v1.4.1

✨ Features

Workspace Member Reactivation Command

Self-hosted administrators can now restore a deactivated workspace member straight from the command line, without editing the database by hand. Running reactivate_workspace_member <workspace-slug> <email> re-enables the membership and reports the role the member is restored to.

• Validates the workspace, the user, and the existing membership before changing anything, with a clear error when any of them is missing
• Safe to re-run — an already-active member is reported as such instead of failing
• Keeps audit fields intact by limiting the write to the membership's active state

⬆️ Enhancements

• The workspace-level modules list now returns the member IDs for each module, so module members and member-based filters render correctly on the workspace modules view.
• Work item layouts are now wrapped in an error boundary. If a single layout fails to render, it degrades to a local "Something went wrong" message with a Retry button instead of taking down the whole page.

🐞 Bug fixes

• Fixed notifications failing to load on self-hosted deployments, where a missing trailing slash on the notification list request surfaced as a 500 error behind the reverse proxy.
• Fixed filtering modules by member breaking for modules with no members assigned.
• Fixed the layout dropdown button being clipped and overlapping neighbouring controls in the Create View modal.
• Fixed crashes on work items whose labels included an ID that no longer resolves to a label, affecting the properties row, the spreadsheet label column, the peek overview, and draft work items.
• Fixed crashes when a response came back empty or in an unexpected shape, affecting description version history, previous exports, the integrations list, profile activity, and sub-work-items.
• Fixed the previous exports list failing to refresh, and surfaced an error instead of failing silently when the refresh does not go through.
• Fixed profile activity showing a loading state indefinitely instead of an empty state when a user had no activity.

🛡️ Security

• Hardened asset uploads on published Space pages. The endpoint previously trusted the client-supplied file size when signing the upload policy, allowing a caller to request a policy larger than the instance's configured FILE_SIZE_LIMIT. The size is now clamped to the instance limit and malformed values are rejected.
• Upgraded cryptography to 50.0.0 to close a high-severity PKCS#7 Bleichenbacher oracle.
• Upgraded React Router to 7.18.1, resolving denial-of-service, open redirect, cross-site scripting, and constructor injection advisories.
• Upgraded sharp to 0.35.3 to pick up high-severity libvips fixes.
• Resolved further high-severity advisories in fast-uri (host confusion), js-yaml (quadratic CPU denial of service), linkify-it (mailto validator denial of service), postcss (source map path traversal), and undici (information disclosure, CRLF and cookie injection).
• Resolved medium- and low-severity advisories in sanitize-html (URI scheme validation bypass), valibot, and body-parser (request limit bypass).