This is a security release. Please update your Kaneo instance.
This release fixes permission checks for scoped API keys and custom workspace roles, protects privileged invitation links, ties MCP authorization codes to the session that approved them, and removes private integration metadata from public project responses. It also strengthens outbound request validation, prevents webhook credentials from reaching integration logs, and updates the dependencies and runtimes shipped in our images.
Updating
- Update both the API and web app to 2.47.1, or pull the matching bundled image. Back up your database and follow your normal deployment procedure.
- If people without permission to manage privileged invitations could access pending invitation IDs, cancel those invitations and send new ones after updating.
- If you delegate access through API keys, review the keys and account changes made by their owners. Revoke unexpected keys or sessions.
- If older Discord integration logs were accessible to others or sent to telemetry, rotate the affected webhook credentials.
- For installations that run on a separately managed Node.js runtime, update that runtime too. The official images now use Node.js 24.22.1.
Individual security advisories describe the affected versions and conditions: https://github.com/usekaneo/kaneo/security/advisories
Two dependency alerts still identify package versions for which we ship tested local backports: node-forge 1.4.0 and Zod 3.25.76. Their security changes and regression tests are included in this release; the scanner entries have not been suppressed.
Thanks to the people who reported these issues and helped check the fixes. Reporter credits are preserved in the individual advisories.
Client updates
- MCP 0.1.14: update pinned client configurations to
@kaneo/mcp@0.1.14and restart the client. - Android 0.3.2: install the signed APK attached to the Android release.
Bug Fixes
- security: enforce authorization and harden outbound requests: #2106
- web: preserve custom OAuth logout redirects: #2103
- web: keep saved label filters matching new assignments: #2064
- web: paste markdown into the active editor: #2102
- web: match custom-field filters before opening tasks: #2063
- i18n: complete French translations: #2101
- allow project:update to edit workflow columns and project details: #2073
- web: color priority marks by level: 9293522
- ci: budget sequential quality checks: #2089
- mobile: restore Android startup and release 0.3.1: 56f6d00
- ci: restore nightly permissions: #2088
- mobile: upgrade to Expo SDK 58 so the app launches on iOS 27: d3d1572
Documentation
- update sponsors: 9ba2e34
Credits
Huge thanks to @tinsever, @markussagens, @Hexalyse, and @randoneering for helping!