What's Changed
- chore: remove posthog integration and analytics scaffold by @sriramveeraghanta in #9634
- chore: set issue type on GitHub issue templates by @sriramveeraghanta in #9559
- [WEB-8789] Adopt @makeplane/propel as the design token source by @anmolsinghbhatia in #9682
- chore: upgrade React to 19 and React Router to 8 by @sriramveeraghanta in #9530
- fix: runtime crash in dropdowns from headlessui v2 Fragment check (React 19 upgrade regression) by @codingwolf-at in #9694
- chore: remove Zenith managed hosting from README by @vihar in #9693
- refactor(admin): migrate from @plane/ui to @plane/propel by @sriramveeraghanta in #9690
- refactor(admin): replace workspace @plane/propel with @makeplane/propel by @sriramveeraghanta in #9692
- chore: remove unused @plane/ui exports by @anmolsinghbhatia in #9701
- chore: wire @makeplane/propel into web by @anmolsinghbhatia in #9699
- refactor: migrate web Checkbox to @makeplane/propel Checkbox by @anmolsinghbhatia in #9702
- refactor: migrate web progress indicators to @makeplane/propel by @anmolsinghbhatia in #9698
- refactor: migrate ToggleSwitch to @makeplane/propel by @anmolsinghbhatia in #9696
- refactor: migrate web Tooltip to @makeplane/propel Tooltip by @anmolsinghbhatia in #9697
- [WEB-7946] fix: add rate limiting to email/password sign-in and sign-up endpoints by @mguptahub in #9335
- [WEB-8103] fix: stop leaking webhook HMAC secret_key on reads by @mguptahub in #9382
- [WEB-8110] fix: sanitize page list order_by against an allowlist by @mguptahub in #9387
- [WEB-8283] fix: bind Spaces board object IDs to the anchor's project by @mguptahub in #9442
- [WEB-8352] fix(security): scope SubIssuesEndpoint to the URL project by @mguptahub in #9466
- refactor: migrate web Input to @makeplane/propel Input by @anmolsinghbhatia in #9708
- chore(ci): build images natively per architecture and merge by digest by @sriramveeraghanta in #9673
- chore: remove unused @plane/ui P1 primitives by @anmolsinghbhatia in #9711
- refactor: migrate web Tag to @makeplane/propel Pill by @anmolsinghbhatia in #9710
- refactor: migrate admin and web from nginx to Caddy by @sriramveeraghanta in #9716
- refactor: flatten editor package folder structure by @sriramveeraghanta in #9719
- refactor: flatten editor src/core into src by @sriramveeraghanta in #9723
- feat: add Georgian (ka-ge) language support by @sriramveeraghanta in #9720
- fix(i18n): correct broken German translations by @CoderSufiyan in #9715
- refactor: migrate web @plane/propel Tooltip to @makeplane/propel by @anmolsinghbhatia in #9726
- refactor: migrate web Avatar to @makeplane/propel Avatar by @anmolsinghbhatia in #9724
- chore: upgrade pnpm to 11.10, turbo to latest, fix dependabot alert by @sriramveeraghanta in #9734
- chore: bump @makeplane/propel to 0.3.0 by @anmolsinghbhatia in #9738
- refactor: migrate admin icons to @makeplane/propel by @anmolsinghbhatia in #9730
- refactor: migrate space icons to @makeplane/propel by @anmolsinghbhatia in #9729
- refactor: migrate web icons to @makeplane/propel by @anmolsinghbhatia in #9731
- chore(deps): bump sanitize-html from 2.17.5 to 2.17.7 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #9736
- refactor: migrate package icons to @makeplane/propel by @anmolsinghbhatia in #9732
- docs: fix typos in code comments by @adem-loghmari in #9318
- fix(api): validate assignees/labels in IssueSerializer instead of silently dropping invalid ids by @houssaineamzil in #9526
- [GIT-221] fix(cycle): guard against no end_date when archiving cycle by @Rahulcheryala in #9200
- fix(security): clear the HIGH/CRITICAL Trivy findings in the community images by @pratapalakshmi in #9773
- refactor: migrate Banner to @makeplane/propel across web app by @codingwolf-at in #9737
- refactor: migrate web Collapsible to @makeplane/propel Collapsible by @codingwolf-at in #9743
- refactor: migrate web TextArea to @makeplane/propel TextArea by @codingwolf-at in #9747
- refactor: migrate web Tabs to @makeplane/propel by @anmolsinghbhatia in #9752
- fix(api): avoid re-crawling issue link on update when url is unchanged by @Tyagiquamar in #9763
- fix(security): clear the 2026-09-10 nightly Trivy findings by @pratapalakshmi in #9806
- fix: enforce trailing slash on API requests and settings URLs by @prateekshourya29 in #9824
- perf: bind outside-click once and cache platform detection by @prateekshourya29 in #9825
- perf: isolate kanban delete-drop-zone by @prateekshourya29 in #9827
- [INFRA-962] fix(minio): pull MinIO images from quay.io instead of the removed Docker Hub org by @pratapalakshmi in #9829
- fix(deps): resolve dependabot security alerts by @sriramveeraghanta in #9839
- chore: remove legacy blue Plane branding assets by @vihar in #9840
- [WEB-8289] fix: scope draft-to-issue conversion to the draft owner by @mguptahub in #9443
- fix(api): decode HTML entities in plain-text email bodies by @sriramveeraghanta in #9841
- chore: add migration check GitHub Action by @sriramveeraghanta in #9847
- fix(web): show sub-work items on the parent in local by @RealBhupesh in #9804
- fix(i18n): add missing Polish plural form for epic.label by @Pawel-Kranzberg in #9851
- fix(i18n): restore {templateName}/{templateType} in cs template toasts by @owgreen-dev in #9848
- chore(i18n): improve Japanese translations by @0qiudbx4q3d38ikph5 in #9679
- fix(i18n/ko): correct '버다운' → '번다운' (Burndown) in Korean translations by @0xdeadd in #9032
- chore(i18n/ru): misc translation fixes by @egormanga in #9815
- feat(i18n): add Dutch (nl) language support by @nocx2com in #9639
- [WEB-9166] fix(project): scope project-join membership lookup to the invited project by @sriramveeraghanta in #9866
- fix: update email.py license header by @Sanikaa205 in #9865
- fix: eliminate spurious full-page reloads in the dev server by @prateekshourya29 in #9873
- fix(web): stop 401 redirect reload loop on session expiry by @yuzhiyang1 in #9862
- refactor: replace @plane/ui and @plane/propel with @makeplane/propel and @plane/blocks by @sriramveeraghanta in #9802
- fix(power-k): shortcut matching, badge rendering, i18n and dead-code cleanup by @vihar in #9874
- chore: remove stale Google IDX workspace config by @vihar in #9876
- [INFRA-779] fix(security): reject authority-relative next_path redirects by @mguptahub in #9709
- chore: gate Django debug toolbar behind DEBUG env in local settings by @prateekshourya29 in #9880
- [GIT-350] chore: flatten web layouts, lib, and services out of core/ by @prateekshourya29 in #9881
- [GIT-349] chore: flatten web hooks and store out of core/ by @prateekshourya29 in #9882
- [GIT-351] chore: flatten web components out of core/ by @prateekshourya29 in #9883
- fix: serialize issue history before merging activities and comments by @pablohashescobar in #9899
- fix: return 404 instead of 500 for UUID work-item lookup in v1 API by @pablohashescobar in #9898
- fix: skip logging missing objects in S3 get_object_metadata by @pablohashescobar in #9909
- fix: return 204 instead of 500 for repeated module-issue deletes by @pablohashescobar in #9910
- [GIT-352] chore: point web @/* at app root and remove core/ by @prateekshourya29 in #9884
- fix: reject scalar JSON bodies on v1 write endpoints by @pablohashescobar in #9912
- fix(api): expand=updated_by returns the user, and null relations stay null by @sriramveeraghanta in #9717
- fix: accept numeric-string size on issue attachment upload by @pablohashescobar in #9911
- fix(security): bump the fast-uri pin to 3.1.8 by @pratapalakshmi in #9919
- [INFRA-804] fix(airgapped and minio): harden community restore-airgapped.sh script and minio image fix by @akshat5302 in #9727
- [INFRA-1039] fix(deployments): find the latest release when the GitHub API returns compact JSON by @akshat5302 in #9916
- fix: address v1.4.3 release review comments by @sriramveeraghanta in #9925
- [INFRA-843] fix(security): bump pins overtaken by the 2026-10-01 advisories by @pratapalakshmi in #9924
- [INFRA-1076] fix: clear the 2026-10-07 nightly npm Trivy findings by @pratapalakshmi in #9956
- chore(api): manage Python dependencies with uv by @sriramveeraghanta in #9950
- [INFRA-1089] chore(deps): switch MinIO image to pgsty/silo by @mguptahub in #9962
- [WEB-9400] feat: add Bulgarian language support by @anmolsinghbhatia in #10007
- [WEB-8372] fix(security): restrict state writes to project admins by @sriramveeraghanta in #10008
- [WEB-8332] fix(security): block workspace-member mass-assignment by @mguptahub in #9460
- chore(deps): resolve open Dependabot alerts by @sriramveeraghanta in #10011
- [INFRA-1096] fix: persist generated AIO secrets and avoid regenerating SECRET_KEY for an existing database by @mguptahub in #9987
- [INFRA-843] fix(security): build caddy on 2.11.7 with x/net v0.60.0 by @pratapalakshmi in #9988
- fix(api): preserve Redis TLS URL credentials and database by @HaiYangBG1 in #9979
- [SECUR-243] fix(security): scope issue comment + relation endpoints to the URL project by @mguptahub in #9531
- [SECUR-247] fix(security): require project membership to publish by @sriramveeraghanta in #10033
- chore(security): remove unused API token service flag by @sriramveeraghanta in #10032
- fix: skip external image srcs when duplicating page assets by @pablohashescobar in #9938
- [WEB-9302] fix: unsnooze expired intake items at project-timezone midnight by @pablohashescobar in #9944
- fix: use env bash in host scripts for NixOS support by @asinglesprinkle in #10030
- [GIT-384] Fix voting on published work items with no votes by @Rahulcheryala in #10103
- [INFRA-843] fix: close the 2026-10-26 nightly Trivy findings by @pratapalakshmi in #10120
- [WIKI-1268] chore: upgrade Tiptap and Hocuspocus to v3 by @sriramveeraghanta in #10101
- [WEB-8291] fix: gate project invitation list/retrieve/destroy to project admins by @mguptahub in #9444
- [WEB-8374] fix(security): scope ProjectMemberPreferenceEndpoint to the caller by @mguptahub in #9474
- [WEB-8401] fix(security): scope public Space asset mutations to the creator by @mguptahub in #9483
- [SECUR-236] fix: grouped-paginator cursor bound + Project mass-assignment by @mguptahub in #9486
- [INFRA-501] fix(security): enforce project membership on every workspace-level asset route by @mguptahub in #9657
- [INFRA-772] fix(security): stop trusting body-supplied created_by/created_at on external API by @mguptahub in #9704
- [WEB-8353] fix(security): enforce guest issue visibility on attachments + activity by @mguptahub in #9467
- [INFRA-778] fix(security): scope ExportIssuesEndpoint.get to the requesting user's own exports by @mguptahub in #9707
- [INFRA-496] fix(security): refuse routed actions served by unauthorized DRF mixins by @mguptahub in #9652
- [INFRA-499] fix(security): require workspace membership to read a global view by @mguptahub in #9653
- [INFRA-777] fix(security): scope ProjectArchiveUnarchiveAPIEndpoint to the URL project by @mguptahub in #9706
- [WEB-8400] fix(security): scope DeployBoardViewSet queryset to the URL workspace/project by @mguptahub in #9481
- fix(security): stop rendering raw comment HTML unescaped in email notifications by @kovalancik06-max in #9651
- [GIT-395]fix: keep timeline scroll position when toggling full screen by @vamsikrishnamathala in #10126
- [WIKI-1268] fix: honor collaboration forced disconnects by @saivallampati in #10121
- chore: replace mguptahub with pratapalakshmi as deployments code owner by @sriramveeraghanta in #10137
- [INFRA-843] fix: close the 2026-10-29 nightly Trivy findings by @pratapalakshmi in #10144
- fix(web): allow saving profile settings with an empty last name (#10122) by @ghazy2001 in #10147
- feat: sync web, Space and Admin UI with the Propel design system by @anmolsinghbhatia in #10038
- refactor(admin): share OAuth provider form and fix csrf input warning by @sriramveeraghanta in #10173
- fix: address design-system QA review across the web app by @anmolsinghbhatia in #10178
- fix(auth): stop shadowing base_host in space OAuth callbacks by @0xDevNinja in #9922
New Contributors
- @CoderSufiyan made their first contribution in #9715
- @adem-loghmari made their first contribution in #9318
- @houssaineamzil made their first contribution in #9526
- @Tyagiquamar made their first contribution in #9763
- @RealBhupesh made their first contribution in #9804
- @Pawel-Kranzberg made their first contribution in #9851
- @owgreen-dev made their first contribution in #9848
- @0qiudbx4q3d38ikph5 made their first contribution in #9679
- @0xdeadd made their first contribution in #9032
- @egormanga made their first contribution in #9815
- @nocx2com made their first contribution in #9639
- @Sanikaa205 made their first contribution in #9865
- @yuzhiyang1 made their first contribution in #9862
- @HaiYangBG1 made their first contribution in #9979
- @asinglesprinkle made their first contribution in #10030
- @kovalancik06-max made their first contribution in #9651
- @saivallampati made their first contribution in #10121
- @ghazy2001 made their first contribution in #10147
- @0xDevNinja made their first contribution in #9922
Full Changelog: v1.4.3...v1.5.0-rc1