Skip to content

Commit 4ef2fe4

Browse files
eyriehq-bot[bot]b-saikrishnakanthsriramveeraghantaanmolsinghbhatiadependabot[bot]
authored
chore(upstream): merge Plane v1.3.1 into Plane Plus (dev/v2.2.0) (#45)
* [WEB-6784] feat scrollbar in shortcuts modal (makeplane#8872) * fix: update border for project timezone * feat: added scrollbar in keyboard shortcuts modal * fix: remove unnecessary changes * fix: remove redundant overflow * [WEB-6785] fix: update border for project timezone (makeplane#8870) * chore: remove Intercom integration and chat support components (makeplane#8875) Intercom is no longer used. This removes all related frontend components, hooks, custom events, API config, types, and i18n keys. * chore: update dependencies (Django, cryptography, axios, lodash) (makeplane#8880) * chore: update dependencies (Django, cryptography, axios, lodash) - Django 4.2.29 → 4.2.30 - cryptography 46.0.6 → 46.0.7 - axios 1.13.5 → 1.15.0 - lodash 4.17.23 → 4.18.0 * chore: update lodash from 4.18.0 to 4.18.1 * [WEB-6840] feat: skip role & use-case steps for self-hosted instances (makeplane#8890) * chore(deps): bump pytest (makeplane#8891) Bumps the pip group with 1 update in the /apps/api/requirements directory: [pytest](https://github.com/pytest-dev/pytest). Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * enhance sub-issue query performance with optimized annotations and subqueries (makeplane#8889) * fix: enforce workspace membership on V2 asset endpoints (makeplane#8885) WorkspaceFileAssetEndpoint had no authorization checks beyond authentication, allowing any logged-in user to create, read, patch, and delete assets in any workspace by slug. DuplicateAssetEndpoint only authorized the destination workspace, letting users copy assets from workspaces they don't belong to. Add @allow_permission decorators to all WorkspaceFileAssetEndpoint methods and scope DuplicateAssetEndpoint's source asset lookup to workspaces where the caller is an active member. Ref: GHSA-qw87-v5w3-6vxx * fix: replace IS_SELF_MANAGED with WEBHOOK_ALLOWED_IPS allowlist (makeplane#8884) * fix: replace IS_SELF_MANAGED toggle with explicit WEBHOOK_ALLOWED_IPS allowlist Instead of blanket-allowing all private IPs on self-managed deployments, webhook URL validation now blocks all private/internal IPs by default and only permits specific networks listed in the WEBHOOK_ALLOWED_IPS env variable (comma-separated IPs/CIDRs). * fix: address PR review comments for webhook SSRF protection - Sanitize error messages to avoid leaking internal details to clients - Guard against TypeError with mixed IPv4/IPv6 allowlist networks - Re-validate webhook URL at send time to prevent DNS-rebinding - Add unit tests for mixed-version IP network allowlists * [SILO-1158] chore: add context for project in relations API (makeplane#8860) * add context for project in relations API * modify issue relation serializer * fix: sanitize filenames in upload paths to prevent path traversal (makeplane#8879) * fix: sanitize filenames in upload paths to prevent path traversal (GHSA-v57h-5999-w7xp) Add server-side filename sanitization across all file upload endpoints to prevent path traversal sequences (../) in user-supplied filenames from being incorporated into S3 object keys. While S3 keys are flat strings and not vulnerable to filesystem traversal, this adds defense-in-depth and prevents S3 key pollution. Changes: - Add sanitize_filename() utility in path_validator.py - Sanitize filenames in get_upload_path() for FileAsset and IssueAttachment models - Sanitize name parameter in all upload view endpoints * fix: address PR review feedback on filename sanitization - Remove unused `import re` - Normalize backslashes to forward slashes before os.path.basename() so Windows-style paths (e.g. ..\..\..\evil.txt) are handled on POSIX - Strip whitespace before removing leading dots so " .env" is caught - Return None instead of "unnamed" for empty input so existing `if not name` validation guards remain effective - Add `or "unnamed"` fallback at call sites that lack a name guard * fix: use random hex name as fallback in get_upload_path instead of "unnamed" * fix: resolve ruff E501 line too long in DuplicateAssetEndpoint * chore(ci): suppress CodeQL file coverage deprecation warning (makeplane#8916) * chore(ci): suppress CodeQL file coverage deprecation warning Explicitly opt into the new default behavior where CodeQL skips computing file coverage information on pull requests for improved analysis performance. * Update .github/workflows/codeql.yml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * chore: update CODEOWNERS for apps and deployments (makeplane#8919) * chore: update CODEOWNERS for apps and deployments Assign owners per app/area so reviews are routed to the right maintainers. * chore: update the codeowners * chore: add Claude Code skills for PR descriptions and release notes (makeplane#8920) * chore: add Claude Code skills for PR descriptions and release notes * chore(skills): update release-notes branches to canary->master and example version to v1.3.0 * chore(skills): address PR review comments - pr-description: infer base branch from PR metadata, fix Improvement wording, reference template's screenshot placeholder verbatim - release-notes: add `text` language to unlabeled fenced code block * chore: bump up the package version * chore(deps): bump lxml (makeplane#8925) Bumps the pip group with 1 update in the /apps/api/requirements directory: [lxml](https://github.com/lxml/lxml). Updates `lxml` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.0.0...lxml-6.1.0) --- updated-dependencies: - dependency-name: lxml dependency-version: 6.1.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump axios, uuid and add security overrides (makeplane#8930) * chore(deps): bump axios, uuid and add security overrides Bump axios 1.15.0 → 1.15.2 and uuid 13.0.0 → 14.0.0 in the catalog, and add pnpm overrides pinning postcss >=8.5.10, follow-redirects >=1.16.0, and routing axios/uuid through the catalog. * fix: overrides * fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets (makeplane#9078) * fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets The IP-based allowlist alone isn't practical for containerised deployments where service IPs are dynamic. Adds a hostname-based bypass for trusted internal services (e.g. Silo via docker-compose / k8s service DNS) and makes the previously hardcoded ["plane.so"] domain blocklist configurable via WEBHOOK_DISALLOWED_DOMAINS. - validate_url accepts allowed_hosts (exact, case-insensitive match; skips DNS lookup for trusted names) - WebhookSerializer wires both settings through and lets allowlisted hosts bypass the disallowed-domain check - Exposes WEBHOOK_ALLOWED_HOSTS in aio/cli deployment env files * fix: default WEBHOOK_DISALLOWED_DOMAINS to empty for self-hosted * fix: pass WEBHOOK_ALLOWED_HOSTS to send-time webhook re-validation * fix: pnpm path for Docker builds (makeplane#9079) Add $PNPM_HOME/bin to PATH so corepack-installed pnpm binaries are resolvable during Docker builds. * fix(brand): replace upstream Plane logos and copy with Plane Plus in onboarding screens - not-ready-view.tsx: swap gradient-logo.webp (3D Plane diamond) → EyrieHQ icon; "Welcome to Plane" → "Welcome to Plane Plus" - tour/root.tsx: "Welcome to Plane, {name}" → "Welcome to Plane Plus, {name}"; copy updated to match - admin/instance-not-ready.tsx: drop PlaneTakeOffImage → EyrieHQ icon; "Welcome aboard Plane!" → "Welcome aboard Plane Plus!" - admin/new-user-popup.tsx: drop TakeoffIcon SVGs + unused theme imports → EyrieHQ icon; "Welcome to Plane instance portal" → "Welcome to Plane Plus" --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: b-saikrishnakanth <130811169+b-saikrishnakanth@users.noreply.github.com> Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com> Co-authored-by: Anmol Singh Bhatia <121005188+anmolsinghbhatia@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Phạm Nguyên Phương <69796528+PhuongPN6689@users.noreply.github.com> Co-authored-by: Saurabh Kumar <70131915+Saurabhkmr98@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: EyrieHQ <eyriehq@eyriehq.com> Co-authored-by: Surya <surya@eyriehq.com>
1 parent fa0870d commit 4ef2fe4

87 files changed

Lines changed: 969 additions & 650 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.claude/skills/pr-description.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
name: pr-description
3+
description: Generate a PR description following the project's GitHub PR template. Analyzes the current branch's changes against the base branch to produce a complete, filled-out PR description.
4+
user_invocable: true
5+
---
6+
7+
# PR Description Generator
8+
9+
Generate a pull request description based on the project's PR template at `.github/pull_request_template.md`.
10+
11+
## Steps
12+
13+
1. **Determine the base branch**: Prefer the PR's actual `baseRefName` (via `gh pr view <PR> --json baseRefName`) when a PR exists. Otherwise default by intent — feature PRs target `preview`, release PRs target `master`. If still ambiguous, ask the user.
14+
15+
2. **Analyze changes**: Run the following to understand what changed:
16+
- `git log <base>...HEAD --oneline` to see all commits on this branch
17+
- `git diff <base>...HEAD --stat` to see which files changed
18+
- `git diff <base>...HEAD` to read the actual diff (use `--no-color`)
19+
- If the diff is very large, focus on the most important files first
20+
21+
3. **Fill out the PR template** with the following sections:
22+
23+
### Description
24+
25+
Write a clear, concise summary of what the PR does and why. Focus on the "what" and "why", not line-by-line changes. Mention any important implementation decisions.
26+
27+
### Type of Change
28+
29+
Check the appropriate box(es) based on the changes:
30+
- Bug fix (non-breaking change which fixes an issue)
31+
- Feature (non-breaking change which adds functionality)
32+
- Improvement (non-breaking change that improves existing functionality)
33+
- Code refactoring
34+
- Performance improvements
35+
- Documentation update
36+
37+
### Screenshots and Media
38+
39+
Leave this section for the user to fill in, preserving the existing placeholder comment from `.github/pull_request_template.md` verbatim rather than introducing different text.
40+
41+
### Test Scenarios
42+
43+
Based on the code changes, suggest specific test scenarios that should be verified. Be concrete (e.g., "Navigate to project settings and verify the new toggle works") rather than generic.
44+
45+
### References
46+
- If commit messages or branch name reference a work item identifier (e.g., `WEB-1234`), include it
47+
- If the user provides a linked issue, include it
48+
- If Sentry issue links or IDs (e.g., `SENTRY-ABC123`, Sentry URLs) were mentioned earlier in the conversation, include them as references
49+
50+
4. **Output format**: Print the filled-out markdown template so the user can copy it directly. Do NOT wrap it in a code fence — output the raw markdown.
51+
52+
## Guidelines
53+
54+
- Keep the description concise but informative
55+
- Use bullet points for multiple changes
56+
- Focus on user-facing impact, not implementation details
57+
- If the branch has a Plane work item ID in its name (e.g., `WEB-1234`), reference it
58+
- Don't fabricate test scenarios that aren't relevant to the actual changes

.claude/skills/release-notes.md

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
---
2+
name: release-notes
3+
description: "Generate release notes for a Plane release PR in `makeplane/plane` (semver, e.g. `release: vX.Y.Z`). Reads PR commits, filters out noise, categorizes by conventional-commit type, optionally enriches via Plane MCP, and writes the result as the PR description."
4+
user_invocable: true
5+
---
6+
7+
# Release Notes Generator
8+
9+
Generate structured release notes from a Plane release PR by parsing its commit list, then update the PR description.
10+
11+
## Versioning
12+
13+
Plane community uses **semver** (`vX.Y.Z`, major.minor.patch) for releases.
14+
15+
- PR title format: `release: vX.Y.Z`
16+
- Source branch: `canary`
17+
- Target branch: `master`
18+
19+
## When to Use
20+
21+
- User links/mentions a Plane release PR (e.g. `release: v1.3.0`) and asks for release notes
22+
- User asks to "create release notes" / "update PR description" for a release PR in `makeplane/plane`
23+
- The branch is named `canary` or `release/x.y.z` and the base is `master`
24+
25+
## Steps
26+
27+
### 1. Fetch commits
28+
29+
```bash
30+
gh pr view <PR_NUM> --json title,body,baseRefName,headRefName,commits \
31+
--jq '.commits[] | .messageHeadline + "\n---BODY---\n" + .messageBody + "\n===END==="'
32+
```
33+
34+
For a quick scan first:
35+
36+
```bash
37+
gh pr view <PR_NUM> --json commits \
38+
--jq '.commits[] | {oid: .oid[0:10], message: .messageHeadline}'
39+
```
40+
41+
### 2. Filter out noise
42+
43+
**Always exclude** these commits — mechanical, not user-facing:
44+
45+
| Pattern | Reason |
46+
| -------------------------------------------- | -------------- |
47+
| `fix: merge conflicts` | Merge artifact |
48+
| `Merge branch '...' of github.com:...` | Merge artifact |
49+
| `Revert "..."` (when immediately re-applied) | Internal churn |
50+
51+
### 3. Parse work item IDs
52+
53+
Most meaningful commits begin with a Plane work item identifier in brackets:
54+
55+
- `[WEB-XXXX]` — web/frontend product items
56+
- `[SILO-XXXX]` — Silo (integrations: Slack, GitHub, GitLab, Jira/Linear)
57+
- `[MOBILE-XXXX]`, `[API-XXXX]`, etc.
58+
59+
Always preserve these IDs in the release notes — they let readers click through to the source ticket.
60+
61+
### 4. (Optional) Enrich via Plane MCP
62+
63+
For larger features where the commit headline is terse, fetch the work item:
64+
65+
```text
66+
mcp__plane__retrieve_work_item_by_identifier(project_identifier="WEB", issue_identifier=6874)
67+
```
68+
69+
Use the returned `name` and `description_stripped` to flesh out the bullet. Skip this for routine fixes — commit body is usually enough. Don't enrich every item (slow + work item descriptions are often empty).
70+
71+
### 5. Categorize by conventional-commit type
72+
73+
| Commit prefix | Section |
74+
| -------------------------------- | ------------------- |
75+
| `feat:`, `feat(scope):` | ✨ New Features |
76+
| `fix:`, `fix(scope):` | 🐛 Bug Fixes |
77+
| `refactor:` | 🔧 Refactor & Chore |
78+
| `chore:`, `chore(scope):` | 🔧 Refactor & Chore |
79+
| `chore(deps):`, dependabot bumps | 📦 Dependencies |
80+
81+
### 6. Format
82+
83+
```markdown
84+
# Release vX.Y.Z
85+
86+
## ✨ New Features
87+
88+
- **<Short title>**[WEB-XXXX] (#PR_NUM)
89+
Optional 1–2 sentence elaboration drawn from commit body.
90+
91+
## 🐛 Bug Fixes
92+
93+
- **<Short title>**[WEB-XXXX] (#PR_NUM)
94+
95+
## 🔧 Refactor & Chore
96+
97+
- **<Short title>**[WEB-XXXX] (#PR_NUM)
98+
99+
## 📦 Dependencies
100+
101+
- Bump `<package>` X.Y.Z → A.B.C (#PR_NUM)
102+
```
103+
104+
Rules:
105+
106+
- Lead with a bold human-readable title (rewrite the commit subject if cryptic)
107+
- Always include the work item ID in brackets and the merge PR number in parens
108+
- Add a sub-line elaboration only when the commit body has substance worth surfacing (acceptance criteria, scope notes, gotchas like "behind feature flag", "requires migration", "requires Vercel setting")
109+
- Drop empty sections
110+
111+
### 7. Update the PR description
112+
113+
```bash
114+
gh pr edit <PR_NUM> --body "$(cat <<'EOF'
115+
<release notes markdown>
116+
EOF
117+
)"
118+
```
119+
120+
Always use a HEREDOC with single-quoted `'EOF'` so backticks/dollars in the notes are preserved.
121+
122+
## Quick Reference: end-to-end
123+
124+
```bash
125+
PR=2498
126+
gh pr view $PR --json commits --jq '.commits[] | .messageHeadline + "\n---\n" + .messageBody + "\n==="' > /tmp/commits.txt
127+
# read /tmp/commits.txt, filter, categorize, draft notes
128+
gh pr edit $PR --body "$(cat <<'EOF'
129+
... release notes ...
130+
EOF
131+
)"
132+
```
133+
134+
## Common Mistakes
135+
136+
- **Including `fix: merge conflicts`** — merge artifact, no functional content
137+
- **Dropping the work item ID** — readers rely on `[WEB-XXXX]` to navigate to the ticket
138+
- **Over-enriching with MCP lookups** — work item descriptions are often empty; commit body is usually richer
139+
- **Missing the merge PR number** — always include `(#NNNN)` from the commit subject so reviewers can audit the source PR
140+
- **Using `--body` without HEREDOC** — backticks/dollar signs get shell-interpreted and corrupt the notes
141+
- **Editing the title** — release PR titles are version markers; only edit the body
142+
143+
## Plane-Specific Conventions
144+
145+
- Release PRs go from `canary``master`
146+
- PR title format: `release: vX.Y.Z` semver (major.minor.patch)
147+
- Commits coming from feature branches always carry a work item ID; commits without one are usually infra/chores

.github/workflows/codeql.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ jobs:
1616
contents: read
1717
security-events: write
1818

19+
env:
20+
CODEQL_ACTION_FILE_COVERAGE_ON_PRS: "false"
21+
1922
strategy:
2023
fail-fast: false
2124
matrix:

CODEOWNERS

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,8 @@
1-
eslint.config.mjs @lifeiscontent
1+
.oxlintrc.json @sriramveeraghanta @lifeiscontent
2+
.oxfmtrc.json @sriramveeraghanta @lifeiscontent
3+
apps/api/ @dheeru0198 @pablohashescobar
4+
apps/web/ @sriramveeraghanta
5+
apps/space/ @sriramveeraghanta
6+
apps/admin/ @sriramveeraghanta
7+
apps/live/ @Palanikannan1437
8+
deployments/ @mguptahub

apps/admin/Dockerfile.admin

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ WORKDIR /app
44

55
ENV TURBO_TELEMETRY_DISABLED=1
66
ENV PNPM_HOME="/pnpm"
7-
ENV PATH="$PNPM_HOME:$PATH"
7+
ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
88
ENV CI=1
99

1010
RUN corepack enable pnpm

apps/admin/app/(all)/(dashboard)/general/form.tsx

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ import { Input, ToggleSwitch } from "@plane/ui";
1616
import { ControllerInput } from "@/components/common/controller-input";
1717
// hooks
1818
import { useInstance } from "@/hooks/store";
19-
// components
20-
import { IntercomConfig } from "./intercom";
2119

2220
export interface IGeneralConfigurationForm {
2321
instance: IInstance;
@@ -27,14 +25,13 @@ export interface IGeneralConfigurationForm {
2725
export const GeneralConfigurationForm = observer(function GeneralConfigurationForm(props: IGeneralConfigurationForm) {
2826
const { instance, instanceAdmins } = props;
2927
// hooks
30-
const { instanceConfigurations, updateInstanceInfo, updateInstanceConfigurations } = useInstance();
28+
const { updateInstanceInfo } = useInstance();
3129

3230
// form data
3331
const {
3432
handleSubmit,
3533
control,
3634
formState: { errors, isSubmitting },
37-
watch,
3835
} = useForm<Partial<IInstance>>({
3936
defaultValues: {
4037
instance_name: instance?.instance_name,
@@ -45,17 +42,6 @@ export const GeneralConfigurationForm = observer(function GeneralConfigurationFo
4542
const onSubmit = async (formData: Partial<IInstance>) => {
4643
const payload: Partial<IInstance> = { ...formData };
4744

48-
// update the intercom configuration
49-
const isIntercomEnabled =
50-
instanceConfigurations?.find((config) => config.key === "IS_INTERCOM_ENABLED")?.value === "1";
51-
if (!payload.is_telemetry_enabled && isIntercomEnabled) {
52-
try {
53-
await updateInstanceConfigurations({ IS_INTERCOM_ENABLED: "0" });
54-
} catch (error) {
55-
console.error(error);
56-
}
57-
}
58-
5945
await updateInstanceInfo(payload)
6046
.then(() =>
6147
setToast({
@@ -112,8 +98,7 @@ export const GeneralConfigurationForm = observer(function GeneralConfigurationFo
11298
</div>
11399

114100
<div className="space-y-6">
115-
<div className="border-b border-subtle pb-1.5 text-16 font-medium text-primary">Chat + telemetry</div>
116-
<IntercomConfig isTelemetryEnabled={watch("is_telemetry_enabled") ?? false} />
101+
<div className="border-b border-subtle pb-1.5 text-16 font-medium text-primary">Telemetry</div>
117102
<div className="flex items-center gap-14">
118103
<div className="flex grow items-center gap-4">
119104
<div className="shrink-0">

apps/admin/app/(all)/(dashboard)/general/intercom.tsx

Lines changed: 0 additions & 86 deletions
This file was deleted.

0 commit comments

Comments
 (0)