AhmedTawfik/planka
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,114 Commits 1 Branch 0 Tags
52edbcc2f8c28fc71d5b1246644a1902886d5424
Commit Graph
1114 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Symon 52edbcc2f8 feat: add operator config options for Apprise notifications (closes #1576) 
Adds three new environment variables that give instance operators control
over Apprise notification services, addressing GDPR and compliance concerns
around third-party data transfers.

## New environment variables

- APPRISE_ENABLED (default: true)
  Set to "false" to globally prevent users from creating Apprise notification
  services and to silently skip sending any Apprise notifications. Existing
  services in the database are preserved but not used while disabled.

- APPRISE_ALLOWED_SCHEMAS (default: empty — no restriction)
  Comma-separated allowlist of Apprise URL schemas (e.g. "slack,tgram").
  When set, only services whose URL schema appears in this list can be
  created or will be sent. Takes priority over APPRISE_BLOCKED_SCHEMAS.
  Uses Apprise's internal schema names (e.g. "tgram" for Telegram).

- APPRISE_BLOCKED_SCHEMAS (default: empty — built-in list applies)
  Comma-separated blocklist of Apprise URL schemas (e.g. "discord,slack").
  When set, replaces the built-in blocked list entirely. When empty, the
  built-in list (syslog, dbus, kde, qt, glib, gnome, macosx, windows)
  continues to apply as a fallback.

## Enforcement

Validation happens at two layers:

1. API layer (create endpoints for user and board notification services)
   Returns HTTP 403 when Apprise is disabled, HTTP 422 when the URL schema
   is not permitted. This gives users immediate feedback in the UI.

2. Python send layer (send_notifications.py)
   The schema config is passed as a JSON argument so the same allow/block
   rules apply at send time, guarding against services that were created
   before the config was tightened.

## Files changed

- server/config/custom.js — parse new env vars via existing envToArray helper
- server/utils/send_notifications.py — accept schemaConfig as argv[4]; replace
  hard-coded BLOCKED_SCHEMAS_SET with dynamic allowed/blocked resolution
- server/api/helpers/utils/send-notifications.js — short-circuit when disabled;
  pass schemaConfig JSON to the Python script
- server/api/helpers/notification-services/create-one-in-{user,board}.js — add
  appriseDisabled and schemaNotAllowed exits with schema validation logic
- server/api/controllers/notification-services/create-in-{user,board}.js — wire
  new exits to forbidden (403) and unprocessableEntity (422) responses
- server/.env.sample — document all three new variables with comments
 2026-04-26 23:44:52 +03:00
Daniel Hiller a8dcd7cef3 chore: Remove global npm update step from build workflow 2026-04-18 15:23:53 +00:00
Daniel Hiller 6e2e6539d1 chore: Update what's new documentation 2026-04-18 15:19:56 +00:00
Daniel Hiller e429b478ca chore: Bump version to 2.1.1 and update release notes 2026-04-18 15:10:14 +00:00
Daniel Hiller 0e5dedd627 Merge pull request #1638 from plankanban/dependabot/npm_and_yarn/server/multi-e6e4b50ff7 
build(deps): Bump underscore and @sailshq/nedb in /server
 2026-04-18 16:23:01 +02:00
Daniel Hiller eb90b12b0e Merge pull request #1637 from plankanban/dependabot/npm_and_yarn/server/multi-c857c64966 
build(deps): Bump path-to-regexp and @sailshq/router in /server
 2026-04-18 16:22:59 +02:00
Daniel Hiller cd9ba8ff4f feat: Add Pro features discovery banner 
Adds a dismissible banner in the topbar that informs users about
PLANKA Pro features.

- Dismissible per-user (stored in localStorage)
- Reappears after 30 days
- Rotates between main message and 3 feature highlights
- Links to planka.app/pro (with ref parameter for anonymous source attribution)
 2026-04-18 13:32:22 +00:00
Daniel Hiller 4e23f3c8a9 refactor(docker): Remove global npm installation from Dockerfiles 2026-04-18 13:32:22 +00:00
dependabot[bot] a9f28b45f4 build(deps): Bump underscore and @sailshq/nedb in /server 
Bumps [underscore](https://github.com/jashkenas/underscore) and [@sailshq/nedb](https://github.com/sailshq/nedb). These dependencies needed to be updated together.

Updates `underscore` from 1.13.1 to 1.13.8
- [Commits](https://github.com/jashkenas/underscore/compare/1.13.1...1.13.8)

Updates `@sailshq/nedb` from 1.8.3 to 1.8.4
- [Commits](https://github.com/sailshq/nedb/compare/v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: underscore
  dependency-version: 1.13.8
  dependency-type: indirect
- dependency-name: "@sailshq/nedb"
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:29:02 +00:00
dependabot[bot] d44e0dde93 build(deps): Bump path-to-regexp and @sailshq/router in /server 
Bumps [path-to-regexp](https://github.com/pillarjs/path-to-regexp) and [@sailshq/router](https://github.com/sailshq/router). These dependencies needed to be updated together.

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13)

Updates `@sailshq/router` from 1.3.10 to 1.3.11
- [Changelog](https://github.com/sailshq/router/blob/master/HISTORY.md)
- [Commits](https://github.com/sailshq/router/compare/v1.3.10...v1.3.11)

---
updated-dependencies:
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
- dependency-name: "@sailshq/router"
  dependency-version: 1.3.11
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 13:28:46 +00:00
Daniel Hiller 20eb57de4c Merge pull request #1635 from HannesOberreiter/fix/unicode-initials 
fix: unicode/emoji characters in user avatar initials
 2026-04-18 15:28:06 +02:00
Daniel Hiller 4ccc71419f Merge pull request #1551 from plankanban/dependabot/npm_and_yarn/client/multi-5543462fab 
build(deps): Bump bn.js in /client
 2026-04-18 15:28:04 +02:00
Daniel Hiller 0e93111e1b Merge pull request #1612 from plankanban/dependabot/npm_and_yarn/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3
 2026-04-18 15:28:02 +02:00
Daniel Hiller 11f7814e87 Merge pull request #1611 from plankanban/dependabot/npm_and_yarn/client/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /client
 2026-04-18 15:27:59 +02:00
Daniel Hiller 9a4241e3d1 Merge pull request #1610 from plankanban/dependabot/npm_and_yarn/server/yaml-2.8.3 
build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server
 2026-04-18 15:27:57 +02:00
Daniel Hiller 4fd164c81a Merge pull request #1627 from plankanban/dependabot/npm_and_yarn/client/vite-7.3.2 
build(deps): Bump vite from 7.3.1 to 7.3.2 in /client
 2026-04-18 15:27:55 +02:00
Daniel Hiller 5331f590a2 Merge pull request #1617 from plankanban/dependabot/npm_and_yarn/server/brace-expansion-1.1.13 
build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server
 2026-04-18 15:27:52 +02:00
Daniel Hiller 082b257a50 Merge pull request #1628 from plankanban/dependabot/npm_and_yarn/brace-expansion-2.0.3 
build(deps): Bump brace-expansion from 2.0.2 to 2.0.3
 2026-04-18 15:27:50 +02:00
Daniel Hiller fd0981b5b3 Merge pull request #1624 from plankanban/dependabot/npm_and_yarn/client/lodash-es-4.18.1 
build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:48 +02:00
Daniel Hiller 9b68d3fc30 Merge pull request #1630 from plankanban/dependabot/npm_and_yarn/client/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client
 2026-04-18 15:27:46 +02:00
Daniel Hiller 922d70e289 Merge pull request #1629 from plankanban/dependabot/npm_and_yarn/server/lodash-4.18.1 
build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server
 2026-04-18 15:27:43 +02:00
Daniel Hiller 40a3e436ad Merge pull request #1608 from plankanban/dependabot/npm_and_yarn/server/picomatch-2.3.2 
build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server
 2026-04-18 15:27:22 +02:00
Daniel Hiller 227332768c Merge pull request #1607 from plankanban/dependabot/npm_and_yarn/client/picomatch-2.3.2 
build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /client
 2026-04-18 15:27:19 +02:00
Daniel Hiller 555117912c Merge pull request #1631 from plankanban/dependabot/npm_and_yarn/server/nodemailer-8.0.5 
build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server
 2026-04-18 15:27:11 +02:00
Daniel Hiller 9ba5f86073 Merge pull request #1632 from plankanban/dependabot/npm_and_yarn/server/multi-d854bddb60 
build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server
 2026-04-18 15:27:09 +02:00
HannesOberreiter 3bf6e6fa19 fix: allow unicodes in initials 2026-04-16 14:21:13 +02:00
dependabot[bot] 8cc00ef2ef build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.4.1 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.4.1...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.11 to 3.972.17
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.17
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-09 00:26:02 +00:00
dependabot[bot] 3d3c8f374c build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 8.0.5.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodemailer/nodemailer/compare/v7.0.13...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 22:42:51 +00:00
dependabot[bot] 7a3873cbeb build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:29:03 +00:00
dependabot[bot] 512b69080d build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server 
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 08:21:34 +00:00
dependabot[bot] 5fa6fe825b build(deps): Bump brace-expansion from 2.0.2 to 2.0.3 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-08 06:15:56 +00:00
dependabot[bot] f61299fde8 build(deps): Bump vite from 7.3.1 to 7.3.2 in /client 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 7.3.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-06 21:38:57 +00:00
dependabot[bot] a55214e617 build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client 
Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-02 11:42:15 +00:00
Maksim Eltyshev dbad8e976b fix(s3): Add requestChecksumCalculation config option 
Closes #1619
 2026-04-01 22:12:58 +02:00
dependabot[bot] 3915536e72 build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 14:25:58 +00:00
dependabot[bot] 3b7cc9c8a7 build(deps): Bump yaml from 2.8.2 to 2.8.3 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 18:33:58 +00:00
dependabot[bot] 081d0cee1f build(deps): Bump yaml from 2.8.2 to 2.8.3 in /client 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 17:25:40 +00:00
dependabot[bot] 60aaa4ad92 build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-26 17:25:17 +00:00
dependabot[bot] dbff5b2b1b build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 23:26:27 +00:00
dependabot[bot] f9102db1b2 build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /client 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 23:18:47 +00:00
dependabot[bot] 9abad91b04 build(deps): Bump rollup from 4.57.1 to 4.59.0 in /client (#1559) 
Bumps [rollup](https://github.com/rollup/rollup) from 4.57.1 to 4.59.0.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v4.57.1...v4.59.0)

---
updated-dependencies:
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:07:46 +01:00
dependabot[bot] 2b5921c30d build(deps): Bump immutable from 5.1.4 to 5.1.5 in /client (#1563) 
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.4 to 5.1.5.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/immutable-js/immutable-js/compare/v5.1.4...v5.1.5)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:07:21 +01:00
dependabot[bot] 03acecc43e build(deps): Bump svgo from 3.3.2 to 3.3.3 in /client (#1564) 
Bumps [svgo](https://github.com/svg/svgo) from 3.3.2 to 3.3.3.
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](https://github.com/svg/svgo/compare/v3.3.2...v3.3.3)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:07:12 +01:00
dependabot[bot] 06bedc1f7d build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /server (#1603) 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:06:30 +01:00
dependabot[bot] e31eca2273 build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /client (#1595) 
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.4.1 to 3.4.2.
- [Commits](https://github.com/WebReflection/flatted/compare/v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-25 21:06:17 +01:00
Sebastian Dichler d3ff3e2db8 feat(client): Add ability for admins to edit user avatars (#1604) 2026-03-25 11:24:27 +01:00
Sebastian Dichler 952a078aa1 chore(i18n): Update German translation (#1602) 2026-03-23 20:43:13 +01:00
Maksim Eltyshev 4ea0322dc4 build(dev): Add proxy target to dev compose file 2026-03-22 22:57:48 +01:00
Sebastian Dichler 105b37ef57 chore(i18n): Update German translation (#1597) 2026-03-22 22:39:27 +01:00
Maksim Eltyshev 4fb498667e build(client): Allow specifying proxy target 
Closes #1593
 2026-03-22 22:24:52 +01:00