Security
This release fixes a medium-severity access control issue (GHSA-hxpg-c28w-vxgx). Everyone on 1.15.2 or earlier should upgrade.
Board members without the admin role could open a board's settings page directly by its URL. From there they could create, rename and delete labels, change board settings and export the board. The settings page and the label dialogs now require a board admin, and the role is checked again before every change.
Thanks to @kats1123 for reporting this responsibly.
What's Changed
Upgrading
Pull ghcr.io/dkorecko/ticky:v1.15.3 (or :latest) and restart. There are no database changes.
Full Changelog: v1.15.2...v1.15.3