lukevella/rallly v4.12.0

on GitHub

🔒 Security

This release fixes a vulnerability where a space admin could remove or demote the space owner, locking the owner out of their own space (#2793). Advisory GHSA-34w3-569j-j947 is published alongside this release.

Related hardening also landed: soft deleted polls now return 404 instead of leaking comments and participants (#2599, #2607), and admin mutations are authorized against the database rather than the session snapshot.

⚠️ Breaking changes

• Legacy /p/<id> and /admin/<id> poll links no longer work (#2781). These redirects served links created before v3. The backing columns are dropped by a migration, so this is irreversible. Old bookmarks and emailed links from pre v3 polls will return 404.
• New polls have comments disabled by default (#2792). Comments are deprecated and will be removed in a future release. In most cases, participant response notes (new in this release) cover the same need. Organizers can still turn comments on in poll settings.

Also changed for existing instances:

• Gravatar support is removed (#2780). Participant avatars fall back to initials.
• Poll retention semantics changed (#2720). Polls are now kept for at least 30 days after their final date, and any activity extends the window. Previously polls were removed when not updated for 30 days with all dates in the past.

🗃️ Database migrations

This release ships 12 migrations, more than usual: two drop columns permanently and three rewrite data across large tables.

✨ Highlights

• 📝 Rich text descriptions for polls and events, with a proper editor and sanitized Markdown rendering (#2653)
• 🗒️ Participant response notes: participants can attach a private note to their response, visible only to the host (#2789)
• 🌍 Date and time localization overhaul: Intl based rendering, clock format changes apply instantly, and the app adopts your saved language on sign in (#2512 and follow ups)
• ♿ Accessibility pass: skip to content links and landmarks, visible focus indicators, accessible names on icon buttons, WCAG AA contrast, restored pinch zoom on mobile, accessible date and time pickers, and a standing axe-core CI check to keep it that way
• 🗑️ Delete your account from account settings, with a clear summary of the consequences (#2699)
• 🔑 Set a password from security settings without going through the reset flow (#2709)
• 🚪 Login and sign up merged into a single flow, with passwordless registration folded in (#2689)
• 💬 Comment notification emails include the comment text (#2784); comments are capped at 2000 characters with a live indicator (#2782)
• 📊 "Responded on" column in the poll CSV export (#2510)
• 🎨 Space branding on the new poll page (#2526)
• 👤 Guest sessions stay alive during active use, so fewer surprise session losses on invite pages (#2499)

Control panel

• Ban and unban users; banned users are rejected before a login code is sent (#2628)

💄 Improvements

• Poll timezone setting reframed as "Lock timezone" (#2751)
• Redesigned new participant dialog with an availability summary and a success state (#2750)
• Week calendar rebuilt on a new calendar component (#2746)
• Faster page loads: sessions refresh at most once a day and invite pages no longer prefetch links
• Restyled create poll page, poll settings, and account settings pages
• Assorted UI polish across dialogs, OTP inputs, alerts, and menus

🐛 Fixes

• Language preference no longer resets after saving (#2664), and locale cookie writes no longer drop session cookies (#2670)
• Fixed redirect loops between / and /login and with stale sessions; users are no longer signed out automatically on an invalid session (#2650)
• Fixed a login loop caused by cookie deletions not surviving Next.js cookie merging (#2843)
• Setup no longer creates a duplicate space for existing accounts, and established accounts are no longer sent back through setup (#2770)
• All day events show the correct date in ICS files, emails, and the upcoming events list, regardless of the viewer's timezone (#2551)
• The timezone can be changed on polls without votes and is preserved when clearing and re-adding options (#2436)
• Week calendar respects your week start preference and no longer scrolls the first selected slot out of view (#2661)
• Poll create and edit enforce at least one option server side (#2487)

🐳 Self-hosting

• Maintenance mode (#2545): set MAINTENANCE_MODE=true to redirect page traffic to a maintenance page and return 503 from the API. Operators bypass it via /maintenance?token=<MAINTENANCE_BYPASS_TOKEN> (minimum 16 characters). While maintenance mode is on, docker-start.sh skips prisma migrate deploy since the database may be unreachable.
• SMTP debugging (#2634): set SMTP_DEBUG=true to log the full SMTP conversation. The auth exchange is only base64 encoded, so treat these logs as sensitive.
• ALLOWED_EMAILS patterns are matched case insensitively and whitespace is trimmed (#2566)

🧹 Internal

A large internal cleanup also landed: an app layer restructure with lint enforced boundaries, a full migration from Radix UI to Base UI, TypeScript 6, tRPC to server action migrations, and 42 translation syncs.

Full Changelog: v4.11.1...v4.12.0