v1.4.0-rc1

What's Changed

• release: v1.2.1 by @sriramveeraghanta in #8322
• release: v1.2.2 by @sriramveeraghanta in #8645
• release: v1.2.3 by @sriramveeraghanta in #8717
• [WIKI-874] refactor: description input component by @aaryan610 in #8544
• chore(deps): bump python-json-logger from 3.3.0 to 4.0.0 in /apps/api by @dependabot[bot] in #8692
• chore(deps): bump pytest from 7.4.0 to 9.0.2 in /apps/api by @dependabot[bot] in #8693
• [WEB-6599] feat: instance not ready ui revamp by @anmolsinghbhatia in #8755
• [WEB-6610] Fix work item drag handle hover gap by @iam-vipin in #8759
• chore(deps): bump the actions group across 1 directory with 11 updates by @dependabot[bot] in #8741
• fix: added workspace member check in allow permission for creator by @NarayanBavisetti in #8778
• fix: unused imports by @sriramveeraghanta in #8795
• chore: remove service token endpoint which is unused by @sriramveeraghanta in #8797
• fix: add missing model_activity.delay() for API-driven issue webhooks by @ouchanip in #8792
• [WEB-6702] feat: redesign intake action buttons and use design tokens by @anmolsinghbhatia in #8801
• [WEB-6739] fix: color inside of active projects of analytics overview tab by @b-saikrishnakanth in #8803
• [WEB-6734] fix: circular progress indicator stroke color by @b-saikrishnakanth in #8802
• fix: migrate page navigation pane tabs from Headless UI to Propel by @Palanikannan1437 in #8805
• chore(deps): bump requests from 2.32.4 to 2.33.0 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8804
• fix: tsdown watch by @lifeiscontent in #8813
• [WEB-6762] fix: missing profile icons for recent activities on "Your Work" Page by @b-saikrishnakanth in #8812
• [WEB-6763] fix: date range dropdown clipped in sub-issues list by @b-saikrishnakanth in #8809
• [WEB-6783] fix: crash when deleting work item from peek view in workspace spreadsheet by @anmolsinghbhatia in #8821
• chore(deps): bump cryptography from 46.0.5 to 46.0.6 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8819
• [SILO-1087] feat: add IssueRelations external API by @Saurabhkmr98 in #8763
• [SILO-1026] feat: add estimates external API endpoints by @Saurabhkmr98 in #8664
• [WEB-6794] fix: align profile cover update with correct unsplash and upload handling by @anmolsinghbhatia in #8830
• chore(deps): update dependency overrides by @sriramveeraghanta in #8831
• chore(deps): replace dotenvx with dotenv and update overrides by @sriramveeraghanta in #8832
• fix: IDOR in IssueBulkUpdateDateEndpoint (GHSA-4q54-h4x9-m329) by @sriramveeraghanta in #8834
• [INFRA-346] chore: remove artifacts.plane.so references from community deployments by @akshat5302 in #8836
• [INFRA-351] fix: correct directory and command for space program in supervisor.conf by @akshat5302 in #8838
• [WEB-6813] fix: module not associated when accepting intake work items by @anmolsinghbhatia in #8839
• fix: prevent privilege escalation in project member role updates by @sriramveeraghanta in #8833
• fix: validate redirects in favicon fetching to prevent SSRF by @sriramveeraghanta in #8858
• chore: upgrade turbo from v2.8.12 to v2.9.4 by @sriramveeraghanta in #8859
• chore(deps): bump vite from 7.3.1 to 7.3.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #8863
• fix: update Twitter icon and links to X by @nielskaspers in #8790
• fix: prevent ORM field injection via segment parameter in analytics (GHSA-93x3-ghh7-72j3) by @sriramveeraghanta in #8864
• fix: strip whitespace from instance configuration values by @okxint in #8744
• [WEB-6784] feat scrollbar in shortcuts modal by @b-saikrishnakanth in #8872
• [WEB-6785] fix: update border for project timezone by @b-saikrishnakanth in #8870
• chore: remove Intercom integration and chat support components by @sriramveeraghanta in #8875
• chore: update dependencies (Django, cryptography, axios, lodash) by @sriramveeraghanta in #8880
• [WEB-6840] feat: skip role & use-case steps for self-hosted instances by @anmolsinghbhatia in #8890
• chore(deps): bump pytest from 9.0.2 to 9.0.3 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8891
• enhance sub-issue query performance with optimized annotations and subqueries (2.6s -> 0.07s) by @PhuongPN6689 in #8889
• fix: enforce workspace membership on V2 asset endpoints by @sriramveeraghanta in #8885
• fix: replace IS_SELF_MANAGED with WEBHOOK_ALLOWED_IPS allowlist by @sriramveeraghanta in #8884
• [SILO-1158] chore: add context for project in relations API by @Saurabhkmr98 in #8860
• fix: sanitize filenames in upload paths to prevent path traversal by @sriramveeraghanta in #8879
• chore(ci): suppress CodeQL file coverage deprecation warning by @sriramveeraghanta in #8916
• chore: update CODEOWNERS for apps and deployments by @sriramveeraghanta in #8919
• chore: add Claude Code skills for PR descriptions and release notes by @sriramveeraghanta in #8920
• chore(deps): bump lxml from 6.0.0 to 6.1.0 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #8925
• chore(deps): bump axios, uuid and add security overrides by @sriramveeraghanta in #8930
• chore(deps): bump postcss from 8.5.6 to 8.5.10 in /packages/tailwind-config in the npm_and_yarn group across 1 directory by @dependabot[bot] in #8931
• fix: filter out soft-deleted states from API endpoints by @KanteshMurade in #8840
• chore(deps): remove unused pnpm overrides by @sriramveeraghanta in #8973
• fix(api): scope cross-workspace resource lookups to prevent IDOR by @sriramveeraghanta in #9008
• fix(nginx): correct real_ip_header typo X-Forward-For → X-Forwarded-For by @MinitJain in #8935
• fix(api): use requester's workspace role in project member role updates (GHSA-x63v-p7wc-47x4) by @sriramveeraghanta in #9014
• [GIT-175] fix: completed_at updation logic for work items by @sangeethailango in #9044
• fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets by @sriramveeraghanta in #9078
• fix: pnpm path for Docker builds by @sriramveeraghanta in #9079
• refactor(i18n): migrate packages/i18n from MobX to react-i18next by @sriramveeraghanta in #8898
• fix(api): pass project_lead_id (not User instance) when creating ProjectMember by @jamartineztelecoengineer84-dotcom in #8966
• [WEB-7181] fix: empty comment quick-actions menu in work item activity by @b-saikrishnakanth in #9024
• [WEB-7182] fix: remove profile preferences activity by @b-saikrishnakanth in #9025
• fix(aio): use JSON array double quotes in VOLUME instruction by @astarte75 in #9099
• fix(web): add requestIdleCallback fallback for Safari/iOS by @bubacho in #9094
• [GIT-174]chore: set completed_at as read only field for work item by @sangeethailango in #9083
• Add docker pytest runner; fix bugs the suite surfaced by @sriramveeraghanta in #9138
• chore: fix security vulnerabilities by @pratapalakshmi in #9140
• chore: restructure .claude/skills into per-skill directories by @sriramveeraghanta in #9146
• refactor: logging with retention + API token hardening by @sriramveeraghanta in #9148
• chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml by @sriramveeraghanta in #9147
• [WEB-7447] feat: migrate CE telemetry from OTLP traces to OTLP metrics by @mguptahub in #9156
• fix(web): add Safari fallback for requestIdleCallback by @KanteshMurade in #9137
• refactor(api): source API_KEY_RATE_LIMIT from settings, drop service token throttle by @sriramveeraghanta in #9161
• fix: harden webhook/link/OAuth-avatar SSRF (advisory clusters A/B/C/E) by @sriramveeraghanta in #9163
• chore: move all dependencies into pnpm catalog by @sriramveeraghanta in #9153
• [GIT-213] fix: return HTTP response from dispatch() exception handler by @sriramveeraghanta in #9179
• [GIT-235] fix: remove unsupported styles from onboarding tour close button by @Rahulcheryala in #9188
• fix: declare @tailwindcss/postcss in admin/space/web Docker builds by @sriramveeraghanta in #9189
• fix: bump npm deps to resolve Dependabot advisories by @sriramveeraghanta in #9191
• fix(api): rate-limit magic-code verify, bound per-token attempts (GHSA-9pvm-fcf6-9234) by @sriramveeraghanta in #9130
• fix: handle error message for special characters in Identifier of Project by @durgeshhhhhhh in #9059
• fix: dropdown shadow on the work item more options by @karthiksuki in #9154
• fix(api): enforce workspace membership on GenericAssetEndpoint by @sriramveeraghanta in #9212
• fix: bump react-router and vitest to resolve Dependabot advisories by @sriramveeraghanta in #9215
• chore: integrate react-doctor scanning by @sriramveeraghanta in #9223
• [GIT-238] refactor: migrate types from apps/web to @plane/types by @Rahulcheryala in #9203
• fix(api): sanitize spreadsheet exports against formula injection by @sriramveeraghanta in #9224
• fix(api): reject API key auth for deactivated user accounts by @sriramveeraghanta in #9225
• fix: resolve esbuild advisory (GHSA-gv7w-rqvm-qjhr) and bump turbo to 2.9.18 by @sriramveeraghanta in #9236
• feat(api): add workspace_slug to webhook delivery payload by @ch4og in #9232
• chore(deps): bump pyjwt from 2.12.0 to 2.13.0 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #9241
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 in /apps/api/requirements in the pip group across 1 directory by @dependabot[bot] in #9243
• chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates by @dependabot[bot] in #9244
• [WEB-7730] fix(security): scope cascade deletes to workspace in BulkDeleteIssuesEndpoint by @mguptahub in #9270
• fix: Require at least one alphanumeric char in workspace name by @okxint in #9263
• [WEB-7727] fix(security): scope issue ID validation to workspace/project in bulk endpoints by @mguptahub in #9269
• chore(deps): upgrade Storybook to v10 and fix security advisories by @sriramveeraghanta in #9277
• fix(api): require at least one alphanumeric char in workspace name by @sriramveeraghanta in #9278
• fix: Use APP_DOMAIN env var for bot user email by @okxint in #9262
• fix: scope workspace user preference filter to current user by @sriramveeraghanta in #9279
• [WEB-7854] fix: prevent workspace invite token disclosure and invite hijack by @mguptahub in #9297
• [WEB-7774] fix(security): sanitize comment_html and intake description_html with nh3 by @mguptahub in #9287
• [WEB-7769] fix(security): scope EstimatePoint create/destroy to workspace and project by @mguptahub in #9286
• [WEB-7805] fix: remove hardcoded SECRET_KEY from community deployment manifests by @mguptahub in #9291
• [WEB-7813] fix: prevent ORM order_by injection in issue and other endpoints by @mguptahub in #9292
• [WEB-7787] fix(security): block deactivated user login and fix WorkspaceOwnerPermission (Cluster X) by @mguptahub in #9290
• [WEB-7787] fix(auth): restore activation flow and narrow deactivation guard by @mguptahub in #9304
• [GIT-239] refactor: migrate constants from apps/web to @plane/constants by @Rahulcheryala in #9204
• [WEB-7776] fix(security): scope FileAsset queries to prevent cross-project IDOR (Cluster F) by @mguptahub in #9288
• [WEB-7847] fix: enforce workspace membership on entity-search endpoint by @mguptahub in #9296
• [WEB-7945] fix(security): prevent shell injection in feature-deployment.yml by @mguptahub in #9334
• [WEB-7855] fix(security): prevent project invite email disclosure via unauthenticated GET by @mguptahub in #9305
• [WEB-7892] fix(security): scope attachment PATCH/DELETE/GET by issue_id, drop created_by overwrite (GHSA-5mxw-g5mw-3v3w) by @mguptahub in #9315
• [WEB-7894] fix: eliminate TOCTOU race in InstanceAdminSignUp (GHSA-p548-28jp-wr4p) by @mguptahub in #9332
• 🐛 Bug: Issues created or updated via REST API send no notifications or emails by @wildsurfer in #9307
• fix(security): block bot user logins by @sriramveeraghanta in #9368
• [WEB-7778] fix(security): reject unverified OAuth provider emails to prevent ATO (Cluster E) by @mguptahub in #9289
• [WEB-7877] fix(security): enforce token + auth validation on project invite accept/reject by @mguptahub in #9308
• [WEB-7888] fix(security): normalize href before protocol check in CustomLinkExtension (GHSA-v2vv-7wq3-8w2j) by @mguptahub in #9313
• [WEB-7895] fix: scope UserProjectInvitationsViewset to workspace-validated project IDs (GHSA-45hc-q4mw-jhxm) by @mguptahub in #9333
• [WEB-8017] fix(security): sanitize order_by on external REST API list endpoints by @mguptahub in #9348
• [WEB-8019] fix(security): scope CycleIssue reassignment lookup to workspace/project by @mguptahub in #9349
• [WEB-8060] fix(security): enforce authz on is_active member (de)activation by @mguptahub in #9367
• [GIT-260] fix(user): Profile cover image uses stale image after update by @codingwolf-at in #9285
• [WEB-7887] fix(security): prevent stored XSS via SVG attachment served inline (GHSA-ch8j-vr4r-qf6h) by @mguptahub in #9312
• [WEB-8012] fix: prevent ORM group_by/sub_group_by injection in issue endpoints by @mguptahub in #9347
• [WEB-8066] fix: scope workspace asset get/patch/delete to project membership by @mguptahub in #9372
• chore: clean up React Doctor warnings in admin app by @sriramveeraghanta in #9418
• [GIT-248 | GIT-254] refactor: store and components consolidation to core by @codingwolf-at in #9245
• [WEB-8068] fix: scope workspace cycles/modules listing to project membership by @mguptahub in #9373
• [WEB-8075] fix: scope ProjectMemberPermission SAFE_METHODS to project membership by @mguptahub in #9375
• [WEB-8095] fix: scope page-version reads to the URL project (GHSA-g49r/ghcr) by @mguptahub in #9380
• [WEB-8074] fix: scope IssueListEndpoint to guest created_by by @mguptahub in #9374
• feat(api): add lite list endpoints for projects, members, cycles, and modules by @akhil-vamshi-konam in #9410
• chore: resolve open Dependabot security alerts (axios, brace-expansion, morgan) by @sriramveeraghanta in #9456

New Contributors

• @ouchanip made their first contribution in #8792
• @nielskaspers made their first contribution in #8790
• @okxint made their first contribution in #8744
• @PhuongPN6689 made their first contribution in #8889
• @KanteshMurade made their first contribution in #8840
• @MinitJain made their first contribution in #8935
• @jamartineztelecoengineer84-dotcom made their first contribution in #8966
• @astarte75 made their first contribution in #9099
• @bubacho made their first contribution in #9094
• @durgeshhhhhhh made their first contribution in #9059
• @wildsurfer made their first contribution in #9307
• @akhil-vamshi-konam made their first contribution in #9410

Full Changelog: v1.2.3...v1.4.0-rc1