v1.5.0-rc1

What's Changed

• chore: remove posthog integration and analytics scaffold by @sriramveeraghanta in #9634
• chore: set issue type on GitHub issue templates by @sriramveeraghanta in #9559
• [WEB-8789] Adopt @makeplane/propel as the design token source by @anmolsinghbhatia in #9682
• chore: upgrade React to 19 and React Router to 8 by @sriramveeraghanta in #9530
• fix: runtime crash in dropdowns from headlessui v2 Fragment check (React 19 upgrade regression) by @codingwolf-at in #9694
• chore: remove Zenith managed hosting from README by @vihar in #9693
• refactor(admin): migrate from @plane/ui to @plane/propel by @sriramveeraghanta in #9690
• refactor(admin): replace workspace @plane/propel with @makeplane/propel by @sriramveeraghanta in #9692
• chore: remove unused @plane/ui exports by @anmolsinghbhatia in #9701
• chore: wire @makeplane/propel into web by @anmolsinghbhatia in #9699
• refactor: migrate web Checkbox to @makeplane/propel Checkbox by @anmolsinghbhatia in #9702
• refactor: migrate web progress indicators to @makeplane/propel by @anmolsinghbhatia in #9698
• refactor: migrate ToggleSwitch to @makeplane/propel by @anmolsinghbhatia in #9696
• refactor: migrate web Tooltip to @makeplane/propel Tooltip by @anmolsinghbhatia in #9697
• [WEB-7946] fix: add rate limiting to email/password sign-in and sign-up endpoints by @mguptahub in #9335
• [WEB-8103] fix: stop leaking webhook HMAC secret_key on reads by @mguptahub in #9382
• [WEB-8110] fix: sanitize page list order_by against an allowlist by @mguptahub in #9387
• [WEB-8283] fix: bind Spaces board object IDs to the anchor's project by @mguptahub in #9442
• [WEB-8352] fix(security): scope SubIssuesEndpoint to the URL project by @mguptahub in #9466
• refactor: migrate web Input to @makeplane/propel Input by @anmolsinghbhatia in #9708
• chore(ci): build images natively per architecture and merge by digest by @sriramveeraghanta in #9673
• chore: remove unused @plane/ui P1 primitives by @anmolsinghbhatia in #9711
• refactor: migrate web Tag to @makeplane/propel Pill by @anmolsinghbhatia in #9710
• refactor: migrate admin and web from nginx to Caddy by @sriramveeraghanta in #9716
• refactor: flatten editor package folder structure by @sriramveeraghanta in #9719
• refactor: flatten editor src/core into src by @sriramveeraghanta in #9723
• feat: add Georgian (ka-ge) language support by @sriramveeraghanta in #9720
• fix(i18n): correct broken German translations by @CoderSufiyan in #9715
• refactor: migrate web @plane/propel Tooltip to @makeplane/propel by @anmolsinghbhatia in #9726
• refactor: migrate web Avatar to @makeplane/propel Avatar by @anmolsinghbhatia in #9724
• chore: upgrade pnpm to 11.10, turbo to latest, fix dependabot alert by @sriramveeraghanta in #9734
• chore: bump @makeplane/propel to 0.3.0 by @anmolsinghbhatia in #9738
• refactor: migrate admin icons to @makeplane/propel by @anmolsinghbhatia in #9730
• refactor: migrate space icons to @makeplane/propel by @anmolsinghbhatia in #9729
• refactor: migrate web icons to @makeplane/propel by @anmolsinghbhatia in #9731
• chore(deps): bump sanitize-html from 2.17.5 to 2.17.7 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #9736
• refactor: migrate package icons to @makeplane/propel by @anmolsinghbhatia in #9732
• docs: fix typos in code comments by @adem-loghmari in #9318
• fix(api): validate assignees/labels in IssueSerializer instead of silently dropping invalid ids by @houssaineamzil in #9526
• [GIT-221] fix(cycle): guard against no end_date when archiving cycle by @Rahulcheryala in #9200
• fix(security): clear the HIGH/CRITICAL Trivy findings in the community images by @pratapalakshmi in #9773
• refactor: migrate Banner to @makeplane/propel across web app by @codingwolf-at in #9737
• refactor: migrate web Collapsible to @makeplane/propel Collapsible by @codingwolf-at in #9743
• refactor: migrate web TextArea to @makeplane/propel TextArea by @codingwolf-at in #9747
• refactor: migrate web Tabs to @makeplane/propel by @anmolsinghbhatia in #9752
• fix(api): avoid re-crawling issue link on update when url is unchanged by @Tyagiquamar in #9763
• fix(security): clear the 2026-09-10 nightly Trivy findings by @pratapalakshmi in #9806
• fix: enforce trailing slash on API requests and settings URLs by @prateekshourya29 in #9824
• perf: bind outside-click once and cache platform detection by @prateekshourya29 in #9825
• perf: isolate kanban delete-drop-zone by @prateekshourya29 in #9827
• [INFRA-962] fix(minio): pull MinIO images from quay.io instead of the removed Docker Hub org by @pratapalakshmi in #9829
• fix(deps): resolve dependabot security alerts by @sriramveeraghanta in #9839
• chore: remove legacy blue Plane branding assets by @vihar in #9840
• [WEB-8289] fix: scope draft-to-issue conversion to the draft owner by @mguptahub in #9443
• fix(api): decode HTML entities in plain-text email bodies by @sriramveeraghanta in #9841
• chore: add migration check GitHub Action by @sriramveeraghanta in #9847
• fix(web): show sub-work items on the parent in local by @RealBhupesh in #9804
• fix(i18n): add missing Polish plural form for epic.label by @Pawel-Kranzberg in #9851
• fix(i18n): restore {templateName}/{templateType} in cs template toasts by @owgreen-dev in #9848
• chore(i18n): improve Japanese translations by @0qiudbx4q3d38ikph5 in #9679
• fix(i18n/ko): correct '버다운' → '번다운' (Burndown) in Korean translations by @0xdeadd in #9032
• chore(i18n/ru): misc translation fixes by @egormanga in #9815
• feat(i18n): add Dutch (nl) language support by @nocx2com in #9639
• [WEB-9166] fix(project): scope project-join membership lookup to the invited project by @sriramveeraghanta in #9866
• fix: update email.py license header by @Sanikaa205 in #9865
• fix: eliminate spurious full-page reloads in the dev server by @prateekshourya29 in #9873
• fix(web): stop 401 redirect reload loop on session expiry by @yuzhiyang1 in #9862
• refactor: replace @plane/ui and @plane/propel with @makeplane/propel and @plane/blocks by @sriramveeraghanta in #9802
• fix(power-k): shortcut matching, badge rendering, i18n and dead-code cleanup by @vihar in #9874
• chore: remove stale Google IDX workspace config by @vihar in #9876
• [INFRA-779] fix(security): reject authority-relative next_path redirects by @mguptahub in #9709
• chore: gate Django debug toolbar behind DEBUG env in local settings by @prateekshourya29 in #9880
• [GIT-350] chore: flatten web layouts, lib, and services out of core/ by @prateekshourya29 in #9881
• [GIT-349] chore: flatten web hooks and store out of core/ by @prateekshourya29 in #9882
• [GIT-351] chore: flatten web components out of core/ by @prateekshourya29 in #9883
• fix: serialize issue history before merging activities and comments by @pablohashescobar in #9899
• fix: return 404 instead of 500 for UUID work-item lookup in v1 API by @pablohashescobar in #9898
• fix: skip logging missing objects in S3 get_object_metadata by @pablohashescobar in #9909
• fix: return 204 instead of 500 for repeated module-issue deletes by @pablohashescobar in #9910
• [GIT-352] chore: point web @/* at app root and remove core/ by @prateekshourya29 in #9884
• fix: reject scalar JSON bodies on v1 write endpoints by @pablohashescobar in #9912
• fix(api): expand=updated_by returns the user, and null relations stay null by @sriramveeraghanta in #9717
• fix: accept numeric-string size on issue attachment upload by @pablohashescobar in #9911
• fix(security): bump the fast-uri pin to 3.1.8 by @pratapalakshmi in #9919
• [INFRA-804] fix(airgapped and minio): harden community restore-airgapped.sh script and minio image fix by @akshat5302 in #9727
• [INFRA-1039] fix(deployments): find the latest release when the GitHub API returns compact JSON by @akshat5302 in #9916
• fix: address v1.4.3 release review comments by @sriramveeraghanta in #9925
• [INFRA-843] fix(security): bump pins overtaken by the 2026-10-01 advisories by @pratapalakshmi in #9924
• [INFRA-1076] fix: clear the 2026-10-07 nightly npm Trivy findings by @pratapalakshmi in #9956
• chore(api): manage Python dependencies with uv by @sriramveeraghanta in #9950
• [INFRA-1089] chore(deps): switch MinIO image to pgsty/silo by @mguptahub in #9962
• [WEB-9400] feat: add Bulgarian language support by @anmolsinghbhatia in #10007
• [WEB-8372] fix(security): restrict state writes to project admins by @sriramveeraghanta in #10008
• [WEB-8332] fix(security): block workspace-member mass-assignment by @mguptahub in #9460
• chore(deps): resolve open Dependabot alerts by @sriramveeraghanta in #10011
• [INFRA-1096] fix: persist generated AIO secrets and avoid regenerating SECRET_KEY for an existing database by @mguptahub in #9987
• [INFRA-843] fix(security): build caddy on 2.11.7 with x/net v0.60.0 by @pratapalakshmi in #9988
• fix(api): preserve Redis TLS URL credentials and database by @HaiYangBG1 in #9979
• [SECUR-243] fix(security): scope issue comment + relation endpoints to the URL project by @mguptahub in #9531
• [SECUR-247] fix(security): require project membership to publish by @sriramveeraghanta in #10033
• chore(security): remove unused API token service flag by @sriramveeraghanta in #10032
• fix: skip external image srcs when duplicating page assets by @pablohashescobar in #9938
• [WEB-9302] fix: unsnooze expired intake items at project-timezone midnight by @pablohashescobar in #9944
• fix: use env bash in host scripts for NixOS support by @asinglesprinkle in #10030
• [GIT-384] Fix voting on published work items with no votes by @Rahulcheryala in #10103
• [INFRA-843] fix: close the 2026-10-26 nightly Trivy findings by @pratapalakshmi in #10120
• [WIKI-1268] chore: upgrade Tiptap and Hocuspocus to v3 by @sriramveeraghanta in #10101
• [WEB-8291] fix: gate project invitation list/retrieve/destroy to project admins by @mguptahub in #9444
• [WEB-8374] fix(security): scope ProjectMemberPreferenceEndpoint to the caller by @mguptahub in #9474
• [WEB-8401] fix(security): scope public Space asset mutations to the creator by @mguptahub in #9483
• [SECUR-236] fix: grouped-paginator cursor bound + Project mass-assignment by @mguptahub in #9486
• [INFRA-501] fix(security): enforce project membership on every workspace-level asset route by @mguptahub in #9657
• [INFRA-772] fix(security): stop trusting body-supplied created_by/created_at on external API by @mguptahub in #9704
• [WEB-8353] fix(security): enforce guest issue visibility on attachments + activity by @mguptahub in #9467
• [INFRA-778] fix(security): scope ExportIssuesEndpoint.get to the requesting user's own exports by @mguptahub in #9707
• [INFRA-496] fix(security): refuse routed actions served by unauthorized DRF mixins by @mguptahub in #9652
• [INFRA-499] fix(security): require workspace membership to read a global view by @mguptahub in #9653
• [INFRA-777] fix(security): scope ProjectArchiveUnarchiveAPIEndpoint to the URL project by @mguptahub in #9706
• [WEB-8400] fix(security): scope DeployBoardViewSet queryset to the URL workspace/project by @mguptahub in #9481
• fix(security): stop rendering raw comment HTML unescaped in email notifications by @kovalancik06-max in #9651
• [GIT-395]fix: keep timeline scroll position when toggling full screen by @vamsikrishnamathala in #10126
• [WIKI-1268] fix: honor collaboration forced disconnects by @saivallampati in #10121
• chore: replace mguptahub with pratapalakshmi as deployments code owner by @sriramveeraghanta in #10137
• [INFRA-843] fix: close the 2026-10-29 nightly Trivy findings by @pratapalakshmi in #10144
• fix(web): allow saving profile settings with an empty last name (#10122) by @ghazy2001 in #10147
• feat: sync web, Space and Admin UI with the Propel design system by @anmolsinghbhatia in #10038
• refactor(admin): share OAuth provider form and fix csrf input warning by @sriramveeraghanta in #10173
• fix: address design-system QA review across the web app by @anmolsinghbhatia in #10178
• fix(auth): stop shadowing base_host in space OAuth callbacks by @0xDevNinja in #9922

New Contributors

• @CoderSufiyan made their first contribution in #9715
• @adem-loghmari made their first contribution in #9318
• @houssaineamzil made their first contribution in #9526
• @Tyagiquamar made their first contribution in #9763
• @RealBhupesh made their first contribution in #9804
• @Pawel-Kranzberg made their first contribution in #9851
• @owgreen-dev made their first contribution in #9848
• @0qiudbx4q3d38ikph5 made their first contribution in #9679
• @0xdeadd made their first contribution in #9032
• @egormanga made their first contribution in #9815
• @nocx2com made their first contribution in #9639
• @Sanikaa205 made their first contribution in #9865
• @yuzhiyang1 made their first contribution in #9862
• @HaiYangBG1 made their first contribution in #9979
• @asinglesprinkle made their first contribution in #10030
• @kovalancik06-max made their first contribution in #9651
• @saivallampati made their first contribution in #10121
• @ghazy2001 made their first contribution in #10147
• @0xDevNinja made their first contribution in #9922

Full Changelog: v1.4.3...v1.5.0-rc1