plankanban/planka v2.3.0

on GitHub

PLANKA Community 2.3.0

Board filters you can save, comment replies and @mentions in descriptions,
webhooks scoped to a project or an account, a keyboard shortcuts dialog — and a
set of hardening fixes. We recommend updating.

Security

• Sign-in limits: failed attempts are now limited per client address and per account.
• Two-factor: a pending sign-in is destroyed after repeated wrong codes, and the second factor is also asked for after updated terms are accepted.
• Protected files (avatars, background images, favicons): the session, account status and password age are checked, not only the token signature, and each route serves only its own directory.
• Link favicons: the server no longer fetches from private, loopback or link-local addresses, including after redirects and at the moment of connecting.
• Notifications and webhooks return only the public profile of the creator.
• SECRET_KEY: PLANKA warns on every start while it is missing, too short, or still the example value. If you copied notsecretkey from the example compose file, change it.
• Backups: the example backup script encrypts the archive when BACKUP_PASSPHRASE is set.
• Client and build dependencies updated (sanitize-html, svgo, js-yaml, fast-uri).

Added

• Board filters: filter by a set of lists, by unassigned cards, exclude labels (negative label filter), and save a filter under a name to pick up again later.
• Comment replies, and @name mentions in card descriptions.
• Webhook scope: fire a webhook for one project or one account instead of everything.
• Apprise control: APPRISE_ENABLED, APPRISE_ALLOWED_SCHEMAS and APPRISE_BLOCKED_SCHEMAS let operators decide which notification schemas an instance may use.
• Keyboard shortcuts dialog (user menu), plus + to add a card to the list under the pointer and F to jump to the filter search.
• List view: reorder cards by hand.
• List card counter on the add-card button, as a board setting.
• Session memory: boards reopen in the last view, lists at their last scroll position, and you return to the page you were on after signing in again.
• Unsaved card descriptions survive a browser crash and are offered back.
• Label picker as a grid of chips, tooltips on icon buttons.
• DATABASE_URL__FILE to read the whole connection string from a secret file.
• Helm chart: probe settings, defaultBaseUrl, Artifact Hub metadata.
• db:clean-orphaned-records and client:locales:check scripts.

Changed

• Missing translations filled in for all 34 languages.
• Dependencies updated, including Apprise 1.11.0.

Fixed

• Endless list pagination: no more errors on unreadable cursors, no skipped or repeated cards with an active filter.
• A card created while a filter is active no longer drops out of view.
• Helm chart: volumes are writable (fsGroup), ownership is taken once on first start, the base URL scheme follows the ingress TLS setting, the README installs from the chart repository.
• db: scripts read the database password and __FILE secrets the same way as the app.
• The container stops with a clear message when its uid cannot write the runtime directories.
• Blank home view when a membership points at a deleted project.
• Task reordering with hidden completed tasks, Enter during IME composition, Swedish date formats, validation messages on login and user settings, input validation in db:create-admin-user.

What's in PLANKA Pro

The latest Pro release, 2.5.0, brings a touch layout for phones and tablets,
five themes, a personal dashboard, cards on more than one board, timeline and
project-wide views, templates, PDF/HTML exports and live presence.
All Pro release notes are collected in #1755. More at
planka.app/pro — you can
try Pro for 30 days on your own server.

Full Changelog: v2.2.1...v2.3.0