release: v1.4.1 - #9545
Open
sriramveeraghanta wants to merge 9 commits into
Open
Conversation
* feat: add command to reactivate workspace members with error handling * fix: address review comments on reactivate command - normalize email input to match User.save lowercasing - fix grammar in error messages - limit save to is_active so audit fields are not clobbered Claude-Session: https://claude.ai/code/session_01NGjXVUi4D8JGWy7b7KDNaN * fix: normalize inputs before validation and report partial reactivation - strip slug/email before the required checks so whitespace-only args are rejected - bump updated_at and pass disable_auto_set_user so the audit fields survive - report the restored role, inactive project memberships, and inactive accounts Claude-Session: https://claude.ai/code/session_01NGjXVUi4D8JGWy7b7KDNaN --------- Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com>
list() omitted the trailing slash while every sibling method and the Django route require /users/notifications/. Self-hosted (Traefik) surfaces the upstream 404 as 500; unread badge still works. Fixes #9489
Added an annotation to the WorkspaceModulesEndpoint to aggregate member IDs into an array, ensuring that only active members are included. This change improves the data structure returned by the API, allowing for better handling of member information in the frontend. Updated the corresponding utility function to handle potential null values for member IDs.
… Create View modal (#9542) Replaced the icon button styling with a more generic button styling for the dropdown component to ensure consistency across the UI. This change enhances the visual coherence of the dropdown button's appearance.
sriramveeraghanta
requested review from
dheeru0198 and
pablohashescobar
as code owners
August 4, 2026 14:31
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
React Doctor found 3 new issues in 3 files · 3 warnings · score 89 / 100 (Great) · 3 fixed · vs 3 warnings
Reviewed by React Doctor for commit |
Contributor
There was a problem hiding this comment.
🟢 Ready to approve
The changes are low-risk and consistent with existing patterns, with only a minor optional performance nit noted in the module ordering helper.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Release v1.4.1 updates several small areas across docs, frontend utilities/UI, services, and the API to improve module/member handling, align notification endpoints, and add an admin utility command.
Changes:
- Add “Managed hosting” (Zenith) option to the README getting-started table.
- Improve module client-side ordering/filtering robustness and align workspace module API payloads with
member_ids. - Normalize workspace notification API calls to the canonical trailing-slash route and add a management command to reactivate workspace members.
File summaries
| File | Description |
|---|---|
| README.md | Adds a managed hosting deployment option link/button. |
| packages/utils/src/module.ts | Uses toSorted() for name ordering and guards member_ids against undefined. |
| packages/services/src/workspace/notification.service.ts | Updates notifications endpoint to include trailing slash. |
| apps/web/core/services/workspace-notification.service.ts | Updates notifications endpoint to include trailing slash (web app). |
| apps/web/core/components/dropdowns/layout.tsx | Switches dropdown button styling helper to standard button styling. |
| apps/api/plane/db/management/commands/reactivate_workspace_member.py | Adds Django management command to reactivate an inactive workspace member. |
| apps/api/plane/app/views/workspace/module.py | Annotates workspace modules with member_ids via ArrayAgg + Coalesce for consistent API output. |
Review details
- Files reviewed: 7/7 changed files
- Comments generated: 1
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
* fix(api): enforce FILE_SIZE_LIMIT on published Space asset upload
The public Space asset upload endpoint
(POST /api/public/assets/v2/anchor/{anchor}/) trusted the client-supplied
`size` value end-to-end: it was stored on the FileAsset and passed straight
to generate_presigned_post(), which uses it as the S3/MinIO policy bound
(["content-length-range", 1, file_size]). This let an authenticated user
obtain a signed upload policy exceeding the instance's FILE_SIZE_LIMIT.
Cap the value with `size_limit = min(size, settings.FILE_SIZE_LIMIT)` and use
it consistently for the stored asset metadata and the presigned POST policy,
matching every other asset upload endpoint.
* fix(api): clamp Space asset size to a valid lower bound
Address review feedback: reject malformed (non-integer) `size` with 400 and
clamp the value to [1, FILE_SIZE_LIMIT] via max(1, min(...)) so the presigned
content-length-range is always valid and no non-positive size is persisted.
…ashes (#9546) * fix: filter out undefined label options in issue properties components Updated the mapping of label IDs to ensure that only defined label options are included in the defaultLabelOptions array across multiple components. This change enhances the robustness of the label handling in the IssueProperties and SpreadsheetLabelColumn components, as well as in the PeekOverviewProperties component. * fix: ensure array checks for results in various components Updated multiple components to include checks for array types before accessing results. This change enhances stability by preventing potential runtime errors when results are undefined or not an array. Affected components include DescriptionVersionsRoot, PrevExports, SingleIntegrationCard, ProfileActivity, and IssueSubIssuesStore. * fix: wrap children in LayoutErrorBoundary for improved error handling Updated the IssueLayoutHOC component to include LayoutErrorBoundary, enhancing error handling by wrapping the children. This change aims to provide a more robust user experience by catching layout-related errors effectively. * fix: optimize handleRefresh with useCallback in PrevExports component Refactored the handleRefresh function in the PrevExports component to use useCallback, improving performance by memoizing the function. Additionally, updated the useEffect dependency array to include handleRefresh, ensuring the effect runs correctly when dependencies change. This change enhances the efficiency of the component's refresh logic. * fix: enhance LayoutErrorBoundary with retry functionality and improved error messaging Refactored the LayoutErrorBoundary component to include a dedicated LayoutErrorFallback for better error presentation. Added a retry mechanism that allows users to attempt to reload the content after an error occurs. This change improves user experience by providing clearer messaging and a more interactive way to recover from errors. * fix: improve label option handling and array checks in various components Refactored the defaultLabelOptions logic in multiple components to use flatMap for better handling of undefined labels. Additionally, updated array checks in the PrevExports component to ensure results are properly validated before access. These changes enhance the robustness and stability of the components, preventing potential runtime errors. * fix: refactor ProfileActivity component for improved loading and data handling Updated the ProfileActivity component to enhance the loading state management and streamline the rendering of user activity results. The refactor includes a more efficient check for userProfileActivity, ensuring that loading indicators and empty states are displayed correctly. This change improves the user experience by providing clearer feedback during data fetching and handling scenarios with no activity results. * fix: improve type safety and array handling in integration card and sub-issues store Updated the SingleIntegrationCard component to use a specific type for workspace integrations, enhancing type safety. Additionally, refactored the subIssues assignment in the IssueSubIssuesStore to ensure it correctly checks for an array before assignment, improving stability and preventing potential runtime errors. * fix: enhance handleRefresh in PrevExports component with error handling Refactored the handleRefresh function in the PrevExports component to include error handling during the refresh process. The function now uses async/await for better readability and ensures that any errors during the mutation are logged, improving the robustness of the component's refresh logic. * style: fix oxfmt formatting flagged by CI check:format Multi-line flatMap guard needed reformatting to satisfy oxfmt. * style: reformat defaultLabelOptions logic for consistency Adjusted the formatting of the defaultLabelOptions logic in the DraftIssueProperties component to maintain consistency with the project's coding standards. This change enhances readability without altering functionality.
Python (apps/api): - cryptography 48.0.1 -> 50.0.0 (PKCS#7 Bleichenbacher oracle, high) npm (pnpm-workspace.yaml catalog/overrides + lockfile): - react-router 7.15.1 -> 7.18.1, @react-router/dev -> 7.17.0, @react-router/node/serve -> 7.18.1 (DoS, open redirect, XSS, constructor injection) - sharp ^0.34.3 -> ^0.35.3 (libvips CVEs, high) - fast-uri -> 3.1.5 via override (host confusion, high) - js-yaml -> 4.3.0 via override (quadratic CPU DoS, high) - linkify-it -> 5.0.2 via override (mailto validator DoS, high) - postcss 8.5.15 -> 8.5.25 (source map path traversal, high/medium) - undici -> 7.29.0 via override (info disclosure, CRLF/cookie injection) - sanitize-html 2.17.0 -> 2.17.5 (URI scheme validation bypass, medium) - valibot -> 1.4.2 via override (flatten() throw, medium) - body-parser -> 1.20.6 via override (limit bypass DoS, low)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ Features
Workspace Member Reactivation Command
Self-hosted administrators can now restore a deactivated workspace member straight from the command line, without editing the database by hand. Running
reactivate_workspace_member <workspace-slug> <email>re-enables the membership and reports the role the member is restored to.⬆️ Enhancements
🐞 Bug fixes
🛡️ Security
FILE_SIZE_LIMIT. The size is now clamped to the instance limit and malformed values are rejected.cryptographyto 50.0.0 to close a high-severity PKCS#7 Bleichenbacher oracle.sharpto 0.35.3 to pick up high-severity libvips fixes.fast-uri(host confusion),js-yaml(quadratic CPU denial of service),linkify-it(mailto validator denial of service),postcss(source map path traversal), andundici(information disclosure, CRLF and cookie injection).sanitize-html(URI scheme validation bypass),valibot, andbody-parser(request limit bypass).