opensource/planka
3
0
Fork 0
mirror of https://github.com/plankanban/planka.git synced 2026-08-28 10:00:39 +08:00
Code Issues Packages Projects Releases Wiki Activity
1,129 Commits 2 Branches 63 Tags
master
Commit Graph

1129 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Hiller 266246e242 chore: Update version v2.2.1 2026-08-10 18:28:48 +02:00
Daniel Hiller bd487e3f9f fix: Prevent path traversal in local file manager 
The local file manager joined attacker-controlled path segments into the
uploads storage path without ensuring the result stayed under the uploads
root. Any authenticated user could read arbitrary files readable by the
Planka process (e.g. /etc/passwd, /app/.env) via `../` sequences on the
/user-avatars/*, /background-images/* and /favicons/* routes (CWE-22).

Resolve the path and enforce it stays within uploadsBasePath, centrally in
buildPath so every local file operation is covered. Additionally resolve
symlinks in read() and re-check containment, so a symlink inside the root
cannot be used to escape it.

Reported by Alpesh (github.com/Alpastx).
 2026-08-10 03:00:29 +02:00
Daniel Hiller 2684198bf8 chore: Update version planka-2.2.0 v2.2.0 2026-08-09 22:36:27 +02:00
Daniel Hiller 3ef87a8603 feat: Add configurable auto logout on inactivity 
Users can pick an inactivity timeout in their preferences. A warning
appears 30 seconds before, and activity or a logout is synchronised
across open tabs.
 2026-08-08 00:24:16 +02:00
Daniel Hiller a9d0c228df feat: Replace user edit popups with a single modal 
Editing a user now opens a modal with an information tab and an API
key tab instead of a chain of popups. The user name in the list opens
it, and the admin two-factor reset moves in as well.
 2026-08-08 00:16:35 +02:00
Daniel Hiller a6f6af8a6c fix: Replace Pro theme tokens with literal colors 
The two-factor stylesheets were carried over from the Pro edition and
referenced CSS custom properties from its theme system, which this
edition does not define. They silently fell back to browser defaults.
 2026-08-08 00:15:34 +02:00
Daniel Hiller 2e4904f77d feat: Add two-factor authentication via TOTP 
Adds TOTP setup with QR code, login challenge, recovery codes and
trusted devices that let a browser skip the second factor for 30
days. Admins can reset another user's second factor by confirming
with their own password.
 2026-08-07 20:11:55 +02:00
Daniel Hiller 36aa732fec feat: Remove OIDC and SSO support 
Existing SSO accounts have no local password, so the migration
deactivates them before dropping is_sso_user and the
identity_provider_user table.
 2026-08-07 19:15:43 +02:00
Daniel Hiller a1f0a2b3fa chore: Update dependencies 2026-08-07 16:45:51 +02:00
Daniel Hiller ebb9d6879e ci: Align workflows with Node 24 2026-08-07 16:36:02 +02:00
Daniel Hiller 3a9eea3020 ci: Drop armv7 from Docker image builds 2026-08-07 16:30:19 +02:00
Daniel Hiller bec5dd1597 chore: Update dependencies 
Bump Node to 24 in Dockerfile and Dockerfile.dev.
Bump sharp to 0.35, nodemailer to 9 and concurrently to 10.
Add overrides for body-parser, qs, multiparty, uuid, diff,
serialize-javascript, linkify-it and svgo to pull in security fixes
that upstream pins block.
Rename the sails patch to match 1.5.18.
 2026-08-07 16:17:24 +02:00
Daniel Hiller 856768c45e Merge pull request #1670 from plankanban/dependabot/npm_and_yarn/client/tmp-0.2.7 
build(deps): Bump tmp from 0.2.5 to 0.2.7 in /client
 2026-06-03 16:10:18 +02:00
Daniel Hiller 93f504e412 Merge pull request #1672 from plankanban/dependabot/npm_and_yarn/server/multi-8c9a216550 
build(deps): Bump ws, engine.io and socket.io-adapter in /server
 2026-06-03 16:09:32 +02:00
dependabot[bot] 8940a1dfa6 build(deps): Bump ws, engine.io and socket.io-adapter in /server 
Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together.

Updates `ws` from 8.18.3 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.20.1)

Updates `engine.io` from 6.6.6 to 6.6.8
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.6...engine.io@6.6.8)

Updates `socket.io-adapter` from 2.5.6 to 2.5.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.6...socket.io-adapter@2.5.7)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
- dependency-name: engine.io
  dependency-version: 6.6.8
  dependency-type: indirect
- dependency-name: socket.io-adapter
  dependency-version: 2.5.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 11:28:05 +00:00
dependabot[bot] 45119825f4 build(deps): Bump tmp from 0.2.5 to 0.2.7 in /client 
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-28 02:53:47 +00:00
Daniel Hiller a8dcd7cef3 chore: Remove global npm update step from build workflow 2.1.1 2026-04-18 15:23:53 +00:00
Daniel Hiller 6e2e6539d1 chore: Update what's new documentation 2026-04-18 15:19:56 +00:00
Daniel Hiller e429b478ca chore: Bump version to 2.1.1 and update release notes 2026-04-18 15:10:14 +00:00
Daniel Hiller 0e5dedd627 Merge pull request #1638 from plankanban/dependabot/npm_and_yarn/server/multi-e6e4b50ff7 
build(deps): Bump underscore and @sailshq/nedb in /server
 2026-04-18 16:23:01 +02:00
Daniel Hiller eb90b12b0e Merge pull request #1637 from plankanban/dependabot/npm_and_yarn/server/multi-c857c64966 
build(deps): Bump path-to-regexp and @sailshq/router in /server
 2026-04-18 16:22:59 +02:00
Daniel Hiller cd9ba8ff4f feat: Add Pro features discovery banner 
Adds a dismissible banner in the topbar that informs users about
PLANKA Pro features.

- Dismissible per-user (stored in localStorage)
- Reappears after 30 days
- Rotates between main message and 3 feature highlights
- Links to planka.app/pro (with ref parameter for anonymous source attribution)
 2026-04-18 13:32:22 +00:00
Daniel Hiller 4e23f3c8a9 refactor(docker): Remove global npm installation from Dockerfiles 2026-04-18 13:32:22 +00:00
dependabot[bot] a9f28b45f4 build(deps): Bump underscore and @sailshq/nedb in /server 
Bumps [underscore](https://github.com/jashkenas/underscore) and [@sailshq/nedb](https://github.com/sailshq/nedb). These dependencies needed to be updated together.

Updates `underscore` from 1.13.1 to 1.13.8
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.8)

Updates `@sailshq/nedb` from 1.8.3 to 1.8.4
- [Commits](https://github.com/sailshq/nedb/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: indirect
- dependency-name: "@sailshq/nedb"
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:29:02 +00:00
dependabot[bot] d44e0dde93 build(deps): Bump path-to-regexp and @sailshq/router in /server 
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [@sailshq/router](https://github.com/sailshq/router). These dependencies needed to be updated together.

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

Updates `@sailshq/router` from 1.3.10 to 1.3.11
- [Changelog](https://github.com/sailshq/router/blob/master/HISTORY.md)
- [Commits](https://github.com/sailshq/router/compare/v1.3.10...v1.3.11)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: "@sailshq/router"
  dependency-version: 1.3.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:28:46 +00:00
Daniel Hiller 20eb57de4c Merge pull request #1635 from HannesOberreiter/fix/unicode-initials 
fix: unicode/emoji characters in user avatar initials
 2026-04-18 15:28:06 +02:00
Daniel Hiller 4ccc71419f Merge pull request #1551 from plankanban/dependabot/npm_and_yarn/client/multi-5543462fab 
build(deps): Bump bn.js in /client
 2026-04-18 15:28:04 +02:00
Daniel Hiller 0e93111e1b Merge pull request #1612 from plankanban/dependabot/npm_and_yarn/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3
 2026-04-18 15:28:02 +02:00
Daniel Hiller 11f7814e87 Merge pull request #1611 from plankanban/dependabot/npm_and_yarn/client/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /client
 2026-04-18 15:27:59 +02:00
Daniel Hiller 9a4241e3d1 Merge pull request #1610 from plankanban/dependabot/npm_and_yarn/server/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server
 2026-04-18 15:27:57 +02:00
Daniel Hiller 4fd164c81a Merge pull request #1627 from plankanban/dependabot/npm_and_yarn/client/vite-7.3.2 
build(deps): Bump vite from 7.3.1 to 7.3.2 in /client
 2026-04-18 15:27:55 +02:00
Daniel Hiller 5331f590a2 Merge pull request #1617 from plankanban/dependabot/npm_and_yarn/server/brace-expansion-1.1.13 
build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server
 2026-04-18 15:27:52 +02:00
Daniel Hiller 082b257a50 Merge pull request #1628 from plankanban/dependabot/npm_and_yarn/brace-expansion-2.0.3 
build(deps): Bump brace-expansion from 2.0.2 to 2.0.3
 2026-04-18 15:27:50 +02:00
Daniel Hiller fd0981b5b3 Merge pull request #1624 from plankanban/dependabot/npm_and_yarn/client/lodash-es-4.18.1 
build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:48 +02:00
Daniel Hiller 9b68d3fc30 Merge pull request #1630 from plankanban/dependabot/npm_and_yarn/client/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:46 +02:00
Daniel Hiller 922d70e289 Merge pull request #1629 from plankanban/dependabot/npm_and_yarn/server/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server
 2026-04-18 15:27:43 +02:00
Daniel Hiller 40a3e436ad Merge pull request #1608 from plankanban/dependabot/npm_and_yarn/server/picomatch-2.3.2 
build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server
 2026-04-18 15:27:22 +02:00
Daniel Hiller 227332768c Merge pull request #1607 from plankanban/dependabot/npm_and_yarn/client/picomatch-2.3.2 
build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /client
 2026-04-18 15:27:19 +02:00
Daniel Hiller 555117912c Merge pull request #1631 from plankanban/dependabot/npm_and_yarn/server/nodemailer-8.0.5 
build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server
 2026-04-18 15:27:11 +02:00
Daniel Hiller 9ba5f86073 Merge pull request #1632 from plankanban/dependabot/npm_and_yarn/server/multi-d854bddb60 
build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server
 2026-04-18 15:27:09 +02:00
HannesOberreiter 3bf6e6fa19 fix: allow unicodes in initials 2026-04-16 14:21:13 +02:00
dependabot[bot] 8cc00ef2ef build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.11 to 3.972.17
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-09 00:26:02 +00:00
dependabot[bot] 3d3c8f374c build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 8.0.5.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.13...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 22:42:51 +00:00
dependabot[bot] 7a3873cbeb build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:29:03 +00:00
dependabot[bot] 512b69080d build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:21:34 +00:00
dependabot[bot] 5fa6fe825b build(deps): Bump brace-expansion from 2.0.2 to 2.0.3 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 06:15:56 +00:00
dependabot[bot] f61299fde8 build(deps): Bump vite from 7.3.1 to 7.3.2 in /client 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 7.3.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-06 21:38:57 +00:00
dependabot[bot] a55214e617 build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client 
Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-02 11:42:15 +00:00
Maksim Eltyshev dbad8e976b fix(s3): Add requestChecksumCalculation config option 
Closes #1619
 2026-04-01 22:12:58 +02:00
dependabot[bot] 3915536e72 build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 14:25:58 +00:00