AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,186 Commits 1 Branch 0 Tags
35f14b479c60b834bb1e23b6802fc9bc1efa67a9
Commit Graph
1186 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel Hiller ebb9d6879e ci: Align workflows with Node 24 2026-08-07 16:36:02 +02:00
Daniel Hiller 3a9eea3020 ci: Drop armv7 from Docker image builds 2026-08-07 16:30:19 +02:00
Daniel Hiller bec5dd1597 chore: Update dependencies 
Bump Node to 24 in Dockerfile and Dockerfile.dev.
Bump sharp to 0.35, nodemailer to 9 and concurrently to 10.
Add overrides for body-parser, qs, multiparty, uuid, diff,
serialize-javascript, linkify-it and svgo to pull in security fixes
that upstream pins block.
Rename the sails patch to match 1.5.18.
 2026-08-07 16:17:24 +02:00
Ayman 9443b85517 fix: Show error messages on invalid password edit 2026-07-10 20:38:08 +01:00
Ayman 180807a0ec fix: Show error messages on invalid form inputs 2026-07-10 20:14:21 +01:00
Ayman c587a1441d fix: Add password validation for admin user seeding process 2026-07-08 08:05:00 +01:00
Ayman aeb3456091 refactor: Replace while true with flag based validation 2026-07-08 07:42:04 +01:00
Ayman 2f5252faad fix: Add email uniqueness check to admin user seeding process 2026-07-08 07:17:39 +01:00
Ayman 7fbc2ea737 fix: Add username uniqueness check to admin user seeding 2026-07-08 07:17:32 +01:00
Ayman 0a2641db84 fix: Add email validation to admin user seeding process 2026-07-08 07:17:26 +01:00
Ayman 062cc3c347 fix: Add name length validation to admin user seeding process 2026-07-08 07:17:14 +01:00
Ayman 1d523cdab5 fix: Add username validation to admin user seeding process 2026-07-08 07:17:05 +01:00
babu-ch 9f18028337 fix: Ignore Enter pressed during IME composition in input fields 
Closes #1703
 2026-07-03 20:54:52 +09:00
crmarisandClaude Fable 5 8615accb66 fix: Fix task reordering when completed tasks are hidden 
The index produced by drag-and-drop refers to the rendered task list,
which excludes completed tasks when hideCompletedTasks is enabled, but
selectNextTaskPosition resolved that index against the unfiltered task
array, computing positions between the wrong (often hidden) neighbors.

Lift the completed-tasks visibility state up to TaskLists so the drag
end handler can pass it through the move action, and apply the same
filter in selectNextTaskPosition that the rendered list uses.

Fixes #1718

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 12:27:36 +03:00
Symon 4a70e995d3 feat: add tooltips for icon buttons 2026-06-07 18:06:04 +03:00
Symon 55d0e2f877 Add negative label filtering for cards 2026-06-05 16:43:45 +03:00
Daniel Hiller 856768c45e Merge pull request #1670 from plankanban/dependabot/npm_and_yarn/client/tmp-0.2.7 
build(deps): Bump tmp from 0.2.5 to 0.2.7 in /client
 2026-06-03 16:10:18 +02:00
Daniel Hiller 93f504e412 Merge pull request #1672 from plankanban/dependabot/npm_and_yarn/server/multi-8c9a216550 
build(deps): Bump ws, engine.io and socket.io-adapter in /server
 2026-06-03 16:09:32 +02:00
dependabot[bot] 8940a1dfa6 build(deps): Bump ws, engine.io and socket.io-adapter in /server 
Bumps [ws](https://github.com/websockets/ws), [engine.io](https://github.com/socketio/socket.io) and [socket.io-adapter](https://github.com/socketio/socket.io). These dependencies needed to be updated together.

Updates `ws` from 8.18.3 to 8.20.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.18.3...8.20.1)

Updates `engine.io` from 6.6.6 to 6.6.8
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/engine.io@6.6.6...engine.io@6.6.8)

Updates `socket.io-adapter` from 2.5.6 to 2.5.7
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io-adapter@2.5.6...socket.io-adapter@2.5.7)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.20.1
  dependency-type: indirect
- dependency-name: engine.io
  dependency-version: 6.6.8
  dependency-type: indirect
- dependency-name: socket.io-adapter
  dependency-version: 2.5.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-29 11:28:05 +00:00
dependabot[bot] 45119825f4 build(deps): Bump tmp from 0.2.5 to 0.2.7 in /client 
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/raszi/node-tmp/compare/v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-28 02:53:47 +00:00
Symon 05979a460f feat: filter webhooks per project, board, and account 
Adds optional project, board, and acting-user scope to each webhook so
events from a specific board or project can be routed to a single
endpoint without an external automation tool in the middle (closes
#1457).

A webhook now fires for an event only when every set scope matches:
empty scope still means "fire for everything", keeping existing
webhooks working unchanged. Scope filtering is centralized in the
sendWebhooks helper, which auto-derives projectId/boardId from the
event payload, so existing call sites are untouched.
 2026-05-02 10:31:30 +03:00
Symon 52edbcc2f8 feat: add operator config options for Apprise notifications (closes #1576) 
Adds three new environment variables that give instance operators control
over Apprise notification services, addressing GDPR and compliance concerns
around third-party data transfers.

## New environment variables

- APPRISE_ENABLED (default: true)
  Set to "false" to globally prevent users from creating Apprise notification
  services and to silently skip sending any Apprise notifications. Existing
  services in the database are preserved but not used while disabled.

- APPRISE_ALLOWED_SCHEMAS (default: empty — no restriction)
  Comma-separated allowlist of Apprise URL schemas (e.g. "slack,tgram").
  When set, only services whose URL schema appears in this list can be
  created or will be sent. Takes priority over APPRISE_BLOCKED_SCHEMAS.
  Uses Apprise's internal schema names (e.g. "tgram" for Telegram).

- APPRISE_BLOCKED_SCHEMAS (default: empty — built-in list applies)
  Comma-separated blocklist of Apprise URL schemas (e.g. "discord,slack").
  When set, replaces the built-in blocked list entirely. When empty, the
  built-in list (syslog, dbus, kde, qt, glib, gnome, macosx, windows)
  continues to apply as a fallback.

## Enforcement

Validation happens at two layers:

1. API layer (create endpoints for user and board notification services)
   Returns HTTP 403 when Apprise is disabled, HTTP 422 when the URL schema
   is not permitted. This gives users immediate feedback in the UI.

2. Python send layer (send_notifications.py)
   The schema config is passed as a JSON argument so the same allow/block
   rules apply at send time, guarding against services that were created
   before the config was tightened.

## Files changed

- server/config/custom.js — parse new env vars via existing envToArray helper
- server/utils/send_notifications.py — accept schemaConfig as argv[4]; replace
  hard-coded BLOCKED_SCHEMAS_SET with dynamic allowed/blocked resolution
- server/api/helpers/utils/send-notifications.js — short-circuit when disabled;
  pass schemaConfig JSON to the Python script
- server/api/helpers/notification-services/create-one-in-{user,board}.js — add
  appriseDisabled and schemaNotAllowed exits with schema validation logic
- server/api/controllers/notification-services/create-in-{user,board}.js — wire
  new exits to forbidden (403) and unprocessableEntity (422) responses
- server/.env.sample — document all three new variables with comments
 2026-04-26 23:44:52 +03:00
Daniel Hiller a8dcd7cef3 chore: Remove global npm update step from build workflow 2026-04-18 15:23:53 +00:00
Daniel Hiller 6e2e6539d1 chore: Update what's new documentation 2026-04-18 15:19:56 +00:00
Daniel Hiller e429b478ca chore: Bump version to 2.1.1 and update release notes 2026-04-18 15:10:14 +00:00
Daniel Hiller 0e5dedd627 Merge pull request #1638 from plankanban/dependabot/npm_and_yarn/server/multi-e6e4b50ff7 
build(deps): Bump underscore and @sailshq/nedb in /server
 2026-04-18 16:23:01 +02:00
Daniel Hiller eb90b12b0e Merge pull request #1637 from plankanban/dependabot/npm_and_yarn/server/multi-c857c64966 
build(deps): Bump path-to-regexp and @sailshq/router in /server
 2026-04-18 16:22:59 +02:00
Daniel Hiller cd9ba8ff4f feat: Add Pro features discovery banner 
Adds a dismissible banner in the topbar that informs users about
PLANKA Pro features.

- Dismissible per-user (stored in localStorage)
- Reappears after 30 days
- Rotates between main message and 3 feature highlights
- Links to planka.app/pro (with ref parameter for anonymous source attribution)
 2026-04-18 13:32:22 +00:00
Daniel Hiller 4e23f3c8a9 refactor(docker): Remove global npm installation from Dockerfiles 2026-04-18 13:32:22 +00:00
dependabot[bot] a9f28b45f4 build(deps): Bump underscore and @sailshq/nedb in /server 
Bumps [underscore](https://github.com/jashkenas/underscore) and [@sailshq/nedb](https://github.com/sailshq/nedb). These dependencies needed to be updated together.

Updates `underscore` from 1.13.1 to 1.13.8
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.8)

Updates `@sailshq/nedb` from 1.8.3 to 1.8.4
- [Commits](https://github.com/sailshq/nedb/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: indirect
- dependency-name: "@sailshq/nedb"
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:29:02 +00:00
dependabot[bot] d44e0dde93 build(deps): Bump path-to-regexp and @sailshq/router in /server 
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [@sailshq/router](https://github.com/sailshq/router). These dependencies needed to be updated together.

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

Updates `@sailshq/router` from 1.3.10 to 1.3.11
- [Changelog](https://github.com/sailshq/router/blob/master/HISTORY.md)
- [Commits](https://github.com/sailshq/router/compare/v1.3.10...v1.3.11)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: "@sailshq/router"
  dependency-version: 1.3.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:28:46 +00:00
Daniel Hiller 20eb57de4c Merge pull request #1635 from HannesOberreiter/fix/unicode-initials 
fix: unicode/emoji characters in user avatar initials
 2026-04-18 15:28:06 +02:00
Daniel Hiller 4ccc71419f Merge pull request #1551 from plankanban/dependabot/npm_and_yarn/client/multi-5543462fab 
build(deps): Bump bn.js in /client
 2026-04-18 15:28:04 +02:00
Daniel Hiller 0e93111e1b Merge pull request #1612 from plankanban/dependabot/npm_and_yarn/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3
 2026-04-18 15:28:02 +02:00
Daniel Hiller 11f7814e87 Merge pull request #1611 from plankanban/dependabot/npm_and_yarn/client/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /client
 2026-04-18 15:27:59 +02:00
Daniel Hiller 9a4241e3d1 Merge pull request #1610 from plankanban/dependabot/npm_and_yarn/server/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server
 2026-04-18 15:27:57 +02:00
Daniel Hiller 4fd164c81a Merge pull request #1627 from plankanban/dependabot/npm_and_yarn/client/vite-7.3.2 
build(deps): Bump vite from 7.3.1 to 7.3.2 in /client
 2026-04-18 15:27:55 +02:00
Daniel Hiller 5331f590a2 Merge pull request #1617 from plankanban/dependabot/npm_and_yarn/server/brace-expansion-1.1.13 
build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server
 2026-04-18 15:27:52 +02:00
Daniel Hiller 082b257a50 Merge pull request #1628 from plankanban/dependabot/npm_and_yarn/brace-expansion-2.0.3 
build(deps): Bump brace-expansion from 2.0.2 to 2.0.3
 2026-04-18 15:27:50 +02:00
Daniel Hiller fd0981b5b3 Merge pull request #1624 from plankanban/dependabot/npm_and_yarn/client/lodash-es-4.18.1 
build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:48 +02:00
Daniel Hiller 9b68d3fc30 Merge pull request #1630 from plankanban/dependabot/npm_and_yarn/client/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:46 +02:00
Daniel Hiller 922d70e289 Merge pull request #1629 from plankanban/dependabot/npm_and_yarn/server/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server
 2026-04-18 15:27:43 +02:00
Daniel Hiller 40a3e436ad Merge pull request #1608 from plankanban/dependabot/npm_and_yarn/server/picomatch-2.3.2 
build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server
 2026-04-18 15:27:22 +02:00
Daniel Hiller 227332768c Merge pull request #1607 from plankanban/dependabot/npm_and_yarn/client/picomatch-2.3.2 
build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /client
 2026-04-18 15:27:19 +02:00
Daniel Hiller 555117912c Merge pull request #1631 from plankanban/dependabot/npm_and_yarn/server/nodemailer-8.0.5 
build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server
 2026-04-18 15:27:11 +02:00
Daniel Hiller 9ba5f86073 Merge pull request #1632 from plankanban/dependabot/npm_and_yarn/server/multi-d854bddb60 
build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server
 2026-04-18 15:27:09 +02:00
HannesOberreiter 3bf6e6fa19 fix: allow unicodes in initials 2026-04-16 14:21:13 +02:00
dependabot[bot] 8cc00ef2ef build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.11 to 3.972.17
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-09 00:26:02 +00:00
dependabot[bot] 3d3c8f374c build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 8.0.5.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.13...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 22:42:51 +00:00
dependabot[bot] 7a3873cbeb build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:29:03 +00:00