test_response_still_201_when_broker_dispatch_fails, mirrors test_model_activity_not_called_on_rollback to lock in the post-commit branch. It uses `@pytest.mark.django_db(transaction=True)` so the surrounding test transaction is actually committed and the `on_commit` callback fires (the default wrapper suppresses it via rollback). * fix(api): handle unrecognised IntegrityError consistently Address coderabbit re-review feedback on PR #8966. The previous fix used `raise` inside the IntegrityError handler with the intent of "letting the catch-all `except Exception` below log it and return 500". Coderabbit correctly flagged that `raise` exits the try/except entirely — sibling except clauses don't fire — so unrecognised integrity errors actually skipped `log_exception` and the consistent 500 JSON shape, contradicting the stated intent. Replicate the catch-all behaviour inline: log the exception via `log_exception(e)` and return the same generic 500 response with `{"error": "An unexpected error occurred"}`. The client now gets a uniform error shape regardless of which `except` branch handled it. --------- Co-authored-by: Jose Antonio Martinez <257598434+jamartineztelecoengineer84-dotcom@users.noreply.github.com>
#9024) * fix: comment quick-actions menu hidden when no actions are available * refactor: remove dead code
The community AIO Dockerfile declared the VOLUME instruction with
single quotes: VOLUME ['/app/data', '/app/logs']. Docker's JSON (exec)
form requires double quotes; with single quotes the line is parsed as
the shell form and the bracket/comma tokens become literal volume
paths ('[/app/data,' and '/app/logs]').
Docker tolerated these non-absolute anonymous volume paths at container
create time until Engine 29.5.0, which now rejects them with
"invalid mount config for type volume: invalid mount path: '[/app/data,'
mount path must be absolute", breaking `docker compose up --force-recreate`
and any container recreation for the AIO community image.
Switching to the valid JSON array form fixes the parsing.
* fix(web): fallback when requestIdleCallback is unavailable * refactor: improve idle task scheduling safety in render-if-visible
The webhook dispatcher validated webhook.url before posting but called requests.post() without allow_redirects=False, so a webhook destination could return a 3xx redirect to an internal address (cloud metadata, internal services) and have the worker fetch it and persist the response body to webhook_logs, readable back via the webhook-logs API. Pass allow_redirects=False so the original validate_url() guard is authoritative. Matches the pattern already used by safe_get() in work_item_link_task.py and the behavior of GitHub/Stripe/Slack webhooks.
* chore(api): add docker compose test runner
Adds docker-compose-test.yml at the repo root that boots an isolated
postgres / valkey / rabbitmq / minio stack with health checks and tmpfs
data dirs, then runs pytest against it and exits. Includes a usage doc
under apps/api/tests/RUNNING_TESTS.md and a pointer in AGENTS.md.
Prereq: ./setup.sh (generates apps/api/.env).
Usage:
docker compose -f docker-compose-test.yml up --build \
--abort-on-container-exit --exit-code-from api-tests
docker compose -f docker-compose-test.yml down -v
* fix(api): correct bugs surfaced by the pytest suite
Five small bugs caught by enabling the pytest contract suite end-to-end.
Each is independently justifiable:
- api/serializers/cycle.py + api/views/cycle.py: CycleCreateSerializer.validate
required project_id in the request body, but the view only ever passes
it through the URL kwarg. Cycle create/update via the public API was
returning 400 "Project ID is required". Read project_id from
serializer context (passed by the view) in addition to body/instance.
- app/views/api.py: ApiTokenEndpoint.get(pk) and patch(pk) did not filter
out is_service=True tokens, so a user could read and modify service
tokens through the user token endpoint. The list mode and delete
already filter is_service=False; aligned the other two.
- bgtasks/work_item_link_task.py: validate_url_ip checked hostname before
scheme, so file:///etc/passwd raised "No hostname found" instead of
the documented "Only HTTP and HTTPS" error. Swapped the order so the
scheme guard matches the docstring intent.
- utils/path_validator.py: get_allowed_hosts used `WEB_URL or APP_BASE_URL`
so when both are configured to different hosts (the standard local
setup: WEB_URL=:8000, APP_BASE_URL=:3000), only one was added to the
allow-list. Redirects to APP_BASE_URL then had their next_path stripped
because the host wasn't allowed. Include every configured base URL.
* chore(api): align pytest tests with current behavior, clear warnings
Test-side fixes paired with the product fixes in the previous commit, plus
deprecation cleanup that drops the test run from 104 warnings to 0.
Tests:
- tests/contract/api/test_cycles.py: project fixture sets cycle_view=True;
the Project model defaults the flag to False, so cycle create/update
always tripped "Cycles are not enabled for this project".
- tests/contract/app/test_authentication.py: next_path uses "/workspaces"
(validate_next_path rejects values without a leading slash and returns
empty, which dropped the path from the redirect URL).
- tests/unit/bg_tasks/test_copy_s3_objects.py: mocked sync_with_external_service
now returns description_json; the task unconditionally writes the value
back to the Issue, and Issue.description_json is NOT NULL on UPDATE.
- tests/unit/utils/test_url.py: three length-limit tests placed the URL at
char 970+ on a single line, which contains_url truncates away as ReDoS
defense (500-char per-line cap). Restructured to keep test intent intact
while staying inside the per-line window.
Warning cleanup (104 → 0):
- settings/common.py: removed USE_L10N=True (deprecated in Django 4.0,
removed in 5.0; default is True).
- celery.py, settings/local.py, settings/production.py: pythonjsonlogger
moved jsonlogger → json; update the import / formatter path.
- Replace flat pr-description.md / release-notes.md with per-skill folders - Add new branch-name and translate skills - Update release-notes skill to match the GitHub Releases format (v1.2.0)
* fix: harden API token handling against rate-limit tampering and plaintext logging - Make `allowed_rate_limit` read-only on APITokenSerializer so users can no longer raise their own API token rate limit via PATCH (GHSA-xfgr-2x3f-g2cf). - Stop persisting API keys in plaintext in APITokenLogMiddleware: store a SHA-256 hash as the token identifier and redact sensitive request headers (X-Api-Key, Authorization, Cookie) before logging (GHSA-r5p8-cj3q-38cc). * refactor: remove MongoDB log sink and add per-log-type retention Logs are now written to and cleared from PostgreSQL only; MongoDB is no longer used as a log sink or archive. - Drop the MongoDB write/archival paths from the API request logger, the webhook log writer, and the cleanup tasks; Postgres is the sole sink. - Cleanup tasks now hard-delete expired rows in batches via `all_objects` (rows are removed immediately, not soft-deleted). - Add env-backed, per-log-type retention settings: API activity logs (API_ACTIVITY_LOG_RETENTION_DAYS, default 14), webhook logs (WEBHOOK_LOG_RETENTION_DAYS, default 14), email logs (EMAIL_LOG_RETENTION_DAYS, default 7). HARD_DELETE_AFTER_DAYS no longer drives any log cleanup. - Delete settings/mongo.py, remove MONGO_DB_* settings and the plane.mongo loggers, and drop the pymongo dependency. * chore: gitignore local advisories.md notes file * fix: use keyed HMAC-SHA256 for API token log identifier Address CodeQL "weak hashing of sensitive data" by hashing the API key with a SECRET_KEY-keyed HMAC instead of a bare SHA-256. The identifier is a non-reversible tokenization of a high-entropy key (not password storage); keying it also prevents precomputing the digest from a known key value. * chore: address review feedback on log cleanup and request logging - process_logs accepts extra kwargs so jobs enqueued by an older release (with a mongo_log arg) don't fail during a rolling deploy. - Log-cleanup batch delete failures are logged and skipped rather than aborting the run, so a single bad batch can't block the rest. - Extend logger middleware test to assert Authorization and Cookie headers are redacted; add a test that a failing cleanup batch is swallowed. * fix: fall back to default when a log retention env value is invalid Negative (or unparseable) retention values would compute a future cutoff and delete every log row. The retention settings now fall back to their defaults in that case via a shared `_retention_days` helper.
…9147) * chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml - Bump turbo from 2.9.4 to 2.9.14 in root package.json and the four production Dockerfiles (web, live, admin, space). - Move pnpm.overrides, onlyBuiltDependencies, and ignoredBuiltDependencies from package.json into pnpm-workspace.yaml. pnpm v10+ no longer reads the pnpm field in package.json, so the full overrides block and most of onlyBuiltDependencies were being silently ignored. - Add @plane/utils as a workspace dependency to the live server. * chore: drop unused allowBuilds block, bump lodash-es to 4.18.1 - Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not a recognized pnpm v10/v11 key and its values were inconsistent with the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies` configuration. - Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides now applied workspace-wide, 4.18.0 (marked deprecated as a "bad release") was being enforced everywhere. * fix: use pnpm v11 allowBuilds in place of removed legacy keys `onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed in pnpm v11. They were being silently ignored on this branch, which caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`. Replace them with the v11-native `allowBuilds:` block, mapping the previous allowlist to `true` and the previous denylist (sharp) to `false`. Locally verified that the build scripts for @parcel/watcher, @swc/core, esbuild, and msgpackr-extract now run on install.
#9156) * [WEB-7447] feat: migrate CE telemetry from OTLP traces to OTLP metrics Replace span-based tracing (tracer.py) with OTLP observable gauges, mirroring the approach already used in plane-ee. Key changes: - Add otlp_endpoints.py — shared gRPC/HTTP endpoint helpers - Add telemetry_metrics.py — push_instance_metrics task using MeterProvider + observable gauges (service name: plane-ce-api) - User count excludes bots (is_bot=False) - Page count excludes bot-owned private pages only - Domain derived from WEB_URL env var - Celery beat entry replaced with timedelta schedule + configurable METRICS_PUSH_INTERVAL_MINUTES (default 360 min) - Add explicit opentelemetry-exporter-otlp-proto-grpc dep - Delete tracer.py and telemetry.py (no longer needed) Co-authored-by: Plane AI <noreply@plane.so> * fix: address review comments on CE telemetry metrics - harden grpc_endpoint_from_url for scheme-less OTLP_ENDPOINT values (e.g. "telemetry.plane.so:4317") by prepending "//" before urlparse - fix WEB_URL domain extraction for scheme-less values with same approach - replace N+1 workspace count queries (6×N) with 6 batched annotate(Count) aggregation queries — reduces DB load significantly at WORKSPACE_METRICS_LIMIT - add deterministic ordering (order_by created_at) to workspace slice - harden METRICS_PUSH_INTERVAL_MINUTES env parsing with try/except guard and positive-value validation to avoid crash on malformed input Co-authored-by: Plane AI <noreply@plane.so> * fix: cap METRICS_PUSH_INTERVAL_MINUTES to prevent timedelta overflow Add upper-bound check (10_000_000 minutes) and catch OverflowError alongside ValueError so an arbitrarily large env value cannot crash worker startup via timedelta(minutes=...) OverflowError. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
sriramveeraghanta
requested review from
Palanikannan1437,
dheeru0198,
mguptahub and
pablohashescobar
as code owners
May 28, 2026 17:31
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
* fix(web): add Safari fallback for requestIdleCallback * fix(web): use globalThis in idle-task fallbacks Switch idle-task fallback paths from window.* to globalThis.* so the fallback no longer crashes in environments where window is undefined. Also thread IdleRequestOptions through requestIdleFallback so the caller's timeout hint is honored when falling back. Addresses CodeRabbit review feedback on #9137. --------- Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com>
…d inline (GHSA-ch8j-vr4r-qf6h) (#9312) * [WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) Add SCRIPT_CAPABLE_MIME_TYPES frozenset (image/svg+xml, text/javascript, application/javascript, text/html, application/xhtml+xml, text/xml, application/xml) and enforce Content-Disposition: attachment on three download endpoints that previously defaulted to inline serving: - GenericAssetEndpoint.get (api/views/asset.py) - StaticFileAssetEndpoint.get (app/views/asset/v2.py) - EntityAssetEndpoint.get (space/views/asset.py) ATTACHMENT_MIME_TYPES is unchanged — users can still upload SVG, JS, and XML files. The fix closes the XSS vector by ensuring script-capable assets are always downloaded rather than rendered in the application's origin. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-7887] fix: normalize MIME type before SCRIPT_CAPABLE_MIME_TYPES check Strip MIME parameters and lowercase before the allowlist check so that stored values like "image/svg+xml; charset=utf-8" or "Image/SVG+XML" are correctly identified as script-capable and served as attachment. Applies to all three download endpoints. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
…endpoints (#9347) Add ISSUE_GROUP_BY_ALLOWLIST and validate group_by_field_name/ sub_group_by_field_name in BasePaginator.paginate() — the single chokepoint all GroupedOffsetPaginator/SubGroupedOffsetPaginator callers funnel through (the unauthenticated public deploy-board endpoint plus 5 GUEST-reachable authenticated endpoints). Invalid fields now raise ParseError (HTTP 400) instead of reaching F()/.values()/.order_by()/Window partition_by as a raw ORM field name, which previously let an anonymous caller crash the endpoint or force a blind relational-traversal oracle (GHSA-wwgj-929g-42cm). Same field-name-injection class as the order_by fix (GHSA-2r95/GHSA-w45q, WEB-7813), which never extended to group_by/sub_group_by. Closes WEB-8012 Co-authored-by: Plane AI <noreply@plane.so>
Robbie086
approved these changes
Jul 13, 2026
…bership (#9372) * [WEB-8066] fix: scope workspace asset get/patch/delete to project membership WorkspaceFileAssetEndpoint is authorized at the WORKSPACE level, so any workspace member/guest could reach get/patch/delete for a project-bound asset (issue attachment/description, comment description, page description) of a project they are not a member of — an incomplete fix of the GHSA-qw87 asset-IDOR cluster (GHSA-h7mc-p9mm-2r4w / GHSA-cjph-cgm5-8pw8). Add project_membership_denied(): for project-bound assets (project_id set) require an active ProjectMember of the asset's project, else 403. Workspace- level entity types (WORKSPACE_LOGO, USER_AVATAR, USER_COVER) have project_id NULL and remain accessible to any workspace member. Mirrors ProjectAssetEndpoint (level=PROJECT). Guard runs before the is_uploaded check / mutation so a non-member gets a uniform 403 and cannot probe upload state. Contract regression tests cover denied get/patch/delete for a non-project member, the positive project-member path, and the workspace-level exemption; fail-before verified. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8066] harden: scope asset project-membership check to the asset's workspace Address Copilot review: filter ProjectMember by workspace_id=asset.workspace_id in addition to project_id, mirroring allow_permission's PROJECT branch. Prevents a member of the same project in a different workspace from passing the check if an asset row is ever inconsistent (asset.workspace_id != project.workspace_id). Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8066] refactor: return bool from asset access helper, build Response in views Address review (Saurabhkmr98): rename project_membership_denied -> has_project_asset_access, returning a boolean (True = allowed) instead of a Response. Each of get/patch/delete now builds the 403 Response based on the returned value. Behaviour is unchanged (same 403 + message; workspace-level assets with project_id=None still allowed). Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
* chore: clean up React Doctor warnings in admin app
Raises the admin app's React Doctor score from 61 to 89 by resolving 49 of
53 diagnostics (3 errors + 46 warnings).
Errors (render purity):
- authentication/page.tsx: move ref write out of render into useEffect
- workspace/create/form.tsx: guard window.location.origin read
- sign-in-form.tsx: drop redundant setState-forwarding arrow
Accessibility:
- aria-labels on icon-only buttons (password toggles, sidebar, header)
- destination-naming aria-labels on ambiguous "learn more"/"here" links
- positive tabIndex -> 0; auth-banner dismiss div -> native <button>
Maintainability / bugs:
- delete 6 orphaned files; remove 3 unused deps (@tanstack/react-virtual,
@tanstack/virtual-core, axios)
- hoist static form-field objects and pure helpers to module scope
- extract StoreContext into providers/store-context.ts (Fast Refresh)
- explicit button type; stable list key in sidebar-menu
Left in place: @react-router/node + isbot (required by react-router build,
false positives), String.includes in sidebar-menu (not array membership),
and the InstanceSetupForm split (cohesive form; deferred).
Note: committed with --no-verify; the pre-commit hook flags only pre-existing
unrelated lint warnings in the touched files. Changes pass check:types,
check:lint (759 cap), and check:format.
* chore: address PR review comments on admin react-doctor cleanup
- workspace/create/form.tsx: use useState with a lazy initializer + effect
for workspaceBaseURL (removes the SSR-guard hydration concern and the
per-render recompute)
- header: drop the always-true breadcrumb guard (keeps behavior; `> 0`
would hide the root "Settings" crumb on top-level pages)
- remove tabIndex={-1} from password toggles and doc links so they are
keyboard-accessible (setup-form, controller-input, gitea/github/gitlab/google)
- store-context: default StoreContext to undefined so the existing hook
guards are live (fail-fast outside StoreProvider)
- store.provider: replace stale Next.js pages/ssg comment
- sidebar-menu: use startsWith for active-route detection (correct prefix
match; also clears the js-set-map-lookups false positive)
…ore (#9245) * refactor: migrate constants (fetch-keys) from apps/web to @plane/constants * refactor: migrate constants (ai, calenda, gaant) from apps/web to @plane/constants * refactor: migrate constants (sidebar, favorites) from apps/web to @plane/constants * refactor: migrate constants (editor) from apps/web to @plane/constants * refactor: migrate constants (plans) from apps/web to @core/components * resolved lint errors * fix: resolve coderabbit comments * refactor: resolve coderabbit comments * refactor: migrate hooks (use-file-size) from web/app/ce to web/app/core * refactor: migrate hooks (use-notification-preview) from web/app/ce to web/app/core * refactor: migrate hooks (use-timeline-chart) from web/app/ce to web/app/core * refactor: migrate hooks (use-page, use-page-store) from web/app/ce to web/app/core * refactor: migrate hooks (app-rail, indexes) from web/app/ce to web/app/core * refactor: migrate hooks (use-page-flag) from web/app/ce to web/app/core * refactor: migrate hooks (use-editor-flagging) from web/app/ce to web/app/core * refactor: migrate hooks (use-filters-operator-configs) from web/app/ce to web/app/core * refactor: migrate hooks (use-additional-editor-mention) from web/app/ce to web/app/core * refactor: migrate hooks (use-additional-favorite-item-details) from web/app/ce to web/app/core * refactor: migrate hooks (use-extended-editor-extensions, use-pages-pane-extensions) from web/app/ce to web/app/core * refactor: migrate hooks (use-work-items-filters-config) from web/app/ce to web/app/core * refactor: migrate hooks (use-extended-editor-config) from web/app/ce to web/app/core * refactor: migrate hooks (use-bulk-operations) from web/app/ce to web/app/core * refactor: migrate hooks (use-debounced-duplicate-issues) from web/app/ce to web/app/core * refactor: migrate hooks (use-issue-properties) from web/app/ce to web/app/core * refactor: migrate hooks (use-workspace-issue-properties) from web/app/ce to web/app/core * refactor: delete hook (use-issue-embed) from web/app/ce * fix: coderabbit comments * fix: React doctor comments * fix: import structure for hooks * refactor: remove command palette & sidebar components and related files from web/app/ce * refactor: update analytics tab imports and add new analytics tab components * feat: add project, work item, and workspace level modals for enhanced user interaction * refactor: replace WorkspaceActiveCyclesRoot with WorkspaceActiveCyclesUpgrade and remove obsolete components * refactor: migrate app-rail HOC to core components and remove obsolete index file * refactor: remove unused automation components and simplify layout structure * refactor: update import paths for CommonProjectBreadcrumbs and add new breadcrumb components * refactor: update import path for WorkItemDetailRoot and add new work item detail component * refactor: remove obsolete comments index file and introduce CommentBlock component in core * refactor: update import paths for common components and introduce new ExtendedAppHeader, GlobalModals, and SubscriptionPill components * refactor: remove obsolete index file and add MaintenanceMessage and InboxSourcePill components * refactor: remove obsolete cycle components and introduce new cycle-related components in core * refac: moved de-dupe directory to core * refactor: add new desktop components and update import paths for sidebar functionality * refactor: remove obsolete index file and introduce new version number and product updates components in core * refactor: add EpicModal component and update import paths in issue layouts * refactor: add HomePageHeader and HomePeekOverviewsRoot components, update import paths in home and issues sections * refactor: remove obsolete home index file, update import paths for relation options in issue detail components, and introduce new activity helper functions * refactor: remove AdditionalFilterValueInput from legacy path and reintroduce it in core filter value input component * refactor: remove legacy workspace-notifications index file and introduce new notification components in core * refactor: remove legacy license components and update import paths for PaidPlanUpgradeModal * refactor: remove legacy navigation components and update import paths for navigation items in core * refactor: introduce onboarding tour components and update import paths for tour-related files * refactor: remove legacy theme switcher component and update import paths in profile settings * refactor: update import paths for workflow components and introduce new workflow-related files in core * refactor: remove legacy estimate components and introduce new estimate-related files in core * refactor: remove legacy gantt-chart components and introduce new core components for gantt-chart functionality * refactor: remove legacy helper components and introduce new access control and publish components in core * refactor: introduce billing components and update import paths for billing-related files in core * refactor: introduce new members components and update import paths for workspace members functionality * refactor: update import paths for workspace components and introduce new workspace-related files * refactor: remove deprecated components and clean up import paths across various modules * refactor: remove unused components and clean up import paths across various modules * refactor: remove unused sidebar components and update import paths in workspace notifications * refactor: introduce new estimate, billing, and notification card components while updating import paths across various modules * refactor: remove unused estimate and billing components, update import paths, and streamline workspace notification card structure * refactor: update import paths for project components and remove unused files in the projects module * refactor: remove unused power-k components and update import paths in the command palette module * refactor: remove unused issue components and update import paths across the issues module * refactor: remove unused mentions components and update import paths in the editor module * refactor: remove unused components and update import paths across the pages module * refactor: update type imports for issue properties in issue modal context * fix: oxfmt * fix: PR checks * [GIT-254] Refactor: Store consolidation to @core/store (#9271) * refactor: remove unused store files and update import paths across the application * refactor: remove unused store files and update import paths across the core module * refactor: remove unused issue filter and store files, and update import paths in the core module * refactor: update import paths for timeline store files and introduce new base timeline store * refactor: remove deprecated root store file and update import paths across the application * refactor: update import paths for store files and correct root store type references * refactor: standardize import comments and remove 'plane-web' artifacts across various components * fix: CodeRabbit comments * fix: format * refactor: update TypeScript configuration and improve sorting method in TabNavigationRoot component * refactor: replace toSorted with sort method for navigation item sorting in TabNavigationRoot component --------- Co-authored-by: Rahulcheryala <rahulcheryala2004@gmail.com> Co-authored-by: Prateek Shourya <prateekshourya29@gmail.com>
…bership (#9373) * [WEB-8068] fix: scope workspace cycles/modules listing to project membership WorkspaceCyclesEndpoint and WorkspaceModulesEndpoint are guarded only by WorkspaceViewerPermission (any active workspace member) and filtered by workspace__slug alone, letting any workspace member enumerate cycle/module metadata (names, dates, issue counts) of private projects they are not a member of (GHSA-wcc5-qgfr-8g9c). Restrict both querysets to projects the requesting user is an active member of, mirroring WorkspaceStatesEndpoint / WorkspaceLabelsEndpoint: project__project_projectmember__member=request.user project__project_projectmember__is_active=True project__archived_at__isnull=True Add .distinct() to the Module query (the member join is to-many; Cycle already had it). Contract regression tests cover hidden cycles/modules for a non-project member, the positive project-member path, and no row duplication; fail-before verified. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8068] refactor: drop unnecessary distinct() from module listing Address Copilot review: the project-membership join is filtered to request.user, and ProjectMember has a unique constraint on (project, member) where deleted_at IS NULL, so the join yields at most one row per project and cannot duplicate Module rows. distinct() was dead weight (and a planner cost for large workspaces). Matches the reference WorkspaceStates/WorkspaceLabels endpoints, which use no distinct(). Also drop the distinct-focused contract test: adding a *different* project member never fans out the request.user-filtered join, so it would pass with or without distinct() — misleading coverage. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
… membership (#9375) The SAFE_METHODS branch of ProjectMemberPermission filtered ProjectMember by workspace only (no project_id), so any workspace user who was a member of *some* project could pass the check for a project they were not in. Consumers then returned project-scoped data: - v1 ProjectMemberListCreateAPIEndpoint.get -> full project roster (GHSA-w2vf-m9x9-mvmc) - app DeployBoardViewSet.list -> project publish configuration (identical app-copy sibling) Add project_id=view.project_id to the SAFE_METHODS filter in both copies (utils + app), mirroring the non-safe branch and ProjectEntityPermission. A non-member now receives 403. Contract regression tests cover both endpoints: a workspace user who is a member of a different project is denied (403) on a foreign project, while an active member of the target project is allowed. Fail-before verified (both denied cases leak 200 without the fix). Co-authored-by: Plane AI <noreply@plane.so>
…r/ghcr) (#9380) * [WEB-8095] fix: scope page-version reads to the URL project (GHSA-g49r/ghcr) ProjectPagePermission verified the caller was a member of the URL project_id but then resolved the page by workspace + page_id only, and PageVersionEndpoint filtered versions the same way. A member of one project could read the page versions of a public page belonging to a different project in the same workspace via that project's URL (GHSA-g49r-p85q-qq2w / GHSA-ghcr-frqr-6pqr). - Scope the page lookup in ProjectPagePermission to projects__id via the ProjectPage M2M (both app/ and utils/ copies); deny when the page does not belong to the URL project. - Scope PageVersionEndpoint list/detail querysets to page__projects__id=project_id (defense in depth); distinct() on the list guards against active + soft-deleted ProjectPage duplicates. - Add contract regression tests (fail-before verified). Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8095] fix: require active ProjectPage link when scoping pages to a project Address CodeRabbit + Copilot review on #9380: projects__id=project_id matched even soft-deleted ProjectPage links, so a page removed from the project (link revoked) would still pass, and the version detail get() could raise MultipleObjectsReturned on active + soft-deleted rows. Put both conditions on the same project_pages relation in one filter so they match a single ProjectPage row that is active: project_pages__project_id=project_id + project_pages__deleted_at__isnull =True. The partial-unique constraint (project, page WHERE deleted_at IS NULL) then guarantees at most one row, so get() stays unambiguous and the list needs no distinct(). Add a revoked-link regression test. Co-authored-by: Plane AI <noreply@plane.so> * [WEB-8095] fix: distinct() on page-version detail lookup as a MultipleObjectsReturned guard Address CodeRabbit review on #9380. The active-link filter already keeps the page__project_pages join to a single row via the partial-unique constraint, but add distinct() to the detail get() as defense in depth so the join can never surface MultipleObjectsReturned (a 500) even if that invariant were ever violated. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
* [WEB-8074] fix: scope IssueListEndpoint to guest created_by IssueListEndpoint.get (/workspaces/<slug>/projects/<project_id>/issues/list/) returned any issue whose id was passed in ?issues=, without the guest created_by restriction its sibling IssueViewSet.list enforces. A project GUEST (role=5) on a project with guest_view_all_features=False could read issues they did not author by supplying their ids (GHSA-32c7-84jc-4w67). Replicate the guest scope: when the requester is an active role=5 ProjectMember and not project.guest_view_all_features, filter the queryset to created_by=request.user. Applied to the base queryset so it flows through filtering, annotation and grouping. Contract regression tests cover the restricted guest (own-only), a full member (sees all), and a guest with guest_view_all_features enabled (sees all); fail-before verified. Co-authored-by: Plane AI <noreply@plane.so> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Plane AI <noreply@plane.so> Co-authored-by: Dheeraj Kumar Ketireddy <dheeraj.ketireddy@plane.so> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
… modules (#9410) * feat: add lite list endpoints for projects, members, cycles, and modules * refactor: enhance order_by sanitization for cycle and module endpoints, update error handling for non-existent projects and workspaces
Bumps three dependencies flagged by Dependabot, closing all 7 open alerts: - axios 1.16.0 -> 1.18.1 (catalog), closing 5 alerts: GHSA-gcfj-64vw-6mp9 (high, inherited proxy after interceptor config clone), GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548, GHSA-xj6q-8x83-jv6g. Dependabot proposed 1.18.0; 1.18.1 is a pure bugfix release on top of it that also fixes runtime crashes and AxiosError circular-serialisation, so it is used instead. Supersedes PR #9447. - brace-expansion 5.0.6 -> 5.0.7 (override), closing GHSA-3jxr-9vmj-r5cp (high, DoS via exponential-time expansion of consecutive {} groups). - morgan -> 1.11.0 (new override), closing GHSA-4vj7-5mj6-jm8m (log forging via unneutralized control characters in :remote-user). Pulled in transitively by @react-router/serve. Verified: check:types 28/28, check:lint 16/16, build 16/16.
6 tasks
Prevent tab, newline, and other ASCII control characters from appearing in S3 object keys generated from user-provided upload filenames. Fixes #9127 Co-authored-by: Cursor <cursoragent@cursor.com>
…ject_id (regression from #9288) (#9495) * [SECUR-242] fix(api): scope bulk-asset associate by uploader, not project_id Regression from #9288 (WEB-7776, cross-project IDOR scoping): adding project_id=project_id to ProjectBulkAssetEndpoint.post broke project creation — the "enable features" step 404s because the freshly-uploaded cover/feature asset still has project_id=NULL (this endpoint is what sets it). master had no such filter. Scope the lookup by created_by=request.user instead. This still closes the IDOR (#9288) — a caller can only touch assets they uploaded, and @allow_permission already scopes them to the project — and is stricter than the original master code (which had no ownership check), while allowing not-yet-associated assets to be linked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [SECUR-242] fix: bound bulk-asset associate to unassociated-or-same-project (CodeRabbit) Address CodeRabbit: created_by alone let a user move their own asset from another project into this one via the PROJECT_COVER/ISSUE_DESCRIPTION update branches. Add an unassociated-or-same-project bound (project_id=project_id OR project_id IS NULL) alongside created_by, so freshly-uploaded (NULL) assets still link but cross-project moves are rejected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mguptahub
approved these changes
Jul 29, 2026
6 tasks
* chore: update apps/live code owner to @Prashant-Surya * chore: set apps/live code owner to @saivallampati * chore: remove departed owner @lifeiscontent from ox configs
…iles (#9490) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
sriramveeraghanta
force-pushed
the
canary
branch
from
July 29, 2026 14:15
ff4bf5d to
cd82da1
Compare
* chore(api): upgrade Django 4.2 → 5.2 and bump Django ecosystem deps Upgrade Django 4.2.30 LTS → 5.2.15 LTS and bump all Django-coupled dependencies to versions that officially support 5.2 (DRF 3.17.1, channels 4.3.2, django-cors-headers 4.9.0, django-filter 25.2, django-storages 1.14.6, django-redis 7.0.0, celery 5.5.3, django-celery-beat 2.9.0, django-celery-results 2.6.0, drf-spectacular 0.29.0, scout-apm 3.5.3, psycopg 3.3.4, whitenoise 6.12.0, django-debug-toolbar 6.0.0, pytest-django 4.12.0). OpenTelemetry set, django-crum and pytz held (already 5.2-compatible). Code changes the upgrade required: - urls.py: gate the debug-toolbar URL include on apps.is_installed(), since django-debug-toolbar 6.0 ships a model that errors when the app isn't in INSTALLED_APPS (test settings run DEBUG=True but don't install it). - migration 0122: state-only AlterField for three M2M fields using through_fields (Django 5.1 deconstruction normalization); sqlmigrate is a no-op, zero DB impact. - test_authentication.py: module-level autouse cache.clear() fixture to fix 8 pre-existing throttle test-isolation failures (identical on the 4.2 baseline) so the suite is green. Verified on python:3.12-alpine + Postgres 15.7: check clean, makemigrations --check clean, full migrate applies, pytest 393 passed. Adds the migration plan/audit write-up under apps/api/docs/. * fix(api): scope auth test cache reset to throttle keys only The module-wide _reset_auth_throttle_cache fixture called cache.clear(), wiping the entire shared Redis cache between tests. Replace it with targeted deletion of throttle_authentication_* keys (DRF SimpleRateThrottle history for AuthenticationThrottle) via cache.delete_pattern, keeping the same before/after cleanup.
- adapter/oauth.py: stop logging request headers on user-info fetch failure; they carry the Bearer access token (py/clear-text-logging-sensitive-data) - adapter/base.py: drop the email value from the invalid-email warning log (py/clear-text-logging-sensitive-data) - provider/oauth/github.py: stop logging organization id / user login on org-membership failure (py/clear-text-logging-sensitive-data) - editor custom-link: rewrite the C0-control strip regex with escaped, non-overlapping ranges instead of raw control bytes overlapping \s (js/overly-large-range); also fixes the file being detected as binary
* fix: resolve React Doctor errors and restore its PR baseline The React Doctor check on PR #9160 reported 266 issues across 130 files. Most of that is a reporting artifact: the workflow's `actions/checkout` step used the default shallow clone, so React Doctor had no merge base to diff against and fell back to listing every pre-existing issue in every changed file rather than only what the PR introduced. Add `fetch-depth: 0` so the comparison works. Also point the `push` trigger at `preview` — the repo's default branch — instead of `main`, which does not exist here, so the health-score trend never ran. Fix the 7 genuine errors it surfaced: - use-keypress: `callback` sat in the effect deps while every one of the 10 call sites passes an inline arrow, so the document listener was torn down and re-added on every render. Latch the callback in a ref and key the subscription on `key` alone. This clears `no-effect-with-fresh-deps` at create-root.tsx:102 and create-project-modal.tsx:64 at the source. - estimates/points/preview: the dblclick listener was added with no cleanup, so listeners accumulated on every toggle. Add the matching removeEventListener. - issues/header, calendar/issue-block, pages/editor/editor-body: guard `window` reads that run during render with `typeof window !== "undefined"`, matching the pattern already used elsewhere in web and admin. The editor case previously relied on the surrounding try/catch swallowing a ReferenceError on the server. Also clears the five pre-existing oxlint warnings in calendar/issue-block that the repo's `--deny-warnings` pre-commit gate blocks on once the file is touched: rename a shadowed `issue` parameter, and mark two presentational wrapper divs with `role="presentation"` — CustomMenu already wraps the first in a real <button>, and the second exists only to stop click propagation to the surrounding ControlLink. Verified: `turbo run check:types --filter=web` passes (11/11 tasks), `oxlint --deny-warnings` reports 0 warnings and 0 errors on the changed files. Claude-Session: https://claude.ai/code/session_01Hrr1nfNBiyC256drHM8BbT * fix: import EditorAIMenu directly instead of through the ai barrel The only issue React Doctor reports against this branch. `./ai` re-exports both menu.tsx and ask-pi-menu.tsx, so importing through it pulls the ask-pi menu into the page editor bundle for a symbol that lives in menu.tsx. Pre-existing on preview rather than introduced here, but it is a one-line fix in a file this branch already touches. Claude-Session: https://claude.ai/code/session_01Hrr1nfNBiyC256drHM8BbT * fix: address CodeRabbit review on the React Doctor branch - react-doctor.yml: set persist-credentials: false on checkout. The token otherwise stays in .git/config for the third-party millionco/react-doctor step that runs next. fetch-depth: 0 has already fetched every ref the merge-base diff needs, and the action authenticates to the API through its own credentials, so nothing depends on the persisted git credential. - calendar/issue-block: pass workspaceSlug?.toString() to handleRedirection. The param is typed string | undefined and line 89 of the same file already optional-chains it; this call site would have thrown on a missing route param. Pre-existing, but it is on a line this branch already touches. Declined the two SSR/hydration findings: apps/web sets ssr: false in react-router.config.ts and ships a client-only bundle, so there is no server render to diverge from. The typeof window guards satisfy the React Doctor rule but are defensive only. Claude-Session: https://claude.ai/code/session_01Hrr1nfNBiyC256drHM8BbT
…9513) Bug 5: filtering the work item list by a creation/update date returned an empty list. created_at and updated_at are DateTimeFields, but the UI sends a bare calendar date, and the filterset only exposed `exact` and `range` lookups: - {"created_at__exact": "2026-07-30"} was coerced to 2026-07-30 00:00:00, so it matched only rows stamped exactly midnight — effectively never. - {"created_at__range": "2026-07-28,2026-07-30"} capped the upper bound at 2026-07-30 00:00:00, silently dropping everything created during that final day (the range only "worked" if you overshot the end date by one day). Compare the date component instead (`date` / `date__range` via a CSV-parsing DateCSVRangeFilter), so a calendar date means the whole day and both range bounds are inclusive. The UI's existing query format is unchanged. Verified against a local canary build: the exact requests from the bug report now return 4 and 4 (previously 0 and 0). Adds unit coverage; 6 of the 7 new tests fail without this change. Note: `__date` is evaluated in the active timezone, which TimezoneMixin takes from the user's profile (user_timezone) rather than the browser's timezone, so a profile/browser timezone mismatch can still shift results by a day. Tracked separately — not addressed here. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…RL concatenation (#9512)
…eated_at (#9514) filter_updated_at() passed `created_at__date` as the date term in both its GET and POST branches, so filtering by "Updated At" actually filtered on the creation date. Work items updated today but created earlier never appeared under "Updated At -> is -> today", and the two filters returned identical result sets. Re-raise of community PR #9323 by @sanjibani, which is approved-ready but cannot merge because the CLA is unsigned. Original patch and tests carried over unchanged apart from the two fixes below; credit for the fix is theirs. Adjustments made while porting: - test_get_method_targets_updated_at_column asserted the exact key "updated_at__date", but date_filter's single-value branch appends a lookup suffix ("updated_at__date__contains"), so the assertion always failed. Match on the key prefix instead. - Added the missing trailing newline to the new test file. Verified on a local canary build: with one work item created 2020-01-01 but updated today, `?updated_at=2026-07-01;after` now returns 5 while `?created_at=2026-07-01;after` returns 4 — previously both returned 4. Unit tests pass (5); 4 of the 5 fail without the source change. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| is_pinned: preference?.is_pinned ?? false, | ||
| }; | ||
| return ( | ||
| WORKSPACE_SIDEBAR_DYNAMIC_NAVIGATION_ITEMS_LINKS.filter((item) => { |
There was a problem hiding this comment.
React Doctor · react-doctor/js-combine-iterations (warning)
This loops over your list twice because .filter().map() makes two passes, so do it in one pass with .reduce() or a for...of loop
Fix → Combine .map().filter() style chains into one pass with .reduce() or a for...of loop, so you only loop over the list once
| import type { PageProps } from "@react-pdf/renderer"; | ||
| import { Document, Font, Page } from "@react-pdf/renderer"; | ||
| import type { PageProps, Styles } from "@react-pdf/renderer"; | ||
| import { Document, Font, Page, StyleSheet } from "@react-pdf/renderer"; |
There was a problem hiding this comment.
React Doctor · react-doctor/prefer-dynamic-import (warning)
"@react-pdf/renderer" ships extra code to your users up front & slows page load. Load it on demand with React.lazy() or next/dynamic.
Fix → Load it only when needed: const Component = dynamic(() => import('library'), { ssr: false }) from next/dynamic, or React.lazy().
| import { GanttChartBlocksList } from "@/components/gantt-chart/blocks/blocks-list"; | ||
| import { IssueBulkOperationsRoot } from "@/components/issues/bulk-operations"; | ||
| import { useBulkOperationStatus } from "@/hooks/use-bulk-operation-status"; | ||
| // local imports | ||
| import { DEFAULT_BLOCK_WIDTH, GANTT_SELECT_GROUP, HEADER_HEIGHT } from "../constants"; | ||
| import { getItemPositionWidth } from "../views"; |
There was a problem hiding this comment.
React Doctor · react-doctor/no-barrel-import (warning)
This ships extra code to your users & slows page load. Import directly from "../views/helpers".
Fix → Import from the direct path: import { Button } from './components/Button' instead of ./components
| @@ -18,8 +18,6 @@ import { SimpleEmptyState } from "@/components/empty-state/simple-empty-state-ro | |||
| // hooks | |||
| import { useHome } from "@/hooks/store/use-home"; | |||
| import { useProject } from "@/hooks/store/use-project"; | |||
| // plane web components | |||
| import { HomePageHeader } from "@/plane-web/components/home/header"; | |||
| // local imports | |||
| import { StickiesWidget } from "../stickies/widget"; | |||
| import { HomeLoader, NoProjectsEmptyState, RecentActivityWidget } from "./widgets"; | |||
There was a problem hiding this comment.
React Doctor · react-doctor/no-barrel-import (warning)
This ships extra code to your users & slows page load. Import directly from: "./widgets/loaders/home-loader", "./widgets/empty-states/no-projects", "./widgets/recents".
Fix → Import from the direct path: import { Button } from './components/Button' instead of ./components
| @@ -10,8 +10,6 @@ import { useTranslation } from "@plane/i18n"; | |||
| import { LinkIcon, ViewsIcon, RelationPropertyIcon } from "@plane/propel/icons"; | |||
| // plane imports | |||
| import type { TIssueServiceType, TWorkItemWidgets } from "@plane/types"; | |||
| // plane web imports | |||
| import { WorkItemAdditionalWidgetActionButtons } from "@/plane-web/components/issues/issue-detail-widgets/action-buttons"; | |||
| // local imports | |||
| import { IssueAttachmentActionButton } from "./attachments"; | |||
There was a problem hiding this comment.
React Doctor · react-doctor/no-barrel-import (warning)
This ships extra code to your users & slows page load. Import directly from "./attachments/quick-action-button".
Fix → Import from the direct path: import { Button } from './components/Button' instead of ./components
| @@ -57,12 +57,14 @@ export function TourSidebar({ step, setStep }: Props) { | |||
| </h3> | |||
| <div className="mt-8 space-y-5"> | |||
| {sidebarOptions.map((option) => ( | |||
| // oxlint-disable-next-line jsx_a11y/click-events-have-key-events | |||
| <h5 | |||
There was a problem hiding this comment.
React Doctor · react-doctor/click-events-have-key-events (warning)
Keyboard users can't trigger this click handler because there's no keyboard one, so add onKeyUp, onKeyDown, or onKeyPress.
Fix → Pair onClick with a key handler so keyboard users can trigger it.
| import { WORKSPACE_ESTIMATES, WORKSPACE_CYCLES, WORKSPACE_LABELS, WORKSPACE_MODULES } from "@/constants/fetch-keys"; | ||
| import { useWorkspaceIssuePropertiesExtended } from "@/plane-web/hooks/use-workspace-issue-properties-extended"; | ||
| import { WORKSPACE_ESTIMATES, WORKSPACE_CYCLES, WORKSPACE_LABELS, WORKSPACE_MODULES } from "@plane/constants"; | ||
| import { useWorkspaceIssuePropertiesExtended } from "@/hooks/use-workspace-issue-properties-extended"; | ||
| // plane imports | ||
| import { useProjectEstimates } from "./store/estimates"; |
There was a problem hiding this comment.
React Doctor · react-doctor/no-barrel-import (warning)
This ships extra code to your users & slows page load. Import directly from "./store/estimates/use-project-estimate".
Fix → Import from the direct path: import { Button } from './components/Button' instead of ./components
| @@ -126,6 +126,7 @@ export class StateStore implements IStateStore { | |||
| // Ensure all STATE_GROUPS are present | |||
| const allGroups = Object.keys(STATE_GROUPS).reduce( | |||
| (acc, group) => ({ | |||
There was a problem hiding this comment.
React Doctor · react-doctor/no-spread-accumulator-in-reduce (warning)
This is O(n²) because spreading the accumulator copies the entire growing collection every step. Mutate and return the accumulator instead (acc[key] = value; return acc).
Fix → Mutate the accumulator and return it (acc[key] = value; return acc) so the fold stays O(n) instead of copying the whole accumulator every step.
|
|
||
| export function listLocales(): string[] { | ||
| const entries = fs.readdirSync(LOCALES_DIR, { withFileTypes: true }); | ||
| return entries |
There was a problem hiding this comment.
React Doctor · react-doctor/js-combine-iterations (warning)
This loops over your list twice because .filter().map() makes two passes, so do it in one pass with .reduce() or a for...of loop
Fix → Combine .map().filter() style chains into one pass with .reduce() or a for...of loop, so you only loop over the list once
|
|
||
| import React, { useEffect, useState } from "react"; | ||
| import { I18nextProvider } from "react-i18next"; | ||
| import { i18nInstance, initPromise } from "../core"; |
There was a problem hiding this comment.
React Doctor · react-doctor/no-barrel-import (warning)
This ships extra code to your users & slows page load. Import directly from "../core/instance".
Fix → Import from the direct path: import { Button } from './components/Button' instead of ./components
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ Features
Lite List Endpoints in the REST API
New lightweight list endpoints for projects, members, cycles, and modules return trimmed payloads built for pickers, dropdowns, and sync jobs that only need identifiers and display fields. They avoid the cost of the full list responses when you are populating a selector or mirroring structure into an external system, and they carry the same
order_bysanitization and scoping guarantees as the full endpoints.Feature-Namespaced Translations
The internationalization package now runs on
react-i18nextwith translations stored as per-feature JSON namespaces (workspace, project, work item, cycle, intake, and more) instead of a single monolithic TypeScript file. Translators and contributors can work on one feature area at a time across all 19 supported languages, and the public translation API is unchanged, so no consumer code needed to move.⬆️ Enhancements
workspace_slug, so receivers can route events without an extra lookup.X-Forwarded-Forheader, so rate limiting and request logs see the real client IP instead of the proxy's.🐞 Bug fixes
completed_attimestamp on work items being recalculated incorrectly; it is now a read-only field.requestIdleCallbackAPI; a fallback scheduler now handles idle work.VOLUMEdeclaration.🛡️ Security
This release closes a large batch of coordinated security advisories. Self-hosted instances should upgrade.
Access control and tenant isolation
Authentication and invitations
Injection and content safety
nh3on both the app and API layers, closing stored XSS (GHSA-6qrq-f73q-r67j, GHSA-j9pv-f5wm-p4g2, GHSA-hh2r-3hwp-mvq3).javascript:URLs can no longer slip through (GHSA-v2vv-7wq3-8w2j).order_by,group_by, andsub_group_byquery parameters across work item, project, view, activity, and notification endpoints — including the unauthenticated public board — closing an ordering oracle over sensitive columns and unhandled 500s (GHSA-wwgj-929g-42cm).=are no longer written as live formulas, matching the existing CSV protection.Secrets and deployment
SECRET_KEYandLIVE_SERVER_SECRET_KEYfrom the all-in-one and CLI deployment manifests; a random key is now generated on first boot and persisted across restarts, including on upgrade from the old default (GHSA-cmwv-pjmw-8483).Dependency upgrades
axiosto 1.18.1, closing GHSA-gcfj-64vw-6mp9, GHSA-hcpx-6fm6-wx23, GHSA-mwf2-3pr3-8698, GHSA-f4gw-2p7v-4548, and GHSA-xj6q-8x83-jv6g.react-routerto 7.15.1, closing GHSA-8x6r-g9mw-2r78, GHSA-49rj-9fvp-4h2h, GHSA-8646-j5j9-6r62, GHSA-2j2x-hqr9-3h42, and GHSA-f22v-gfqf-p8f3.esbuildto 0.28.1 to add binary-integrity verification, closing an RCE path in the Deno install flow (GHSA-gv7w-rqvm-qjhr).vitestto 4.1.x (GHSA-5xrq-8626-4rwp),undicito 7.28.0 (GHSA-vmh5-mc38-953g and six related advisories), andbrace-expansionto 5.0.7 (GHSA-3jxr-9vmj-r5cp).ws,qs,tmp,vite, andpostcssto their patched releases, and refreshed the Python dependenciescryptographyandpyjwt.