fix(aio): use JSON array double quotes in VOLUME instruction (#9099)

The community AIO Dockerfile declared the VOLUME instruction with
single quotes: VOLUME ['/app/data', '/app/logs']. Docker's JSON (exec)
form requires double quotes; with single quotes the line is parsed as
the shell form and the bracket/comma tokens become literal volume
paths ('[/app/data,' and '/app/logs]').

Docker tolerated these non-absolute anonymous volume paths at container
create time until Engine 29.5.0, which now rejects them with
"invalid mount config for type volume: invalid mount path: '[/app/data,'
mount path must be absolute", breaking `docker compose up --force-recreate`
and any container recreation for the AIO community image.

Switching to the valid JSON array form fixes the parsing.

.claude/skills/pr-description.md

@@ -0,0 +1,58 @@
+---
+name: pr-description
+description: Generate a PR description following the project's GitHub PR template. Analyzes the current branch's changes against the base branch to produce a complete, filled-out PR description.
+user_invocable: true
+---
+
+# PR Description Generator
+
+Generate a pull request description based on the project's PR template at `.github/pull_request_template.md`.
+
+## Steps
+
+1. **Determine the base branch**: Prefer the PR's actual `baseRefName` (via `gh pr view <PR> --json baseRefName`) when a PR exists. Otherwise default by intent — feature PRs target `preview`, release PRs target `master`. If still ambiguous, ask the user.
+
+2. **Analyze changes**: Run the following to understand what changed:
+   - `git log <base>...HEAD --oneline` to see all commits on this branch
+   - `git diff <base>...HEAD --stat` to see which files changed
+   - `git diff <base>...HEAD` to read the actual diff (use `--no-color`)
+   - If the diff is very large, focus on the most important files first
+
+3. **Fill out the PR template** with the following sections:
+
+   ### Description
+
+   Write a clear, concise summary of what the PR does and why. Focus on the "what" and "why", not line-by-line changes. Mention any important implementation decisions.
+
+   ### Type of Change
+
+   Check the appropriate box(es) based on the changes:
+   - Bug fix (non-breaking change which fixes an issue)
+   - Feature (non-breaking change which adds functionality)
+   - Improvement (non-breaking change that improves existing functionality)
+   - Code refactoring
+   - Performance improvements
+   - Documentation update
+
+   ### Screenshots and Media
+
+   Leave this section for the user to fill in, preserving the existing placeholder comment from `.github/pull_request_template.md` verbatim rather than introducing different text.
+
+   ### Test Scenarios
+
+   Based on the code changes, suggest specific test scenarios that should be verified. Be concrete (e.g., "Navigate to project settings and verify the new toggle works") rather than generic.
+
+   ### References
+   - If commit messages or branch name reference a work item identifier (e.g., `WEB-1234`), include it
+   - If the user provides a linked issue, include it
+   - If Sentry issue links or IDs (e.g., `SENTRY-ABC123`, Sentry URLs) were mentioned earlier in the conversation, include them as references
+
+4. **Output format**: Print the filled-out markdown template so the user can copy it directly. Do NOT wrap it in a code fence — output the raw markdown.
+
+## Guidelines
+
+- Keep the description concise but informative
+- Use bullet points for multiple changes
+- Focus on user-facing impact, not implementation details
+- If the branch has a Plane work item ID in its name (e.g., `WEB-1234`), reference it
+- Don't fabricate test scenarios that aren't relevant to the actual changes

.claude/skills/release-notes.md

@@ -0,0 +1,147 @@
+---
+name: release-notes
+description: "Generate release notes for a Plane release PR in `makeplane/plane` (semver, e.g. `release: vX.Y.Z`). Reads PR commits, filters out noise, categorizes by conventional-commit type, optionally enriches via Plane MCP, and writes the result as the PR description."
+user_invocable: true
+---
+
+# Release Notes Generator
+
+Generate structured release notes from a Plane release PR by parsing its commit list, then update the PR description.
+
+## Versioning
+
+Plane community uses **semver** (`vX.Y.Z`, major.minor.patch) for releases.
+
+- PR title format: `release: vX.Y.Z`
+- Source branch: `canary`
+- Target branch: `master`
+
+## When to Use
+
+- User links/mentions a Plane release PR (e.g. `release: v1.3.0`) and asks for release notes
+- User asks to "create release notes" / "update PR description" for a release PR in `makeplane/plane`
+- The branch is named `canary` or `release/x.y.z` and the base is `master`
+
+## Steps
+
+### 1. Fetch commits
+
+```bash
+gh pr view <PR_NUM> --json title,body,baseRefName,headRefName,commits \
+  --jq '.commits[] | .messageHeadline + "\n---BODY---\n" + .messageBody + "\n===END==="'
+```
+
+For a quick scan first:
+
+```bash
+gh pr view <PR_NUM> --json commits \
+  --jq '.commits[] | {oid: .oid[0:10], message: .messageHeadline}'
+```
+
+### 2. Filter out noise
+
+**Always exclude** these commits — mechanical, not user-facing:
+
+| Pattern                                      | Reason         |
+| -------------------------------------------- | -------------- |
+| `fix: merge conflicts`                       | Merge artifact |
+| `Merge branch '...' of github.com:...`       | Merge artifact |
+| `Revert "..."` (when immediately re-applied) | Internal churn |
+
+### 3. Parse work item IDs
+
+Most meaningful commits begin with a Plane work item identifier in brackets:
+
+- `[WEB-XXXX]` — web/frontend product items
+- `[SILO-XXXX]` — Silo (integrations: Slack, GitHub, GitLab, Jira/Linear)
+- `[MOBILE-XXXX]`, `[API-XXXX]`, etc.
+
+Always preserve these IDs in the release notes — they let readers click through to the source ticket.
+
+### 4. (Optional) Enrich via Plane MCP
+
+For larger features where the commit headline is terse, fetch the work item:
+
+```text
+mcp__plane__retrieve_work_item_by_identifier(project_identifier="WEB", issue_identifier=6874)
+```
+
+Use the returned `name` and `description_stripped` to flesh out the bullet. Skip this for routine fixes — commit body is usually enough. Don't enrich every item (slow + work item descriptions are often empty).
+
+### 5. Categorize by conventional-commit type
+
+| Commit prefix                    | Section             |
+| -------------------------------- | ------------------- |
+| `feat:`, `feat(scope):`          | ✨ New Features     |
+| `fix:`, `fix(scope):`            | 🐛 Bug Fixes        |
+| `refactor:`                      | 🔧 Refactor & Chore |
+| `chore:`, `chore(scope):`        | 🔧 Refactor & Chore |
+| `chore(deps):`, dependabot bumps | 📦 Dependencies     |
+
+### 6. Format
+
+```markdown
+# Release vX.Y.Z
+
+## ✨ New Features
+
+- **<Short title>** — [WEB-XXXX] (#PR_NUM)
+  Optional 1–2 sentence elaboration drawn from commit body.
+
+## 🐛 Bug Fixes
+
+- **<Short title>** — [WEB-XXXX] (#PR_NUM)
+
+## 🔧 Refactor & Chore
+
+- **<Short title>** — [WEB-XXXX] (#PR_NUM)
+
+## 📦 Dependencies
+
+- Bump `<package>` X.Y.Z → A.B.C (#PR_NUM)
+```
+
+Rules:
+
+- Lead with a bold human-readable title (rewrite the commit subject if cryptic)
+- Always include the work item ID in brackets and the merge PR number in parens
+- Add a sub-line elaboration only when the commit body has substance worth surfacing (acceptance criteria, scope notes, gotchas like "behind feature flag", "requires migration", "requires Vercel setting")
+- Drop empty sections
+
+### 7. Update the PR description
+
+```bash
+gh pr edit <PR_NUM> --body "$(cat <<'EOF'
+<release notes markdown>
+EOF
+)"
+```
+
+Always use a HEREDOC with single-quoted `'EOF'` so backticks/dollars in the notes are preserved.
+
+## Quick Reference: end-to-end
+
+```bash
+PR=2498
+gh pr view $PR --json commits --jq '.commits[] | .messageHeadline + "\n---\n" + .messageBody + "\n==="' > /tmp/commits.txt
+# read /tmp/commits.txt, filter, categorize, draft notes
+gh pr edit $PR --body "$(cat <<'EOF'
+... release notes ...
+EOF
+)"
+```
+
+## Common Mistakes
+
+- **Including `fix: merge conflicts`** — merge artifact, no functional content
+- **Dropping the work item ID** — readers rely on `[WEB-XXXX]` to navigate to the ticket
+- **Over-enriching with MCP lookups** — work item descriptions are often empty; commit body is usually richer
+- **Missing the merge PR number** — always include `(#NNNN)` from the commit subject so reviewers can audit the source PR
+- **Using `--body` without HEREDOC** — backticks/dollar signs get shell-interpreted and corrupt the notes
+- **Editing the title** — release PR titles are version markers; only edit the body
+
+## Plane-Specific Conventions
+
+- Release PRs go from `canary` → `master`
+- PR title format: `release: vX.Y.Z` semver (major.minor.patch)
+- Commits coming from feature branches always carry a work item ID; commits without one are usually infra/chores

.github/workflows/codeql.yml

@@ -16,6 +16,9 @@ jobs:
       contents: read
       security-events: write
 
+    env:
+      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: "false"
+
     strategy:
       fail-fast: false
       matrix:

.github/workflows/i18n-sync-check.yml

@@ -0,0 +1,51 @@
+name: i18n sync check
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "preview"
+    types:
+      - "opened"
+      - "synchronize"
+      - "reopened"
+      - "ready_for_review"
+    paths:
+      - "packages/i18n/**"
+      - ".github/workflows/i18n-sync-check.yml"
+  push:
+    branches:
+      - "preview"
+    paths:
+      - "packages/i18n/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync-check:
+    name: check:sync
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.event_name == 'push' || github.event.pull_request.draft == false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          filter: blob:none
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22.18.0"
+
+      - name: Enable Corepack and pnpm
+        run: corepack enable pnpm
+
+      - name: Run sync check
+        run: pnpm dlx tsx packages/i18n/scripts/sync-check.ts --ci

.gitignore

@@ -110,3 +110,7 @@ build/
 .react-router/
 temp/
 scripts/
+!packages/i18n/scripts/
+
+# i18n auto-generated types (regenerated on every build)
+packages/i18n/src/types/keys.generated.ts

CODEOWNERS

@@ -1 +1,8 @@
-eslint.config.mjs   @lifeiscontent
+.oxlintrc.json   @sriramveeraghanta @lifeiscontent
+.oxfmtrc.json   @sriramveeraghanta @lifeiscontent
+apps/api/           @dheeru0198 @pablohashescobar
+apps/web/           @sriramveeraghanta
+apps/space/         @sriramveeraghanta
+apps/admin/         @sriramveeraghanta
+apps/live/          @Palanikannan1437
+deployments/        @mguptahub

README.md

@@ -10,7 +10,7 @@
 <p align="center">
     <a href="https://plane.so/"><b>Website</b></a> •
     <a href="https://forum.plane.so"><b>Forum</b></a> •
-    <a href="https://twitter.com/planepowers"><b>Twitter</b></a> •
+    <a href="https://x.com/planepowers"><b>X</b></a> •
     <a href="https://docs.plane.so/"><b>Documentation</b></a>
 </p>
 

apps/admin/Dockerfile.admin

@@ -4,7 +4,7 @@ WORKDIR /app
 
 ENV TURBO_TELEMETRY_DISABLED=1
 ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
+ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
 ENV CI=1
 
 RUN corepack enable pnpm

apps/admin/app/(all)/(dashboard)/general/form.tsx

@@ -16,8 +16,6 @@ import { Input, ToggleSwitch } from "@plane/ui";
 import { ControllerInput } from "@/components/common/controller-input";
 // hooks
 import { useInstance } from "@/hooks/store";
-// components
-import { IntercomConfig } from "./intercom";
 
 export interface IGeneralConfigurationForm {
   instance: IInstance;
@@ -27,14 +25,13 @@ export interface IGeneralConfigurationForm {
 export const GeneralConfigurationForm = observer(function GeneralConfigurationForm(props: IGeneralConfigurationForm) {
   const { instance, instanceAdmins } = props;
   // hooks
-  const { instanceConfigurations, updateInstanceInfo, updateInstanceConfigurations } = useInstance();
+  const { updateInstanceInfo } = useInstance();
 
   // form data
   const {
     handleSubmit,
     control,
     formState: { errors, isSubmitting },
-    watch,
   } = useForm<Partial<IInstance>>({
     defaultValues: {
       instance_name: instance?.instance_name,
@@ -45,17 +42,6 @@ export const GeneralConfigurationForm = observer(function GeneralConfigurationFo
   const onSubmit = async (formData: Partial<IInstance>) => {
     const payload: Partial<IInstance> = { ...formData };
 
-    // update the intercom configuration
-    const isIntercomEnabled =
-      instanceConfigurations?.find((config) => config.key === "IS_INTERCOM_ENABLED")?.value === "1";
-    if (!payload.is_telemetry_enabled && isIntercomEnabled) {
-      try {
-        await updateInstanceConfigurations({ IS_INTERCOM_ENABLED: "0" });
-      } catch (error) {
-        console.error(error);
-      }
-    }
-
     await updateInstanceInfo(payload)
       .then(() =>
         setToast({
@@ -112,8 +98,7 @@ export const GeneralConfigurationForm = observer(function GeneralConfigurationFo
       </div>
 
       <div className="space-y-6">
-        <div className="border-b border-subtle pb-1.5 text-16 font-medium text-primary">Chat + telemetry</div>
-        <IntercomConfig isTelemetryEnabled={watch("is_telemetry_enabled") ?? false} />
+        <div className="border-b border-subtle pb-1.5 text-16 font-medium text-primary">Telemetry</div>
         <div className="flex items-center gap-14">
           <div className="flex grow items-center gap-4">
             <div className="shrink-0">

apps/admin/app/(all)/(dashboard)/general/intercom.tsx

@@ -1,86 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-import { useState } from "react";
-import { observer } from "mobx-react";
-import useSWR from "swr";
-import { MessageSquare } from "lucide-react";
-import type { IFormattedInstanceConfiguration } from "@plane/types";
-import { ToggleSwitch } from "@plane/ui";
-// hooks
-import { useInstance } from "@/hooks/store";
-
-type TIntercomConfig = {
-  isTelemetryEnabled: boolean;
-};
-
-export const IntercomConfig = observer(function IntercomConfig(props: TIntercomConfig) {
-  const { isTelemetryEnabled } = props;
-  // hooks
-  const { instanceConfigurations, updateInstanceConfigurations, fetchInstanceConfigurations } = useInstance();
-  // states
-  const [isSubmitting, setIsSubmitting] = useState<boolean>(false);
-
-  // derived values
-  const isIntercomEnabled = isTelemetryEnabled
-    ? instanceConfigurations
-      ? instanceConfigurations?.find((config) => config.key === "IS_INTERCOM_ENABLED")?.value === "1"
-        ? true
-        : false
-      : undefined
-    : false;
-
-  const { isLoading } = useSWR(isTelemetryEnabled ? "INSTANCE_CONFIGURATIONS" : null, () =>
-    isTelemetryEnabled ? fetchInstanceConfigurations() : null
-  );
-
-  const initialLoader = isLoading && isIntercomEnabled === undefined;
-
-  const submitInstanceConfigurations = async (payload: Partial<IFormattedInstanceConfiguration>) => {
-    try {
-      await updateInstanceConfigurations(payload);
-    } catch (error) {
-      console.error(error);
-    } finally {
-      setIsSubmitting(false);
-    }
-  };
-
-  const enableIntercomConfig = () => {
-    void submitInstanceConfigurations({ IS_INTERCOM_ENABLED: isIntercomEnabled ? "0" : "1" });
-  };
-
-  return (
-    <>
-      <div className="flex items-center gap-14">
-        <div className="flex grow items-center gap-4">
-          <div className="shrink-0">
-            <div className="flex size-11 items-center justify-center rounded-lg bg-layer-1">
-              <MessageSquare className="size-5 p-0.5 text-tertiary" />
-            </div>
-          </div>
-
-          <div className="grow">
-            <div className="text-13 leading-5 font-medium text-primary">Chat with us</div>
-            <div className="text-11 leading-5 font-regular text-tertiary">
-              Let your users chat with us via Intercom or another service. Toggling Telemetry off turns this off
-              automatically.
-            </div>
-          </div>
-
-          <div className="ml-auto">
-            <ToggleSwitch
-              value={isIntercomEnabled ? true : false}
-              onChange={enableIntercomConfig}
-              size="sm"
-              disabled={!isTelemetryEnabled || isSubmitting || initialLoader}
-            />
-          </div>
-        </div>
-      </div>
-    </>
-  );
-});

apps/admin/nginx/nginx.conf

@@ -11,7 +11,7 @@ http {
 
   set_real_ip_from        0.0.0.0/0;
   real_ip_recursive       on;
-  real_ip_header          X-Forward-For;
+  real_ip_header          X-Forwarded-For;
   limit_req_zone          $binary_remote_addr zone=mylimit:10m rate=10r/s;
 
   access_log /dev/stdout;

apps/admin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "description": "Admin UI for Plane",
   "license": "AGPL-3.0",

apps/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plane-api",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "description": "API server powering Plane's backend",
   "license": "AGPL-3.0"

apps/api/plane/api/serializers/issue.py

@@ -480,44 +480,52 @@ class IssueLinkSerializer(BaseSerializer):
         ]
 
 
+class IssueRelationRefSerializer(serializers.Serializer):
+    """Project-scoped reference to a related work item."""
+
+    project_id = serializers.UUIDField(help_text="Project containing the related work item")
+    issue_id = serializers.UUIDField(help_text="ID of the related work item")
+
+
 class IssueRelationResponseSerializer(serializers.Serializer):
     """
     Serializer for issue relations response showing grouped relation types.
 
-    Returns issue IDs organized by relation type for efficient client-side processing.
+    Each list contains project_id and issue_id pairs so clients can resolve
+    cross-project relations.
     """
 
     blocking = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that are blocking this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items blocking this issue",
     )
     blocked_by = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that this issue is blocked by",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items this issue is blocked by",
     )
     duplicate = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that are duplicates of this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Duplicate work items",
     )
     relates_to = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that relate to this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Related work items",
     )
     start_after = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that start after this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items that start after this issue",
     )
     start_before = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that start before this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items that start before this issue",
     )
     finish_after = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that finish after this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items that finish after this issue",
     )
     finish_before = serializers.ListField(
-        child=serializers.UUIDField(),
-        help_text="List of issue IDs that finish before this issue",
+        child=IssueRelationRefSerializer(),
+        help_text="Work items that finish before this issue",
     )
 
 

apps/api/plane/api/serializers/project.py

@@ -114,13 +114,20 @@ class ProjectCreateSerializer(BaseSerializer):
         if project_identifier is not None and re.match(Project.FORBIDDEN_IDENTIFIER_CHARS_PATTERN, project_identifier):
             raise serializers.ValidationError("Project identifier cannot contain special characters.")
 
-        if data.get("project_lead", None) is not None:
-            # Check if the project lead is a member of the workspace
-            if not WorkspaceMember.objects.filter(
+        project_lead = data.get("project_lead")
+        if (
+            project_lead
+            and not WorkspaceMember.objects.filter(
                 workspace_id=self.context["workspace_id"],
-                member_id=data.get("project_lead"),
-            ).exists():
-                raise serializers.ValidationError("Project lead should be a user in the workspace")
+                member=project_lead,
+                is_active=True,
+            ).exists()
+        ):
+            # Field-shaped error so DRF surfaces it under the specific key
+            # rather than as non_field_errors. Also requires the membership
+            # to be active so that revoked / removed members can't slip
+            # through and trigger the FK error downstream.
+            raise serializers.ValidationError({"project_lead": "The provided user is not a member of this workspace."})
 
         if data.get("default_assignee", None) is not None:
             # Check if the default assignee is a member of the workspace

apps/api/plane/api/views/asset.py

@@ -17,6 +17,7 @@ from drf_spectacular.utils import OpenApiExample, OpenApiRequest
 # Module Imports
 from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from plane.settings.storage import S3Storage
+from plane.utils.path_validator import sanitize_filename
 from plane.db.models import FileAsset, User, Workspace
 from plane.api.views.base import BaseAPIView
 from plane.api.serializers import (
@@ -114,7 +115,7 @@ class UserAssetEndpoint(BaseAPIView):
         This endpoint generates the necessary credentials for direct S3 upload.
         """
         # get the asset key
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)
@@ -287,7 +288,7 @@ class UserServerAssetEndpoint(BaseAPIView):
         necessary credentials for direct S3 upload with server-side authentication.
         """
         # get the asset key
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)
@@ -498,7 +499,7 @@ class GenericAssetEndpoint(BaseAPIView):
         Create a presigned URL for uploading generic assets that can be bound to entities like work items.
         Supports various file types and includes external source tracking for integrations.
         """
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name"))
         type = request.data.get("type")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         project_id = request.data.get("project_id")

apps/api/plane/api/views/issue.py

@@ -23,11 +23,8 @@ from django.db.models import (
     Value,
     When,
     Subquery,
-    UUIDField,
 )
-from django.db.models.functions import Coalesce
-from django.contrib.postgres.aggregates import ArrayAgg
-from django.contrib.postgres.fields import ArrayField
+
 from django.utils import timezone
 from django.conf import settings
 
@@ -82,6 +79,7 @@ from plane.db.models import (
     Workspace,
 )
 from plane.settings.storage import S3Storage
+from plane.utils.path_validator import sanitize_filename
 from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from .base import BaseAPIView
 from plane.utils.host import base_host
@@ -1861,7 +1859,7 @@ class IssueAttachmentListCreateAPIEndpoint(BaseAPIView):
                 status=status.HTTP_403_FORBIDDEN,
             )
 
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name"))
         type = request.data.get("type", False)
         size = request.data.get("size")
         external_id = request.data.get("external_id")
@@ -2292,14 +2290,35 @@ class IssueRelationListCreateAPIEndpoint(BaseAPIView):
                         name="Work Item Relations Response",
                         value={
                             "blocking": [
-                                "550e8400-e29b-41d4-a716-446655440000",
-                                "550e8400-e29b-41d4-a716-446655440001",
+                                {
+                                    "project_id": "550e8400-e29b-41d4-a716-446655440010",
+                                    "issue_id": "550e8400-e29b-41d4-a716-446655440000",
+                                },
+                                {
+                                    "project_id": "550e8400-e29b-41d4-a716-446655440010",
+                                    "issue_id": "550e8400-e29b-41d4-a716-446655440001",
+                                },
+                            ],
+                            "blocked_by": [
+                                {
+                                    "project_id": "550e8400-e29b-41d4-a716-446655440011",
+                                    "issue_id": "550e8400-e29b-41d4-a716-446655440002",
+                                },
                             ],
-                            "blocked_by": ["550e8400-e29b-41d4-a716-446655440002"],
                             "duplicate": [],
-                            "relates_to": ["550e8400-e29b-41d4-a716-446655440003"],
+                            "relates_to": [
+                                {
+                                    "project_id": "550e8400-e29b-41d4-a716-446655440010",
+                                    "issue_id": "550e8400-e29b-41d4-a716-446655440003",
+                                },
+                            ],
                             "start_after": [],
-                            "start_before": ["550e8400-e29b-41d4-a716-446655440004"],
+                            "start_before": [
+                                {
+                                    "project_id": "550e8400-e29b-41d4-a716-446655440012",
+                                    "issue_id": "550e8400-e29b-41d4-a716-446655440004",
+                                },
+                            ],
                             "finish_after": [],
                             "finish_before": [],
                         },
@@ -2316,42 +2335,81 @@ class IssueRelationListCreateAPIEndpoint(BaseAPIView):
         Retrieve all relationships for a work item organized by relation type.
         Returns a structured response with relations grouped by type.
         """
-        empty_uuid_array = Value([], output_field=ArrayField(UUIDField()))
-
-        def _agg_ids(field, **filter_kwargs):
-            return Coalesce(
-                ArrayAgg(field, filter=Q(**filter_kwargs), distinct=True),
-                empty_uuid_array,
-            )
-
-        issue_relation_qs = IssueRelation.objects.filter(
+        relations = IssueRelation.objects.filter(
             Q(issue_id=issue_id) | Q(related_issue_id=issue_id),
             workspace__slug=slug,
-        )
-
-        relation_ids = issue_relation_qs.aggregate(
-            blocking_ids=_agg_ids("issue_id", relation_type="blocked_by", related_issue_id=issue_id),
-            blocked_by_ids=_agg_ids("related_issue_id", relation_type="blocked_by", issue_id=issue_id),
-            duplicate_ids=_agg_ids("related_issue_id", relation_type="duplicate", issue_id=issue_id),
-            duplicate_ids_related=_agg_ids("issue_id", relation_type="duplicate", related_issue_id=issue_id),
-            relates_to_ids=_agg_ids("related_issue_id", relation_type="relates_to", issue_id=issue_id),
-            relates_to_ids_related=_agg_ids("issue_id", relation_type="relates_to", related_issue_id=issue_id),
-            start_after_ids=_agg_ids("issue_id", relation_type="start_before", related_issue_id=issue_id),
-            start_before_ids=_agg_ids("related_issue_id", relation_type="start_before", issue_id=issue_id),
-            finish_after_ids=_agg_ids("issue_id", relation_type="finish_before", related_issue_id=issue_id),
-            finish_before_ids=_agg_ids("related_issue_id", relation_type="finish_before", issue_id=issue_id),
+        ).values(
+            "relation_type",
+            "issue_id",
+            "related_issue_id",
+            issue_project_id=F("issue__project_id"),
+            related_issue_project_id=F("related_issue__project_id"),
         )
 
         response_data = {
-            "blocking": relation_ids["blocking_ids"],
-            "blocked_by": relation_ids["blocked_by_ids"],
-            "duplicate": list(set(relation_ids["duplicate_ids"] + relation_ids["duplicate_ids_related"])),
-            "relates_to": list(set(relation_ids["relates_to_ids"] + relation_ids["relates_to_ids_related"])),
-            "start_after": relation_ids["start_after_ids"],
-            "start_before": relation_ids["start_before_ids"],
-            "finish_after": relation_ids["finish_after_ids"],
-            "finish_before": relation_ids["finish_before_ids"],
+            "blocking": [],
+            "blocked_by": [],
+            "duplicate": [],
+            "relates_to": [],
+            "start_after": [],
+            "start_before": [],
+            "finish_after": [],
+            "finish_before": [],
         }
+        seen_duplicate = set()
+        seen_relates_to = set()
+
+        for rel in relations:
+            rt = rel["relation_type"]
+            if rt == "blocked_by":
+                if str(rel["related_issue_id"]) == str(issue_id):
+                    response_data["blocking"].append(
+                        {"project_id": str(rel["issue_project_id"]), "issue_id": str(rel["issue_id"])}
+                    )
+                if str(rel["issue_id"]) == str(issue_id):
+                    response_data["blocked_by"].append(
+                        {"project_id": str(rel["related_issue_project_id"]), "issue_id": str(rel["related_issue_id"])}
+                    )
+            elif rt == "duplicate":
+                if str(rel["issue_id"]) == str(issue_id) and rel["related_issue_id"] not in seen_duplicate:
+                    seen_duplicate.add(rel["related_issue_id"])
+                    response_data["duplicate"].append(
+                        {"project_id": str(rel["related_issue_project_id"]), "issue_id": str(rel["related_issue_id"])}
+                    )
+                if str(rel["related_issue_id"]) == str(issue_id) and rel["issue_id"] not in seen_duplicate:
+                    seen_duplicate.add(rel["issue_id"])
+                    response_data["duplicate"].append(
+                        {"project_id": str(rel["issue_project_id"]), "issue_id": str(rel["issue_id"])}
+                    )
+            elif rt == "relates_to":
+                if str(rel["issue_id"]) == str(issue_id) and rel["related_issue_id"] not in seen_relates_to:
+                    seen_relates_to.add(rel["related_issue_id"])
+                    response_data["relates_to"].append(
+                        {"project_id": str(rel["related_issue_project_id"]), "issue_id": str(rel["related_issue_id"])}
+                    )
+                if str(rel["related_issue_id"]) == str(issue_id) and rel["issue_id"] not in seen_relates_to:
+                    seen_relates_to.add(rel["issue_id"])
+                    response_data["relates_to"].append(
+                        {"project_id": str(rel["issue_project_id"]), "issue_id": str(rel["issue_id"])}
+                    )
+            elif rt == "start_before":
+                if str(rel["related_issue_id"]) == str(issue_id):
+                    response_data["start_after"].append(
+                        {"project_id": str(rel["issue_project_id"]), "issue_id": str(rel["issue_id"])}
+                    )
+                if str(rel["issue_id"]) == str(issue_id):
+                    response_data["start_before"].append(
+                        {"project_id": str(rel["related_issue_project_id"]), "issue_id": str(rel["related_issue_id"])}
+                    )
+            elif rt == "finish_before":
+                if str(rel["related_issue_id"]) == str(issue_id):
+                    response_data["finish_after"].append(
+                        {"project_id": str(rel["issue_project_id"]), "issue_id": str(rel["issue_id"])}
+                    )
+                if str(rel["issue_id"]) == str(issue_id):
+                    response_data["finish_before"].append(
+                        {"project_id": str(rel["related_issue_project_id"]), "issue_id": str(rel["related_issue_id"])}
+                    )
 
         return Response(response_data, status=status.HTTP_200_OK)
 

apps/api/plane/api/views/project.py

@@ -6,7 +6,7 @@
 import json
 
 # Django imports
-from django.db import IntegrityError
+from django.db import IntegrityError, transaction
 from django.db.models import Exists, F, Func, OuterRef, Prefetch, Q, Subquery, Count
 from django.db.models.functions import Coalesce
 from django.utils import timezone
@@ -38,6 +38,7 @@ from plane.db.models import (
     ProjectPage,
 )
 from plane.bgtasks.webhook_task import model_activity, webhook_activity
+from plane.utils.exception_logger import log_exception
 from .base import BaseAPIView
 from plane.utils.host import base_host
 from plane.api.serializers import (
@@ -223,48 +224,72 @@ class ProjectListCreateAPIEndpoint(BaseAPIView):
             serializer = ProjectCreateSerializer(data={**request.data}, context={"workspace_id": workspace.id})
 
             if serializer.is_valid():
-                serializer.save()
+                with transaction.atomic():
+                    serializer.save()
 
-                # Add the user as Administrator to the project
-                _ = ProjectMember.objects.create(project_id=serializer.instance.id, member=request.user, role=20)
+                    # Add the creator as Administrator of the project.
+                    _ = ProjectMember.objects.create(project_id=serializer.instance.id, member=request.user, role=20)
 
-                if serializer.instance.project_lead is not None and str(serializer.instance.project_lead) != str(
-                    request.user.id
-                ):
-                    ProjectMember.objects.create(
-                        project_id=serializer.instance.id,
-                        member_id=serializer.instance.project_lead,
-                        role=20,
+                    # If a different project_lead was provided, add them as
+                    # Administrator too. Use project_lead_id (the FK column)
+                    # rather than project_lead (the related descriptor, which
+                    # would resolve to a User instance and break UUID coercion
+                    # downstream in ProjectMember.objects.create).
+                    if (
+                        serializer.instance.project_lead_id is not None
+                        and serializer.instance.project_lead_id != request.user.id
+                    ):
+                        ProjectMember.objects.create(
+                            project_id=serializer.instance.id,
+                            member_id=serializer.instance.project_lead_id,
+                            role=20,
+                        )
+
+                    State.objects.bulk_create(
+                        [
+                            State(
+                                name=state["name"],
+                                color=state["color"],
+                                project=serializer.instance,
+                                sequence=state["sequence"],
+                                workspace=serializer.instance.workspace,
+                                group=state["group"],
+                                default=state.get("default", False),
+                                created_by=request.user,
+                            )
+                            for state in DEFAULT_STATES
+                        ]
                     )
 
-                State.objects.bulk_create(
-                    [
-                        State(
-                            name=state["name"],
-                            color=state["color"],
-                            project=serializer.instance,
-                            sequence=state["sequence"],
-                            workspace=serializer.instance.workspace,
-                            group=state["group"],
-                            default=state.get("default", False),
-                            created_by=request.user,
+                    project = self.get_queryset().filter(pk=serializer.instance.id).first()
+
+                    # Defer the activity-log task until the surrounding
+                    # transaction commits, so it never fires on a rolled-back
+                    # creation.
+                    # robust=True so broker / dispatch failures are logged
+                    # internally by Django and don't surface as 500 after a
+                    # successful commit (the inverse of the rollback path
+                    # covered by test_model_activity_not_called_on_rollback).
+                    # A nested function (rather than functools.partial) is
+                    # used here because Django's robust on_commit logging
+                    # path reads ``func.__qualname__`` to format the error
+                    # message; ``partial`` objects don't have that dunder
+                    # by default and the workaround is brittle when the
+                    # wrapped callable is a mock. The closure captures
+                    # the locals at construction time and they are never
+                    # rebound, so late-binding is not a hazard here.
+                    def _dispatch_model_activity():
+                        model_activity.delay(
+                            model_name="project",
+                            model_id=str(project.id),
+                            requested_data=request.data,
+                            current_instance=None,
+                            actor_id=request.user.id,
+                            slug=slug,
+                            origin=base_host(request=request, is_app=True),
                         )
-                        for state in DEFAULT_STATES
-                    ]
-                )
 
-                project = self.get_queryset().filter(pk=serializer.instance.id).first()
-
-                # Model activity
-                model_activity.delay(
-                    model_name="project",
-                    model_id=str(project.id),
-                    requested_data=request.data,
-                    current_instance=None,
-                    actor_id=request.user.id,
-                    slug=slug,
-                    origin=base_host(request=request, is_app=True),
-                )
+                    transaction.on_commit(_dispatch_model_activity, robust=True)
 
                 serializer = ProjectSerializer(project)
                 return Response(serializer.data, status=status.HTTP_201_CREATED)
@@ -275,6 +300,17 @@ class ProjectListCreateAPIEndpoint(BaseAPIView):
                     {"name": "The project name is already taken"},
                     status=status.HTTP_409_CONFLICT,
                 )
+            # Any other IntegrityError is unexpected: log it the same way
+            # the catch-all `except Exception` below would and return the
+            # same generic 500 so the client gets a uniform error shape.
+            # `raise` here would not fall through to a sibling except
+            # clause — it would exit the try/except entirely and bypass
+            # both the logging and the JSON response.
+            log_exception(e)
+            return Response(
+                {"error": "An unexpected error occurred"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
         except Workspace.DoesNotExist:
             return Response({"error": "Workspace does not exist"}, status=status.HTTP_404_NOT_FOUND)
         except ValidationError:
@@ -282,6 +318,16 @@ class ProjectListCreateAPIEndpoint(BaseAPIView):
                 {"identifier": "The project identifier is already taken"},
                 status=status.HTTP_409_CONFLICT,
             )
+        except Exception as e:
+            # Unexpected server-side failure: log the traceback and return a
+            # generic 500 so the client can distinguish it from a 4xx caused
+            # by bad input. Returning 400 here was the anti-pattern that
+            # masked the original ghost-create bug.
+            log_exception(e)
+            return Response(
+                {"error": "An unexpected error occurred"},
+                status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            )
 
 
 class ProjectDetailAPIEndpoint(BaseAPIView):

apps/api/plane/app/serializers/webhook.py

@@ -3,90 +3,66 @@
 # See the LICENSE file for details.
 
 # Python imports
-import socket
-import ipaddress
+import logging
 from urllib.parse import urlparse
 
 # Third party imports
 from rest_framework import serializers
 
+# Django imports
+from django.conf import settings
+
 # Module imports
 from .base import DynamicBaseSerializer
 from plane.db.models import Webhook, WebhookLog
 from plane.db.models.webhook import validate_domain, validate_schema
+from plane.utils.ip_address import validate_url
+
+logger = logging.getLogger(__name__)
 
 
 class WebhookSerializer(DynamicBaseSerializer):
     url = serializers.URLField(validators=[validate_schema, validate_domain])
 
-    def create(self, validated_data):
-        url = validated_data.get("url", None)
-
-        # Extract the hostname from the URL
-        hostname = urlparse(url).hostname
-        if not hostname:
-            raise serializers.ValidationError({"url": "Invalid URL: No hostname found."})
-
-        # Resolve the hostname to IP addresses
+    def _validate_webhook_url(self, url):
+        """Validate a webhook URL against SSRF and disallowed domain rules."""
         try:
-            ip_addresses = socket.getaddrinfo(hostname, None)
-        except socket.gaierror:
-            raise serializers.ValidationError({"url": "Hostname could not be resolved."})
+            validate_url(
+                url,
+                allowed_ips=settings.WEBHOOK_ALLOWED_IPS,
+                allowed_hosts=settings.WEBHOOK_ALLOWED_HOSTS,
+            )
+        except ValueError as e:
+            logger.warning("Webhook URL validation failed for %s: %s", url, e)
+            raise serializers.ValidationError({"url": "Invalid or disallowed webhook URL."})
 
-        if not ip_addresses:
-            raise serializers.ValidationError({"url": "No IP addresses found for the hostname."})
+        hostname = (urlparse(url).hostname or "").rstrip(".").lower()
 
-        for addr in ip_addresses:
-            ip = ipaddress.ip_address(addr[4][0])
-            if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
-                raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."})
+        # Hosts explicitly trusted via WEBHOOK_ALLOWED_HOSTS bypass the
+        # disallowed-domain check — they're already trusted for SSRF, so
+        # the loop-back guard would only get in the way of legitimate
+        # sibling services that share a parent domain with Plane.
+        if hostname in settings.WEBHOOK_ALLOWED_HOSTS:
+            return
 
-        # Additional validation for multiple request domains and their subdomains
         request = self.context.get("request")
-        disallowed_domains = ["plane.so"]  # Add your disallowed domains here
+        disallowed_domains = list(settings.WEBHOOK_DISALLOWED_DOMAINS)
         if request:
-            request_host = request.get_host().split(":")[0]  # Remove port if present
+            request_host = request.get_host().split(":")[0].rstrip(".").lower()
             disallowed_domains.append(request_host)
 
-        # Check if hostname is a subdomain or exact match of any disallowed domain
         if any(hostname == domain or hostname.endswith("." + domain) for domain in disallowed_domains):
             raise serializers.ValidationError({"url": "URL domain or its subdomain is not allowed."})
 
+    def create(self, validated_data):
+        url = validated_data.get("url", None)
+        self._validate_webhook_url(url)
         return Webhook.objects.create(**validated_data)
 
     def update(self, instance, validated_data):
         url = validated_data.get("url", None)
         if url:
-            # Extract the hostname from the URL
-            hostname = urlparse(url).hostname
-            if not hostname:
-                raise serializers.ValidationError({"url": "Invalid URL: No hostname found."})
-
-            # Resolve the hostname to IP addresses
-            try:
-                ip_addresses = socket.getaddrinfo(hostname, None)
-            except socket.gaierror:
-                raise serializers.ValidationError({"url": "Hostname could not be resolved."})
-
-            if not ip_addresses:
-                raise serializers.ValidationError({"url": "No IP addresses found for the hostname."})
-
-            for addr in ip_addresses:
-                ip = ipaddress.ip_address(addr[4][0])
-                if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
-                    raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."})
-
-            # Additional validation for multiple request domains and their subdomains
-            request = self.context.get("request")
-            disallowed_domains = ["plane.so"]  # Add your disallowed domains here
-            if request:
-                request_host = request.get_host().split(":")[0]  # Remove port if present
-                disallowed_domains.append(request_host)
-
-            # Check if hostname is a subdomain or exact match of any disallowed domain
-            if any(hostname == domain or hostname.endswith("." + domain) for domain in disallowed_domains):
-                raise serializers.ValidationError({"url": "URL domain or its subdomain is not allowed."})
-
+            self._validate_webhook_url(url)
         return super().update(instance, validated_data)
 
     class Meta:

apps/api/plane/app/views/analytic/base.py

@@ -29,7 +29,7 @@ from plane.db.models import (
     Module,
 )
 
-from plane.utils.analytics_plot import build_graph_plot
+from plane.utils.analytics_plot import build_graph_plot, VALID_ANALYTICS_FIELDS, VALID_YAXIS
 from plane.utils.issue_filters import issue_filters
 from plane.app.permissions import allow_permission, ROLE
 
@@ -41,32 +41,15 @@ class AnalyticsEndpoint(BaseAPIView):
         y_axis = request.GET.get("y_axis", False)
         segment = request.GET.get("segment", False)
 
-        valid_xaxis_segment = [
-            "state_id",
-            "state__group",
-            "labels__id",
-            "assignees__id",
-            "estimate_point__value",
-            "issue_cycle__cycle_id",
-            "issue_module__module_id",
-            "priority",
-            "start_date",
-            "target_date",
-            "created_at",
-            "completed_at",
-        ]
-
-        valid_yaxis = ["issue_count", "estimate"]
-
         # Check for x-axis and y-axis as thery are required parameters
-        if not x_axis or not y_axis or x_axis not in valid_xaxis_segment or y_axis not in valid_yaxis:
+        if not x_axis or not y_axis or x_axis not in VALID_ANALYTICS_FIELDS or y_axis not in VALID_YAXIS:
             return Response(
                 {"error": "x-axis and y-axis dimensions are required and the values should be valid"},
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
         # If segment is present it cannot be same as x-axis
-        if segment and (segment not in valid_xaxis_segment or x_axis == segment):
+        if segment and (segment not in VALID_ANALYTICS_FIELDS or x_axis == segment):
             return Response(
                 {"error": "Both segment and x axis cannot be same and segment should be valid"},
                 status=status.HTTP_400_BAD_REQUEST,
@@ -214,13 +197,20 @@ class SavedAnalyticEndpoint(BaseAPIView):
         x_axis = analytic_view.query_dict.get("x_axis", False)
         y_axis = analytic_view.query_dict.get("y_axis", False)
 
-        if not x_axis or not y_axis:
+        if not x_axis or not y_axis or x_axis not in VALID_ANALYTICS_FIELDS or y_axis not in VALID_YAXIS:
             return Response(
-                {"error": "x-axis and y-axis dimensions are required"},
+                {"error": "x-axis and y-axis dimensions are required and the values should be valid"},
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
         segment = request.GET.get("segment", False)
+
+        if segment and (segment not in VALID_ANALYTICS_FIELDS or x_axis == segment):
+            return Response(
+                {"error": "Both segment and x axis cannot be same and segment should be valid"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
         distribution = build_graph_plot(queryset=queryset, x_axis=x_axis, y_axis=y_axis, segment=segment)
         total_issues = queryset.count()
         return Response(
@@ -236,32 +226,15 @@ class ExportAnalyticsEndpoint(BaseAPIView):
         y_axis = request.data.get("y_axis", False)
         segment = request.data.get("segment", False)
 
-        valid_xaxis_segment = [
-            "state_id",
-            "state__group",
-            "labels__id",
-            "assignees__id",
-            "estimate_point",
-            "issue_cycle__cycle_id",
-            "issue_module__module_id",
-            "priority",
-            "start_date",
-            "target_date",
-            "created_at",
-            "completed_at",
-        ]
-
-        valid_yaxis = ["issue_count", "estimate"]
-
         # Check for x-axis and y-axis as thery are required parameters
-        if not x_axis or not y_axis or x_axis not in valid_xaxis_segment or y_axis not in valid_yaxis:
+        if not x_axis or not y_axis or x_axis not in VALID_ANALYTICS_FIELDS or y_axis not in VALID_YAXIS:
             return Response(
                 {"error": "x-axis and y-axis dimensions are required and the values should be valid"},
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
         # If segment is present it cannot be same as x-axis
-        if segment and (segment not in valid_xaxis_segment or x_axis == segment):
+        if segment and (segment not in VALID_ANALYTICS_FIELDS or x_axis == segment):
             return Response(
                 {"error": "Both segment and x axis cannot be same and segment should be valid"},
                 status=status.HTTP_400_BAD_REQUEST,

apps/api/plane/app/views/asset/v2.py

@@ -18,10 +18,11 @@ from rest_framework.permissions import AllowAny
 
 # Module imports
 from ..base import BaseAPIView
-from plane.db.models import FileAsset, Workspace, Project, User
+from plane.db.models import FileAsset, Workspace, Project, User, WorkspaceMember
 from plane.settings.storage import S3Storage
 from plane.app.permissions import allow_permission, ROLE
 from plane.utils.cache import invalidate_cache_directly
+from plane.utils.path_validator import sanitize_filename
 from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from plane.throttles.asset import AssetRateThrottle
 
@@ -108,7 +109,7 @@ class UserAssetsV2Endpoint(BaseAPIView):
 
     def post(self, request):
         # get the asset key
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", False)
@@ -311,8 +312,9 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
         else:
             return
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
     def post(self, request, slug):
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type")
@@ -376,6 +378,7 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
             status=status.HTTP_200_OK,
         )
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
     def patch(self, request, slug, asset_id):
         # get the asset id
         asset = FileAsset.objects.get(id=asset_id, workspace__slug=slug)
@@ -397,6 +400,7 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
         asset.save(update_fields=["is_uploaded", "attributes"])
         return Response(status=status.HTTP_204_NO_CONTENT)
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
     def delete(self, request, slug, asset_id):
         asset = FileAsset.objects.get(id=asset_id, workspace__slug=slug)
         asset.is_deleted = True
@@ -406,6 +410,7 @@ class WorkspaceFileAssetEndpoint(BaseAPIView):
         asset.save(update_fields=["is_deleted", "deleted_at"])
         return Response(status=status.HTTP_204_NO_CONTENT)
 
+    @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
     def get(self, request, slug, asset_id):
         # get the asset id
         asset = FileAsset.objects.get(id=asset_id, workspace__slug=slug)
@@ -511,7 +516,7 @@ class ProjectAssetEndpoint(BaseAPIView):
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def post(self, request, slug, project_id):
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", "")
@@ -752,12 +757,22 @@ class DuplicateAssetEndpoint(BaseAPIView):
                 return Response({"error": "Project not found"}, status=status.HTTP_404_NOT_FOUND)
 
         storage = S3Storage(request=request)
-        original_asset = FileAsset.objects.filter(id=asset_id, is_uploaded=True).first()
+        # Scope the source asset lookup to workspaces the caller is a member of
+        user_workspace_ids = WorkspaceMember.objects.filter(
+            member=request.user,
+            is_active=True,
+        ).values_list("workspace_id", flat=True)
+        original_asset = FileAsset.objects.filter(
+            id=asset_id,
+            is_uploaded=True,
+            workspace_id__in=user_workspace_ids,
+        ).first()
 
         if not original_asset:
             return Response({"error": "Asset not found"}, status=status.HTTP_404_NOT_FOUND)
 
-        destination_key = f"{workspace.id}/{uuid.uuid4().hex}-{original_asset.attributes.get('name')}"
+        sanitized_name = sanitize_filename(original_asset.attributes.get("name")) or "unnamed"
+        destination_key = f"{workspace.id}/{uuid.uuid4().hex}-{sanitized_name}"
         duplicated_asset = FileAsset.objects.create(
             attributes={
                 "name": original_asset.attributes.get("name"),

apps/api/plane/app/views/estimate/base.py

@@ -113,7 +113,7 @@ class BulkEstimatePointEndpoint(BaseViewSet):
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
-        estimate = Estimate.objects.get(pk=estimate_id)
+        estimate = Estimate.objects.get(pk=estimate_id, workspace__slug=slug, project_id=project_id)
 
         if request.data.get("estimate"):
             estimate.name = request.data.get("estimate").get("name", estimate.name)

apps/api/plane/app/views/issue/attachment.py

@@ -24,6 +24,7 @@ from plane.db.models import FileAsset, Workspace
 from plane.bgtasks.issue_activities_task import issue_activity
 from plane.app.permissions import allow_permission, ROLE
 from plane.settings.storage import S3Storage
+from plane.utils.path_validator import sanitize_filename
 from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from plane.utils.host import base_host
 
@@ -97,7 +98,7 @@ class IssueAttachmentV2Endpoint(BaseAPIView):
 
     @allow_permission([ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST])
     def post(self, request, slug, project_id, issue_id):
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", False)
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
 

apps/api/plane/app/views/issue/base.py

@@ -99,6 +99,7 @@ class IssueListEndpoint(BaseAPIView):
         # Apply legacy filters
         filters = issue_filters(request.query_params, "GET")
         issue_queryset = queryset.filter(**filters)
+        issue_queryset = issue_queryset.filter(state__deleted_at__isnull=True)
 
         # Add select_related, prefetch_related if fields or expand is not None
         if self.fields or self.expand:
@@ -157,7 +158,7 @@ class IssueListEndpoint(BaseAPIView):
         )
 
         if self.fields or self.expand:
-            issues = IssueSerializer(queryset, many=True, fields=self.fields, expand=self.expand).data
+            issues = IssueSerializer(issue_queryset, many=True, fields=self.fields, expand=self.expand).data
         else:
             issues = issue_queryset.values(
                 "id",

apps/api/plane/app/views/issue/sub_issue.py

@@ -7,7 +7,7 @@ import json
 
 # Django imports
 from django.utils import timezone
-from django.db.models import OuterRef, Func, F, Q, Value, UUIDField, Subquery
+from django.db.models import OuterRef, Func, F, Q, Value, UUIDField, Subquery, Count, IntegerField
 from django.utils.decorators import method_decorator
 from django.views.decorators.gzip import gzip_page
 from django.contrib.postgres.aggregates import ArrayAgg
@@ -22,7 +22,7 @@ from rest_framework import status
 from .. import BaseAPIView
 from plane.app.serializers import IssueSerializer
 from plane.app.permissions import ProjectEntityPermission
-from plane.db.models import Issue, IssueLink, FileAsset, CycleIssue
+from plane.db.models import Issue, IssueLink, FileAsset, CycleIssue, IssueLabel, IssueAssignee, ModuleIssue
 from plane.bgtasks.issue_activities_task import issue_activity
 from plane.utils.timezone_converter import user_timezone_converter
 from collections import defaultdict
@@ -37,70 +37,97 @@ class SubIssuesEndpoint(BaseAPIView):
     def get(self, request, slug, project_id, issue_id):
         sub_issues = (
             Issue.issue_objects.filter(parent_id=issue_id, workspace__slug=slug)
-            .select_related("workspace", "project", "state", "parent")
-            .prefetch_related("assignees", "labels", "issue_module__module")
             .annotate(
                 cycle_id=Subquery(
                     CycleIssue.objects.filter(issue=OuterRef("id"), deleted_at__isnull=True).values("cycle_id")[:1]
                 )
             )
             .annotate(
-                link_count=IssueLink.objects.filter(issue=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
-            )
-            .annotate(
-                attachment_count=FileAsset.objects.filter(
-                    issue_id=OuterRef("id"),
-                    entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                link_count=Coalesce(
+                    Subquery(
+                        IssueLink.objects.filter(issue=OuterRef("id"))
+                        .order_by()
+                        .values("issue")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
                 )
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
             )
             .annotate(
-                sub_issues_count=Issue.issue_objects.filter(parent=OuterRef("id"))
-                .order_by()
-                .annotate(count=Func(F("id"), function="Count"))
-                .values("count")
+                attachment_count=Coalesce(
+                    Subquery(
+                        FileAsset.objects.filter(
+                            issue_id=OuterRef("id"),
+                            entity_type=FileAsset.EntityTypeContext.ISSUE_ATTACHMENT,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
+                )
+            )
+            .annotate(
+                sub_issues_count=Coalesce(
+                    Subquery(
+                        Issue.issue_objects.filter(parent=OuterRef("id"))
+                        .order_by()
+                        .values("parent")
+                        .annotate(count=Count("id"))
+                        .values("count"),
+                        output_field=IntegerField(),
+                    ),
+                    0,
+                )
             )
             .annotate(
                 label_ids=Coalesce(
-                    ArrayAgg(
-                        "labels__id",
-                        distinct=True,
-                        filter=Q(~Q(labels__id__isnull=True) & Q(label_issue__deleted_at__isnull=True)),
+                    Subquery(
+                        IssueLabel.objects.filter(issue_id=OuterRef("id"), deleted_at__isnull=True)
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("label_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
                     ),
                     Value([], output_field=ArrayField(UUIDField())),
                 ),
                 assignee_ids=Coalesce(
-                    ArrayAgg(
-                        "assignees__id",
-                        distinct=True,
-                        filter=Q(
-                            ~Q(assignees__id__isnull=True)
-                            & Q(assignees__member_project__is_active=True)
-                            & Q(issue_assignee__deleted_at__isnull=True)
-                        ),
+                    Subquery(
+                        IssueAssignee.objects.filter(
+                            issue_id=OuterRef("id"),
+                            assignee__member_project__is_active=True,
+                            deleted_at__isnull=True,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("assignee_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
                     ),
                     Value([], output_field=ArrayField(UUIDField())),
                 ),
                 module_ids=Coalesce(
-                    ArrayAgg(
-                        "issue_module__module_id",
-                        distinct=True,
-                        filter=Q(
-                            ~Q(issue_module__module_id__isnull=True)
-                            & Q(issue_module__module__archived_at__isnull=True)
-                            & Q(issue_module__deleted_at__isnull=True)
-                        ),
+                    Subquery(
+                        ModuleIssue.objects.filter(
+                            issue_id=OuterRef("id"),
+                            module__archived_at__isnull=True,
+                            deleted_at__isnull=True,
+                        )
+                        .order_by()
+                        .values("issue_id")
+                        .annotate(arr=ArrayAgg("module_id", distinct=True))
+                        .values("arr"),
+                        output_field=ArrayField(UUIDField()),
                     ),
                     Value([], output_field=ArrayField(UUIDField())),
                 ),
             )
             .annotate(state_group=F("state__group"))
-            .order_by("-created_at")
         )
 
         # Ordering
@@ -110,38 +137,42 @@ class SubIssuesEndpoint(BaseAPIView):
         if order_by_param:
             sub_issues, order_by_param = order_issue_queryset(sub_issues, order_by_param)
 
+        sub_issues = list(
+            sub_issues.values(
+                "id",
+                "name",
+                "state_id",
+                "sort_order",
+                "completed_at",
+                "estimate_point",
+                "priority",
+                "start_date",
+                "target_date",
+                "sequence_id",
+                "project_id",
+                "parent_id",
+                "cycle_id",
+                "module_ids",
+                "label_ids",
+                "assignee_ids",
+                "sub_issues_count",
+                "created_at",
+                "updated_at",
+                "created_by",
+                "updated_by",
+                "attachment_count",
+                "link_count",
+                "is_draft",
+                "archived_at",
+                "state_group",
+            )
+        )
+
         # create's a dict with state group name with their respective issue id's
         result = defaultdict(list)
         for sub_issue in sub_issues:
-            result[sub_issue.state_group].append(str(sub_issue.id))
+            result[sub_issue["state_group"]].append(str(sub_issue["id"]))
 
-        sub_issues = sub_issues.values(
-            "id",
-            "name",
-            "state_id",
-            "sort_order",
-            "completed_at",
-            "estimate_point",
-            "priority",
-            "start_date",
-            "target_date",
-            "sequence_id",
-            "project_id",
-            "parent_id",
-            "cycle_id",
-            "module_ids",
-            "label_ids",
-            "assignee_ids",
-            "sub_issues_count",
-            "created_at",
-            "updated_at",
-            "created_by",
-            "updated_by",
-            "attachment_count",
-            "link_count",
-            "is_draft",
-            "archived_at",
-        )
         datetime_fields = ["created_at", "updated_at"]
         sub_issues = user_timezone_converter(sub_issues, datetime_fields, request.user.user_timezone)
         # Grouping

apps/api/plane/app/views/project/base.py

@@ -332,7 +332,7 @@ class ProjectViewSet(BaseViewSet):
 
         workspace = Workspace.objects.get(slug=slug)
 
-        project = Project.objects.get(pk=pk)
+        project = Project.objects.get(pk=pk, workspace__slug=slug)
         intake_view = request.data.get("inbox_view", project.intake_view)
         current_instance = json.dumps(ProjectSerializer(project).data, cls=DjangoJSONEncoder)
         if project.archived_at:

apps/api/plane/app/views/project/member.py

@@ -206,11 +206,15 @@ class ProjectMemberViewSet(BaseViewSet):
     def partial_update(self, request, slug, project_id, pk):
         project_member = ProjectMember.objects.get(pk=pk, workspace__slug=slug, project_id=project_id, is_active=True)
 
-        # Fetch the workspace role of the project member
-        workspace_role = WorkspaceMember.objects.get(
+        # Fetch the target's workspace role (used to cap the new project role)
+        target_workspace_role = WorkspaceMember.objects.get(
             workspace__slug=slug, member=project_member.member, is_active=True
         ).role
-        is_workspace_admin = workspace_role == ROLE.ADMIN.value
+        # Fetch the requester's workspace role to decide if they may bypass project-role checks
+        requester_workspace_role = WorkspaceMember.objects.get(
+            workspace__slug=slug, member=request.user, is_active=True
+        ).role
+        is_workspace_admin = requester_workspace_role == ROLE.ADMIN.value
 
         # Check if the user is not editing their own role if they are not an admin
         if request.user.id == project_member.member_id and not is_workspace_admin:
@@ -251,7 +255,7 @@ class ProjectMemberViewSet(BaseViewSet):
                 )
 
             # Cannot assign a role higher than the target's workspace role
-            if workspace_role in [5] and new_role in [15, 20]:
+            if target_workspace_role in [5] and new_role in [15, 20]:
                 return Response(
                     {"error": "You cannot add a user with role higher than the workspace role"},
                     status=status.HTTP_400_BAD_REQUEST,

apps/api/plane/app/views/workspace/user.py

@@ -279,11 +279,16 @@ class WorkspaceUserPropertiesEndpoint(BaseAPIView):
 
 class WorkspaceUserProfileEndpoint(BaseAPIView):
     def get(self, request, slug, user_id):
-        user_data = User.objects.get(pk=user_id)
-
         requesting_workspace_member = WorkspaceMember.objects.get(
             workspace__slug=slug, member=request.user, is_active=True
         )
+
+        # Verify the target user is also an active member of this workspace
+        # before exposing their profile data.
+        target_workspace_member = WorkspaceMember.objects.select_related("member").get(
+            workspace__slug=slug, member_id=user_id, is_active=True
+        )
+        user_data = target_workspace_member.member
         projects = []
         if requesting_workspace_member.role >= 15:
             projects = (

apps/api/plane/bgtasks/webhook_task.py

@@ -52,6 +52,7 @@ from plane.db.models import (
 from plane.license.utils.instance_value import get_email_configuration
 from plane.utils.email import generate_plain_text_from_html
 from plane.utils.exception_logger import log_exception
+from plane.utils.ip_address import validate_url
 from plane.settings.mongo import MongoConnection
 
 
@@ -325,6 +326,13 @@ def webhook_send_task(
         return
 
     try:
+        # Re-validate the webhook URL at send time to prevent DNS-rebinding attacks
+        validate_url(
+            webhook.url,
+            allowed_ips=settings.WEBHOOK_ALLOWED_IPS,
+            allowed_hosts=settings.WEBHOOK_ALLOWED_HOSTS,
+        )
+
         # Send the webhook event
         response = requests.post(webhook.url, headers=headers, json=payload, timeout=30)
 

apps/api/plane/db/models/asset.py

@@ -11,10 +11,13 @@ from django.core.exceptions import ValidationError
 from django.db import models
 
 # Module import
+from plane.utils.path_validator import sanitize_filename
+
 from .base import BaseModel
 
 
 def get_upload_path(instance, filename):
+    filename = sanitize_filename(filename) or uuid4().hex
     if instance.workspace_id is not None:
         return f"{instance.workspace.id}/{uuid4().hex}-{filename}"
     return f"user-{uuid4().hex}-{filename}"

apps/api/plane/db/models/issue.py

@@ -17,12 +17,12 @@ from django import apps
 
 # Module imports
 from plane.utils.html_processor import strip_tags
-from plane.db.mixins import SoftDeletionManager
+from plane.utils.path_validator import sanitize_filename
+from plane.db.mixins import SoftDeletionManager, ChangeTrackerMixin
 from plane.utils.exception_logger import log_exception
 from .project import ProjectBaseModel
 from plane.utils.uuid import convert_uuid_to_integer
 from .description import Description
-from plane.db.mixins import ChangeTrackerMixin
 from .state import StateGroup
 
 
@@ -101,7 +101,9 @@ class IssueManager(SoftDeletionManager):
         )
 
 
-class Issue(ProjectBaseModel):
+class Issue(ChangeTrackerMixin, ProjectBaseModel):
+    TRACKED_FIELDS = ["state_id"]
+
     PRIORITY_CHOICES = (
         ("urgent", "Urgent"),
         ("high", "High"),
@@ -176,30 +178,8 @@ class Issue(ProjectBaseModel):
         ordering = ("-created_at",)
 
     def save(self, *args, **kwargs):
-        if self.state is None:
-            try:
-                from plane.db.models import State
-
-                default_state = State.objects.filter(
-                    ~models.Q(is_triage=True), project=self.project, default=True
-                ).first()
-                if default_state is None:
-                    random_state = State.objects.filter(~models.Q(is_triage=True), project=self.project).first()
-                    self.state = random_state
-                else:
-                    self.state = default_state
-            except ImportError:
-                pass
-        else:
-            try:
-                from plane.db.models import State
-
-                if self.state.group == "completed":
-                    self.completed_at = timezone.now()
-                else:
-                    self.completed_at = None
-            except ImportError:
-                pass
+        self._ensure_default_state()
+        kwargs = self._sync_completed_at(kwargs)
 
         if self._state.adding:
             with transaction.atomic():
@@ -245,6 +225,35 @@ class Issue(ProjectBaseModel):
         """Return name of the issue"""
         return f"{self.name} <{self.project.name}>"
 
+    def _ensure_default_state(self):
+        """Assign a default state when none is set."""
+        if self.state is not None:
+            return
+        try:
+            from plane.db.models import State
+
+            default_state = State.objects.filter(~models.Q(is_triage=True), project=self.project, default=True).first()
+            self.state = default_state or State.objects.filter(~models.Q(is_triage=True), project=self.project).first()
+        except ImportError as e:
+            log_exception(e)
+
+    def _sync_completed_at(self, kwargs):
+        """Update completed_at when state changes. Returns kwargs."""
+        if not self.state:
+            return kwargs
+        if not self._state.adding and not self.has_changed("state_id"):
+            return kwargs
+
+        if self.state.group == StateGroup.COMPLETED.value:
+            self.completed_at = timezone.now()
+        else:
+            self.completed_at = None
+
+        update_fields = kwargs.get("update_fields")
+        if update_fields is not None:
+            kwargs["update_fields"] = list(set(update_fields) | {"completed_at"})
+        return kwargs
+
 
 class IssueBlocker(ProjectBaseModel):
     block = models.ForeignKey(Issue, related_name="blocker_issues", on_delete=models.CASCADE)
@@ -376,6 +385,7 @@ class IssueLink(ProjectBaseModel):
 
 
 def get_upload_path(instance, filename):
+    filename = sanitize_filename(filename) or uuid4().hex
     return f"{instance.workspace.id}/{uuid4().hex}-{filename}"
 
 

apps/api/plane/license/api/views/configuration.py

@@ -45,7 +45,8 @@ class InstanceConfigurationEndpoint(BaseAPIView):
 
         bulk_configurations = []
         for configuration in configurations:
-            value = request.data.get(configuration.key, configuration.value)
+            raw_value = request.data.get(configuration.key, configuration.value)
+            value = "" if raw_value is None else str(raw_value).strip()
             if configuration.is_encrypted:
                 configuration.value = encrypt_data(value)
             else:

apps/api/plane/license/api/views/instance.py

@@ -63,8 +63,6 @@ class InstanceEndpoint(BaseAPIView):
             POSTHOG_HOST,
             UNSPLASH_ACCESS_KEY,
             LLM_API_KEY,
-            IS_INTERCOM_ENABLED,
-            INTERCOM_APP_ID,
         ) = get_configuration_value(
             [
                 {
@@ -124,15 +122,6 @@ class InstanceEndpoint(BaseAPIView):
                     "key": "LLM_API_KEY",
                     "default": os.environ.get("LLM_API_KEY", ""),
                 },
-                # Intercom settings
-                {
-                    "key": "IS_INTERCOM_ENABLED",
-                    "default": os.environ.get("IS_INTERCOM_ENABLED", "1"),
-                },
-                {
-                    "key": "INTERCOM_APP_ID",
-                    "default": os.environ.get("INTERCOM_APP_ID", ""),
-                },
             ]
         )
 
@@ -169,10 +158,6 @@ class InstanceEndpoint(BaseAPIView):
         # is smtp configured
         data["is_smtp_configured"] = bool(EMAIL_HOST)
 
-        # Intercom settings
-        data["is_intercom_enabled"] = IS_INTERCOM_ENABLED == "1"
-        data["intercom_app_id"] = INTERCOM_APP_ID
-
         # Base URL
         data["admin_base_url"] = settings.ADMIN_BASE_URL
         data["space_base_url"] = settings.SPACE_BASE_URL

apps/api/plane/settings/common.py

@@ -5,6 +5,8 @@
 """Global Settings"""
 
 # Python imports
+import ipaddress
+import logging
 import os
 from urllib.parse import urlparse
 from urllib.parse import urljoin
@@ -32,6 +34,44 @@ DEBUG = int(os.environ.get("DEBUG", "0"))
 # Self-hosted mode
 IS_SELF_MANAGED = True
 
+# Webhook IP allowlist — comma-separated IPs or CIDR ranges that are allowed as
+# webhook targets even if they resolve to private networks.
+# Example: "10.0.0.0/8,192.168.1.0/24,172.16.0.5"
+_webhook_allowed_ips_raw = os.environ.get("WEBHOOK_ALLOWED_IPS", "")
+WEBHOOK_ALLOWED_IPS = []
+_logger = logging.getLogger("plane")
+for _cidr in _webhook_allowed_ips_raw.split(","):
+    _cidr = _cidr.strip()
+    if not _cidr:
+        continue
+    try:
+        WEBHOOK_ALLOWED_IPS.append(ipaddress.ip_network(_cidr, strict=False))
+    except ValueError:
+        _logger.warning("WEBHOOK_ALLOWED_IPS: skipping invalid entry %r", _cidr)
+
+# Webhook hostname allowlist — comma-separated hostnames that bypass the
+# private-IP SSRF check. Useful for trusted internal services whose IPs are
+# dynamic in containerised deployments (e.g. docker-compose service DNS,
+# kubernetes service hostnames).
+# Example: "silo,silo.namespace.svc.cluster.local,internal-api.lan"
+_webhook_allowed_hosts_raw = os.environ.get("WEBHOOK_ALLOWED_HOSTS", "")
+WEBHOOK_ALLOWED_HOSTS = [
+    _host.strip().rstrip(".").lower()
+    for _host in _webhook_allowed_hosts_raw.split(",")
+    if _host.strip()
+]
+
+# Webhook disallowed domains — comma-separated hostnames. Webhooks targeting
+# these domains or any of their subdomains are rejected (the request host is
+# always appended at validation time as a loop-back guard). Empty by default
+# for self-hosted deployments; set to e.g. "plane.so" to block specific domains.
+_webhook_disallowed_domains_raw = os.environ.get("WEBHOOK_DISALLOWED_DOMAINS", "")
+WEBHOOK_DISALLOWED_DOMAINS = [
+    _d.strip().rstrip(".").lower()
+    for _d in _webhook_disallowed_domains_raw.split(",")
+    if _d.strip()
+]
+
 # Allowed Hosts
 ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "*").split(",")
 

apps/api/plane/space/views/asset.py

@@ -18,6 +18,7 @@ from rest_framework.response import Response
 from plane.bgtasks.storage_metadata_task import get_asset_object_metadata
 from plane.db.models import DeployBoard, FileAsset
 from plane.settings.storage import S3Storage
+from plane.utils.path_validator import sanitize_filename
 
 # Module imports
 from .base import BaseAPIView
@@ -73,7 +74,7 @@ class EntityAssetEndpoint(BaseAPIView):
             return Response({"error": "Project is not published"}, status=status.HTTP_404_NOT_FOUND)
 
         # Get the asset
-        name = request.data.get("name")
+        name = sanitize_filename(request.data.get("name")) or "unnamed"
         type = request.data.get("type", "image/jpeg")
         size = int(request.data.get("size", settings.FILE_SIZE_LIMIT))
         entity_type = request.data.get("entity_type", "")

apps/api/plane/tests/contract/api/test_projects.py

@@ -0,0 +1,216 @@
+# Copyright (c) 2023-present Plane Software, Inc. and contributors
+# SPDX-License-Identifier: AGPL-3.0-only
+# See the LICENSE file for details.
+
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+from rest_framework import status
+
+from plane.db.models import Project, ProjectMember, State, User, WorkspaceMember
+
+
+@pytest.fixture
+def other_workspace_member(db, workspace):
+    """Create another user that is a member of the workspace, distinct from the creator."""
+    unique_id = uuid4().hex[:8]
+    other = User.objects.create(
+        email=f"other-{unique_id}@plane.so",
+        username=f"other_user_{unique_id}",
+        first_name="Other",
+        last_name="User",
+    )
+    other.set_password("test-password")
+    other.save()
+    WorkspaceMember.objects.create(workspace=workspace, member=other, role=20)
+    return other
+
+
+@pytest.fixture
+def outsider_user(db):
+    """Create a user that is NOT a member of any workspace under test."""
+    unique_id = uuid4().hex[:8]
+    outsider = User.objects.create(
+        email=f"outsider-{unique_id}@plane.so",
+        username=f"outsider_{unique_id}",
+        first_name="Out",
+        last_name="Sider",
+    )
+    outsider.set_password("test-password")
+    outsider.save()
+    return outsider
+
+
+@pytest.mark.contract
+class TestProjectListCreateAPIEndpoint:
+    """Contract tests for POST /api/v1/workspaces/{slug}/projects/."""
+
+    def get_url(self, workspace_slug):
+        return f"/api/v1/workspaces/{workspace_slug}/projects/"
+
+    @pytest.mark.django_db
+    def test_create_project_with_lead_as_creator(self, api_key_client, workspace, create_user):
+        """Regression for the ghost-create bug.
+
+        When project_lead points to the creator's own user_id, the endpoint
+        must return 201 and create a fully-populated project (single
+        ProjectMember as admin, default workflow states).
+
+        Before the fix, the endpoint returned 400 "Please provide valid detail"
+        but had already persisted the Project row without states or members,
+        leaving an unusable orphan.
+        """
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Self Lead Project",
+            "identifier": "SL",
+            "project_lead": str(create_user.id),
+        }
+
+        response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_201_CREATED, f"Got {response.status_code}: {response.data!r}"
+
+        # Look up the project we just created instead of relying on
+        # ordering-sensitive Project.objects.first().
+        project = Project.objects.get(id=response.data["id"])
+        # Creator is registered as admin (single membership; lead == creator
+        # should not produce a duplicate row).
+        assert ProjectMember.objects.filter(project=project, member=create_user, role=20).count() == 1
+        # Default workflow states must be created.
+        assert State.objects.filter(project=project).count() == 5
+
+    @pytest.mark.django_db
+    def test_create_project_with_lead_as_other_user(
+        self, api_key_client, workspace, create_user, other_workspace_member
+    ):
+        """When project_lead is a different workspace member, both creator
+        and lead become admins of the project."""
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Other Lead Project",
+            "identifier": "OL",
+            "project_lead": str(other_workspace_member.id),
+        }
+
+        response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_201_CREATED, f"Got {response.status_code}: {response.data!r}"
+        project = Project.objects.get(id=response.data["id"])
+
+        # Both creator and other_workspace_member are admins.
+        assert ProjectMember.objects.filter(project=project, member=create_user, role=20).exists()
+        assert ProjectMember.objects.filter(project=project, member=other_workspace_member, role=20).exists()
+        assert State.objects.filter(project=project).count() == 5
+
+    @pytest.mark.django_db
+    def test_create_project_without_lead(self, api_key_client, workspace, create_user):
+        """Baseline regression: omitting project_lead must succeed and the
+        creator becomes the sole admin."""
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Basic Project",
+            "identifier": "BP",
+        }
+
+        response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_201_CREATED, f"Got {response.status_code}: {response.data!r}"
+        project = Project.objects.get(id=response.data["id"])
+        assert ProjectMember.objects.filter(project=project, member=create_user, role=20).count() == 1
+        assert State.objects.filter(project=project).count() == 5
+
+    @pytest.mark.django_db
+    def test_create_project_with_lead_not_in_workspace_returns_400(self, api_key_client, workspace, outsider_user):
+        """When project_lead refers to a user that is NOT a member of the
+        target workspace, the endpoint must reject the request with a 400
+        carrying a field-shaped error and must not persist the Project."""
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Outsider Lead Project",
+            "identifier": "OUT",
+            "project_lead": str(outsider_user.id),
+        }
+
+        response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST, f"Got {response.status_code}: {response.data!r}"
+        assert "project_lead" in response.data, (
+            f"Expected field-shaped error under 'project_lead', got {response.data!r}"
+        )
+        # No project should have been persisted.
+        assert Project.objects.count() == 0
+
+    @pytest.mark.django_db
+    def test_model_activity_not_called_on_rollback(self, api_key_client, workspace, create_user):
+        """If anything inside the transaction.atomic() block raises, the
+        whole creation must roll back (no Project, no ProjectMember, no
+        State) and the deferred model_activity.delay() task must not fire,
+        because it is registered with transaction.on_commit().
+
+        Force the failure inside State.objects.bulk_create — past the point
+        where the original ghost-create bug would have committed a partial
+        Project — and verify the response is 500 with no side effects.
+        """
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Rollback Probe",
+            "identifier": "RB",
+            "project_lead": str(create_user.id),
+        }
+
+        forced_error = RuntimeError("forced failure for rollback test")
+
+        with (
+            mock.patch(
+                "plane.api.views.project.State.objects.bulk_create",
+                side_effect=forced_error,
+            ),
+            mock.patch("plane.api.views.project.model_activity") as mocked_activity,
+        ):
+            response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_500_INTERNAL_SERVER_ERROR, (
+            f"Got {response.status_code}: {response.data!r}"
+        )
+        # Transaction must have rolled back: no Project, no ProjectMember,
+        # no State persisted.
+        assert Project.objects.count() == 0
+        assert ProjectMember.objects.count() == 0
+        assert State.objects.count() == 0
+        # And the deferred Celery task must not have been dispatched —
+        # transaction.on_commit() callbacks only fire on a successful commit.
+        mocked_activity.delay.assert_not_called()
+
+    @pytest.mark.django_db(transaction=True)
+    def test_response_still_201_when_broker_dispatch_fails(self, api_key_client, workspace, create_user):
+        """If model_activity.delay raises *after* the atomic block has
+        committed (e.g., the Celery broker is down), the project, member
+        rows and states are already persisted — the response must remain
+        201 and the failure must be absorbed by Django's robust=True
+        on_commit handling, not surface as a 500.
+
+        Uses ``transaction=True`` so the surrounding test transaction is
+        actually committed and the ``on_commit`` callback fires (the
+        default ``django_db`` wrapper would suppress it via rollback)."""
+        url = self.get_url(workspace.slug)
+        payload = {
+            "name": "Broker Down",
+            "identifier": "BD",
+            "project_lead": str(create_user.id),
+        }
+
+        with mock.patch("plane.api.views.project.model_activity") as mocked_activity:
+            mocked_activity.delay.side_effect = RuntimeError("broker unavailable")
+            response = api_key_client.post(url, payload, format="json")
+
+        assert response.status_code == status.HTTP_201_CREATED, f"Got {response.status_code}: {response.data!r}"
+        # Project and its scaffolding are persisted (commit happened
+        # before the on_commit callback fired).
+        project = Project.objects.get(id=response.data["id"])
+        assert ProjectMember.objects.filter(project=project).count() == 1
+        assert State.objects.filter(project=project).count() == 5
+        # The dispatch was attempted but its failure was swallowed by
+        # transaction.on_commit(robust=True).
+        mocked_activity.delay.assert_called_once()

apps/api/plane/tests/unit/bg_tasks/test_work_item_link_task.py

@@ -2,9 +2,12 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # See the LICENSE file for details.
 
+import ipaddress
+
 import pytest
 from unittest.mock import patch, MagicMock
 from plane.bgtasks.work_item_link_task import safe_get, validate_url_ip
+from plane.utils.ip_address import validate_url
 
 
 def _make_response(status_code=200, headers=None, is_redirect=False, content=b""):
@@ -43,6 +46,91 @@ class TestValidateUrlIp:
             validate_url_ip("https://example.com")  # Should not raise
 
 
+@pytest.mark.unit
+class TestValidateUrlAllowlist:
+    """Test validate_url allowlist permits specific private IPs."""
+
+    def test_allowlist_permits_private_ip(self):
+        allowed = [ipaddress.ip_network("192.168.1.0/24")]
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("192.168.1.50", 0))]
+            validate_url("http://example.com", allowed_ips=allowed)  # Should not raise
+
+    def test_allowlist_does_not_permit_other_private_ip(self):
+        allowed = [ipaddress.ip_network("192.168.1.0/24")]
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("10.0.0.1", 0))]
+            with pytest.raises(ValueError, match="private/internal"):
+                validate_url("http://example.com", allowed_ips=allowed)
+
+    def test_allowlist_permits_loopback_when_explicitly_allowed(self):
+        allowed = [ipaddress.ip_network("127.0.0.0/8")]
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("127.0.0.1", 0))]
+            validate_url("http://example.com", allowed_ips=allowed)  # Should not raise
+
+    def test_allowlist_permits_matching_ipv4_with_mixed_version_networks(self):
+        allowed = [
+            ipaddress.ip_network("2001:db8::/32"),
+            ipaddress.ip_network("192.168.1.0/24"),
+        ]
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("192.168.1.50", 0))]
+            validate_url("http://example.com", allowed_ips=allowed)  # Should not raise
+
+    def test_allowlist_blocks_non_matching_ipv4_with_mixed_version_networks(self):
+        allowed = [
+            ipaddress.ip_network("2001:db8::/32"),
+            ipaddress.ip_network("192.168.1.0/24"),
+        ]
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("10.0.0.1", 0))]
+            with pytest.raises(ValueError, match="private/internal"):
+                validate_url("http://example.com", allowed_ips=allowed)
+
+    def test_allowed_hosts_bypasses_private_ip_check(self):
+        """Hostnames in WEBHOOK_ALLOWED_HOSTS skip IP-based blocking — used for
+        trusted internal services (e.g. Silo) whose IPs are dynamic in
+        containerised deployments."""
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("172.18.0.5", 0))]
+            validate_url("http://silo:3000/hook", allowed_hosts=["silo"])  # Should not raise
+
+    def test_allowed_hosts_matches_case_insensitively(self):
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("10.0.0.1", 0))]
+            validate_url(
+                "http://Silo.Namespace.Svc.Cluster.Local/x",
+                allowed_hosts=["silo.namespace.svc.cluster.local"],
+            )  # Should not raise
+
+    def test_allowed_hosts_skips_dns_lookup(self):
+        """When the hostname is explicitly trusted we shouldn't even resolve it —
+        protects against operators who allowlist a name that isn't resolvable
+        from the API container."""
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            validate_url("http://silo/hook", allowed_hosts=["silo"])
+            mock_dns.assert_not_called()
+
+    def test_allowed_hosts_requires_exact_match(self):
+        """Subdomains of an allowed host must NOT bypass — a hostile
+        ``attacker.silo.internal`` should still be blocked when only
+        ``silo.internal`` is allowed."""
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("192.168.1.1", 0))]
+            with pytest.raises(ValueError, match="private/internal"):
+                validate_url(
+                    "http://attacker.silo.internal/x",
+                    allowed_hosts=["silo.internal"],
+                )
+
+    def test_allowed_hosts_empty_does_not_bypass(self):
+        with patch("plane.utils.ip_address.socket.getaddrinfo") as mock_dns:
+            mock_dns.return_value = [(None, None, None, None, ("10.0.0.1", 0))]
+            with pytest.raises(ValueError, match="private/internal"):
+                validate_url("http://silo/hook", allowed_hosts=[])
+
+
 @pytest.mark.unit
 class TestSafeGet:
     """Test safe_get follows redirects safely and blocks SSRF."""

apps/api/plane/utils/analytics_plot.py

@@ -22,6 +22,23 @@ from django.utils import timezone
 # Module imports
 from plane.db.models import Issue, Project
 
+VALID_ANALYTICS_FIELDS = [
+    "state_id",
+    "state__group",
+    "labels__id",
+    "assignees__id",
+    "estimate_point__value",
+    "issue_cycle__cycle_id",
+    "issue_module__module_id",
+    "priority",
+    "start_date",
+    "target_date",
+    "created_at",
+    "completed_at",
+]
+
+VALID_YAXIS = ["issue_count", "estimate"]
+
 
 def annotate_with_monthly_dimension(queryset, field_name, attribute):
     # Get the year and the months
@@ -34,6 +51,8 @@ def annotate_with_monthly_dimension(queryset, field_name, attribute):
 
 
 def extract_axis(queryset, x_axis):
+    if x_axis not in VALID_ANALYTICS_FIELDS:
+        raise ValueError(f"Invalid x_axis value: {x_axis}")
     # Format the dimension when the axis is in date
     if x_axis in ["created_at", "start_date", "target_date", "completed_at"]:
         queryset = annotate_with_monthly_dimension(queryset, x_axis, "dimension")
@@ -52,6 +71,13 @@ def sort_data(data, temp_axis):
 
 
 def build_graph_plot(queryset, x_axis, y_axis, segment=None):
+    if x_axis not in VALID_ANALYTICS_FIELDS:
+        raise ValueError(f"Invalid x_axis value: {x_axis}")
+    if y_axis not in VALID_YAXIS:
+        raise ValueError(f"Invalid y_axis value: {y_axis}")
+    if segment and segment not in VALID_ANALYTICS_FIELDS:
+        raise ValueError(f"Invalid segment value: {segment}")
+
     # temp x_axis
     temp_axis = x_axis
     # Extract the x_axis and queryset

apps/api/plane/utils/instance_config_variables/core.py

@@ -232,21 +232,6 @@ unsplash_config_variables = [
     },
 ]
 
-intercom_config_variables = [
-    {
-        "key": "IS_INTERCOM_ENABLED",
-        "value": os.environ.get("IS_INTERCOM_ENABLED", "1"),
-        "category": "INTERCOM",
-        "is_encrypted": False,
-    },
-    {
-        "key": "INTERCOM_APP_ID",
-        "value": os.environ.get("INTERCOM_APP_ID", ""),
-        "category": "INTERCOM",
-        "is_encrypted": False,
-    },
-]
-
 core_config_variables = [
     *authentication_config_variables,
     *workspace_management_config_variables,
@@ -257,5 +242,4 @@ core_config_variables = [
     *smtp_config_variables,
     *llm_config_variables,
     *unsplash_config_variables,
-    *intercom_config_variables,
 ]

apps/api/plane/utils/ip_address.py

@@ -2,6 +2,63 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 # See the LICENSE file for details.
 
+# Python imports
+import ipaddress
+import socket
+from urllib.parse import urlparse
+
+
+def validate_url(url, allowed_ips=None, allowed_hosts=None):
+    """
+    Validate that a URL doesn't resolve to a private/internal IP address (SSRF protection).
+
+    Args:
+        url: The URL to validate.
+        allowed_ips: Optional list of ipaddress.ip_network objects. IPs falling within
+                     these networks are permitted even if they are private/loopback/reserved.
+                     Typically sourced from the WEBHOOK_ALLOWED_IPS setting.
+        allowed_hosts: Optional iterable of hostnames that bypass IP-based blocking
+                       (exact, case-insensitive match against the URL hostname).
+                       Typically sourced from the WEBHOOK_ALLOWED_HOSTS setting and
+                       used for trusted internal services (e.g. Silo) whose IPs are
+                       dynamic in containerised deployments.
+
+    Raises:
+        ValueError: If the URL is invalid or resolves to a blocked IP.
+    """
+    parsed = urlparse(url)
+    hostname = parsed.hostname
+
+    if not hostname:
+        raise ValueError("Invalid URL: No hostname found")
+
+    if parsed.scheme not in ("http", "https"):
+        raise ValueError("Invalid URL scheme. Only HTTP and HTTPS are allowed")
+
+    normalized_host = hostname.rstrip(".").lower()
+    if allowed_hosts and normalized_host in {
+        (h or "").rstrip(".").lower() for h in allowed_hosts if h
+    }:
+        return
+
+    try:
+        addr_info = socket.getaddrinfo(hostname, None)
+    except socket.gaierror:
+        raise ValueError("Hostname could not be resolved")
+
+    if not addr_info:
+        raise ValueError("No IP addresses found for the hostname")
+
+    for addr in addr_info:
+        ip = ipaddress.ip_address(addr[4][0])
+        if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
+            if allowed_ips and any(
+                network.version == ip.version and ip in network for network in allowed_ips
+            ):
+                continue
+            raise ValueError("Access to private/internal networks is not allowed")
+
+
 def get_client_ip(request):
     x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
     if x_forwarded_for:

apps/api/plane/utils/path_validator.py

@@ -7,9 +7,50 @@ from django.utils.http import url_has_allowed_host_and_scheme
 from django.conf import settings
 
 # Python imports
+import os
 from urllib.parse import urlparse
 
 
+def sanitize_filename(filename):
+    """
+    Sanitize a filename to prevent path traversal attacks.
+
+    Strips directory components, path traversal sequences, and null bytes
+    from user-supplied filenames used in upload paths and S3 object keys.
+
+    Returns None for empty/missing input so callers can still validate
+    that a filename was provided.
+    """
+    if not filename or not isinstance(filename, str):
+        return None
+
+    # Strip null bytes
+    filename = filename.replace("\x00", "")
+
+    # Normalize backslashes so os.path.basename handles Windows-style paths on POSIX
+    filename = filename.replace("\\", "/")
+
+    # Take only the basename to remove any directory components
+    filename = os.path.basename(filename)
+
+    # Remove any remaining path traversal sequences
+    filename = filename.replace("..", "")
+
+    # Strip whitespace before removing leading dots so " .env" is caught
+    filename = filename.strip()
+
+    # Remove leading dots (hidden files)
+    filename = filename.lstrip(".")
+
+    # Strip any remaining whitespace
+    filename = filename.strip()
+
+    if not filename:
+        return None
+
+    return filename
+
+
 def _contains_suspicious_patterns(path: str) -> bool:
     """
     Check for suspicious patterns that might indicate malicious intent.

apps/api/requirements/base.txt

@@ -1,7 +1,7 @@
 # base requirements
 
 # django
-Django==4.2.29
+Django==4.2.30
 # rest framework
 djangorestframework==3.15.2
 # postgres
@@ -51,9 +51,9 @@ beautifulsoup4==4.12.3
 # analytics
 posthog==3.5.0
 # crypto
-cryptography==46.0.6
+cryptography==46.0.7
 # html validator
-lxml==6.0.0
+lxml==6.1.0
 # s3
 boto3==1.34.96
 # password validator

apps/api/requirements/test.txt

@@ -1,6 +1,6 @@
 -r base.txt
 # test framework
-pytest==9.0.2
+pytest==9.0.3
 pytest-django==4.5.2
 pytest-cov==4.1.0
 pytest-xdist==3.3.1

apps/api/templates/emails/invitations/project_invitation.html

@@ -261,7 +261,7 @@
                                                                           <td height="5" width="8" style=" font-size: 5px; line-height: 5px; " > ­ </td>
                                                                         </tr>
                                                                         <tr>
-                                                                          <td class="r26-i" style=" font-size: 0px; line-height: 0px; " > <a href="https://twitter.com/planepowers" target="_blank" style=" color: #0092ff; text-decoration: underline; " > <img src="{{ current_site }}/static/logos/twitter_32px.png" width="32" border="0" class="" style=" display: block; width: 100%; " /></a> </td>
+                                                                          <td class="r26-i" style=" font-size: 0px; line-height: 0px; " > <a href="https://x.com/planepowers" target="_blank" style=" color: #0092ff; text-decoration: underline; " > <img src="{{ current_site }}/static/logos/twitter_32px.png" width="32" border="0" class="" style=" display: block; width: 100%; " /></a> </td>
                                                                           <td class="nl2go-responsive-hide" width="8" style=" font-size: 0px; line-height: 1px; " > ­ </td>
                                                                         </tr>
                                                                         <tr class="nl2go-responsive-hide" >

apps/api/templates/emails/notifications/issue-updates.html

@@ -233,7 +233,7 @@
           <td>
             <div style="font-size: 0.8rem; color: #1c2024">
               This email was sent to <a href="mailto:{{receiver.email}}" style="color: #3a5bc7; font-weight: 500; text-decoration: none" >{{ receiver.email }}.</a > If you'd rather not receive this kind of email, <a href="{{ issue_url }}" style="color: #3a5bc7; text-decoration: none" >you can unsubscribe to the {{entity_type}}</a > or <a href="{{ user_preference }}" style="color: #3a5bc7; text-decoration: none" >manage your email preferences</a >. <!-- Github | LinkedIn | Twitter --> 
-              <div style="margin-top: 60px; float: right"> <a href="https://github.com/makeplane" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/github_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> <a href="https://www.linkedin.com/company/planepowers/" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/linkedin_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> <a href="https://twitter.com/planepowers" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/twitter_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> </div>
+              <div style="margin-top: 60px; float: right"> <a href="https://github.com/makeplane" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/github_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> <a href="https://www.linkedin.com/company/planepowers/" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/linkedin_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> <a href="https://x.com/planepowers" target="_blank" style="margin-left: 10px; text-decoration: none" > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/twitter_32px.png" width="25" height="25" border="0" style="display: inline-block" /> </a> </div>
             </div>
           </td>
         </tr>

apps/api/templates/emails/notifications/webhook-deactivate.html

@@ -155,7 +155,7 @@
                                             <td class="nl2go-responsive-hide" width="2" style=" font-size: 0px; line-height: 1px; background-color: #efefef; " > ­ </td>
                                             <td align="left" valign="top" class="r21-i nl2go-default-textstyle" style=" color: #3b3f44; font-family: georgia, serif; font-size: 16px; word-break: break-word; line-height: 1.5; padding-bottom: 5px; padding-left: 5px; padding-right: 5px; padding-top: 5px; text-align: left; " >
                                               <div>
-                                                <p style="margin: 0"> <span style="font-size: 13px" >Despite our popularity, we are humbly early-stage. We are shipping fast, so please reach out to us with feature requests, major and minor nits, and anything else you find missing. We read every </span ><a href="https://forum.plane.so" title="Plane Forum" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >message</span ></a ><span style="font-size: 13px" >, </span ><a href="http://twitter.com/planepowers" title="@planepowers" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >tweet</span ></a ><span style="font-size: 13px" >, and </span ><a href="https://github.com/makeplane/plane/issues" title="Plane's GitHub conversations" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >conversation</span ></a ><span style="font-size: 13px" > and update </span ><a href="https://plane.sh/plane/0b170a1c-0e55-47cb-9307-ea49a05672b5?board=kanban" title="Plane's roadmap" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >our public roadmap</span ></a ><span style="font-size: 13px" >.</span > </p>
+                                                <p style="margin: 0"> <span style="font-size: 13px" >Despite our popularity, we are humbly early-stage. We are shipping fast, so please reach out to us with feature requests, major and minor nits, and anything else you find missing. We read every </span ><a href="https://forum.plane.so" title="Plane Forum" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >message</span ></a ><span style="font-size: 13px" >, </span ><a href="https://x.com/planepowers" title="@planepowers" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >tweet</span ></a ><span style="font-size: 13px" >, and </span ><a href="https://github.com/makeplane/plane/issues" title="Plane's GitHub conversations" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >conversation</span ></a ><span style="font-size: 13px" > and update </span ><a href="https://plane.sh/plane/0b170a1c-0e55-47cb-9307-ea49a05672b5?board=kanban" title="Plane's roadmap" target="_blank" style=" color: #006399; text-decoration: underline; " ><span style="font-size: 13px" >our public roadmap</span ></a ><span style="font-size: 13px" >.</span > </p>
                                               </div>
                                             </td>
                                             <td class="nl2go-responsive-hide" width="2" style=" font-size: 0px; line-height: 1px; background-color: #efefef; " > ­ </td>
@@ -220,7 +220,7 @@
                                                               <th width="40" class="r25-c mobshow resp-table" style=" font-weight: normal; " >
                                                                 <table cellspacing="0" cellpadding="0" border="0" role="presentation" width="100%" class="r26-o" style=" table-layout: fixed; width: 100%; " >
                                                                   <tr>
-                                                                    <td class="r18-i" style=" font-size: 0px; line-height: 0px; padding-bottom: 5px; padding-top: 5px; " > <a href="https://twitter.com/planepowers" target="_blank" style=" color: #006399; text-decoration: underline; " > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/twitter_32px.png" width="32" border="0" style=" display: block; width: 100%; " /></a> </td>
+                                                                    <td class="r18-i" style=" font-size: 0px; line-height: 0px; padding-bottom: 5px; padding-top: 5px; " > <a href="https://x.com/planepowers" target="_blank" style=" color: #006399; text-decoration: underline; " > <img src="https://creative-assets.mailinblue.com/editor/social-icons/rounded_colored/twitter_32px.png" width="32" border="0" style=" display: block; width: 100%; " /></a> </td>
                                                                     <td class="nl2go-responsive-hide" width="8" style=" font-size: 0px; line-height: 1px; " > ­ </td>
                                                                   </tr>
                                                                 </table>

apps/api/templates/emails/user/email_updated.html

@@ -831,7 +831,7 @@
                                                                       "
                                                                     >
                                                                       <a
-                                                                        href="https://twitter.com/planepowers"
+                                                                        href="https://x.com/planepowers"
                                                                         target="_blank"
                                                                         style="
                                                                           color: #006399;

apps/api/templates/emails/user/user_activation.html

@@ -973,7 +973,7 @@
                                                   ><span style="font-size: 13px"
                                                     >, </span
                                                   ><a
-                                                    href="http://twitter.com/planepowers"
+                                                    href="https://x.com/planepowers"
                                                     title="@planepowers"
                                                     target="_blank"
                                                     style="
@@ -1344,7 +1344,7 @@
                                                                       "
                                                                     >
                                                                       <a
-                                                                        href="https://twitter.com/planepowers"
+                                                                        href="https://x.com/planepowers"
                                                                         target="_blank"
                                                                         style="
                                                                           color: #006399;

apps/api/templates/emails/user/user_deactivation.html

@@ -974,7 +974,7 @@
                                                   ><span style="font-size: 13px"
                                                     >, </span
                                                   ><a
-                                                    href="http://twitter.com/planepowers"
+                                                    href="https://x.com/planepowers"
                                                     title="@planepowers"
                                                     target="_blank"
                                                     style="
@@ -1345,7 +1345,7 @@
                                                                       "
                                                                     >
                                                                       <a
-                                                                        href="https://twitter.com/planepowers"
+                                                                        href="https://x.com/planepowers"
                                                                         target="_blank"
                                                                         style="
                                                                           color: #006399;

apps/live/Dockerfile.live

@@ -3,7 +3,7 @@ FROM node:22-alpine AS base
 
 # Setup pnpm package manager with corepack and configure global bin directory for caching
 ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
+ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
 RUN corepack enable
 
 # *****************************************************************************

apps/live/package.json

@@ -1,6 +1,6 @@
 {
   "name": "live",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "description": "A realtime collaborative server powers Plane's rich text editor",
   "license": "AGPL-3.0",

apps/space/Dockerfile.space

@@ -4,7 +4,7 @@ WORKDIR /app
 
 ENV TURBO_TELEMETRY_DISABLED=1
 ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
+ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
 ENV CI=1
 
 RUN corepack enable pnpm

apps/space/nginx/nginx.conf

@@ -11,7 +11,7 @@ http {
 
   set_real_ip_from        0.0.0.0/0;
   real_ip_recursive       on;
-  real_ip_header          X-Forward-For;
+  real_ip_header          X-Forwarded-For;
   limit_req_zone          $binary_remote_addr zone=mylimit:10m rate=10r/s;
 
   access_log /dev/stdout;

apps/space/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "license": "AGPL-3.0",
   "type": "module",

apps/web/Dockerfile.web

@@ -3,7 +3,7 @@ FROM node:22-alpine AS base
 
 # Setup pnpm package manager with corepack and configure global bin directory for caching
 ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME:$PATH"
+ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"
 RUN corepack enable
 
 # *****************************************************************************

apps/web/core/components/analytics/work-items/created-vs-resolved.tsx

@@ -108,7 +108,7 @@ const CreatedVsResolved = observer(function CreatedVsResolved() {
           }}
           yAxis={{
             key: "count",
-            label: t("common.no_of", { entity: isEpic ? t("epics") : t("work_items") }),
+            label: t("common.no_of", { entity: isEpic ? t("common.epics") : t("work_items") }),
             offset: -60,
             dx: -24,
           }}

apps/web/core/components/comments/quick-actions.tsx

@@ -78,45 +78,43 @@ export const CommentQuickActions = observer(function CommentQuickActions(props:
           icon: TrashIcon,
           shouldRender: canDelete,
         },
-      ];
+      ].filter((item) => item.shouldRender !== false);
     },
     [t, setEditMode, canEdit, showCopyLinkOption, activityOperations, comment, showAccessSpecifier, canDelete]
   );
 
+  if (MENU_ITEMS.length === 0) return null;
+
   return (
     <CustomMenu customButton={<IconButton icon={MoreHorizontal} variant="ghost" size="sm" />} closeOnSelect>
-      {MENU_ITEMS.map((item) => {
-        if (item.shouldRender === false) return null;
-
-        return (
-          <CustomMenu.MenuItem
-            key={item.key}
-            onClick={() => item.action()}
-            className={cn(
-              "flex items-center gap-2",
-              {
-                "text-placeholder": item.disabled,
-              },
-              item.className
+      {MENU_ITEMS.map((item) => (
+        <CustomMenu.MenuItem
+          key={item.key}
+          onClick={() => item.action()}
+          className={cn(
+            "flex items-center gap-2",
+            {
+              "text-placeholder": item.disabled,
+            },
+            item.className
+          )}
+          disabled={item.disabled}
+        >
+          {item.icon && <item.icon className={cn("size-3 shrink-0", item.iconClassName)} />}
+          <div>
+            <h5>{item.title}</h5>
+            {item.description && (
+              <p
+                className={cn("whitespace-pre-line text-tertiary", {
+                  "text-placeholder": item.disabled,
+                })}
+              >
+                {item.description}
+              </p>
             )}
-            disabled={item.disabled}
-          >
-            {item.icon && <item.icon className={cn("size-3 shrink-0", item.iconClassName)} />}
-            <div>
-              <h5>{item.title}</h5>
-              {item.description && (
-                <p
-                  className={cn("whitespace-pre-line text-tertiary", {
-                    "text-placeholder": item.disabled,
-                  })}
-                >
-                  {item.description}
-                </p>
-              )}
-            </div>
-          </CustomMenu.MenuItem>
-        );
-      })}
+          </div>
+        </CustomMenu.MenuItem>
+      ))}
     </CustomMenu>
   );
 });

apps/web/core/components/core/modals/change-email-modal.tsx

@@ -61,8 +61,8 @@ export const ChangeEmailModal = observer(function ChangeEmailModal(props: Props)
     await signOut().catch(() =>
       setToast({
         type: TOAST_TYPE.ERROR,
-        title: t("sign_out.toast.error.title"),
-        message: t("sign_out.toast.error.message"),
+        title: t("auth.sign_out.toast.error.title"),
+        message: t("auth.sign_out.toast.error.message"),
       })
     );
   };

apps/web/core/components/core/theme/custom-theme-selector.tsx

@@ -117,7 +117,7 @@ export const CustomThemeSelector = observer(function CustomThemeSelector() {
       <div className="mt-5 flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between">
         {/* Save Theme Button */}
         <Button variant="primary" size="lg" type="submit" loading={isSubmitting || isLoadingPalette}>
-          {isSubmitting ? t("creating_theme") : isLoadingPalette ? "Generating" : t("set_theme")}
+          {isSubmitting ? t("common.saving") : isLoadingPalette ? "Generating" : t("set_theme")}
         </Button>
         {/* Import/Export Section */}
         <CustomThemeDownloadConfigButton getValues={getValues} />

apps/web/core/components/issues/issue-detail/issue-detail-quick-actions.tsx

@@ -100,7 +100,7 @@ export const IssueDetailQuickActions = observer(function IssueDetailQuickActions
       router.push(redirectionPath);
     } catch (_error) {
       setToast({
-        title: t("toast.error "),
+        title: t("toast.error"),
         type: TOAST_TYPE.ERROR,
         message: t("entity.delete.failed", { entity: t("issue.label", { count: 1 }) }),
       });

apps/web/core/components/modules/analytics-sidebar/issue-progress.tsx

@@ -127,7 +127,7 @@ export const ModuleAnalyticsProgress = observer(function ModuleAnalyticsProgress
             {isModuleDateValid ? (
               <div className="relative flex w-full items-center justify-between gap-2">
                 <Disclosure.Button className="relative flex w-full items-center gap-2">
-                  <div className="text-13 font-medium text-secondary">{t("progress")}</div>
+                  <div className="text-13 font-medium text-secondary">{t("common.progress")}</div>
                   {progressHeaderPercentage > 0 && (
                     <div className="bg-amber-500/20 text-amber-500 flex h-5 w-9 items-center justify-center rounded-sm text-11 font-medium">{`${progressHeaderPercentage}%`}</div>
                   )}

apps/web/core/components/navigation/customize-navigation-dialog.tsx

@@ -230,7 +230,7 @@ export const CustomizeNavigationDialog = observer(function CustomizeNavigationDi
 
           {/* Workspace Section */}
           <div className="flex flex-col gap-2">
-            <h3 className="text-13 font-semibold text-placeholder">{t("workspace")}</h3>
+            <h3 className="text-13 font-semibold text-placeholder">{t("common.workspace")}</h3>
             <div className="rounded-md border border-subtle bg-surface-2 py-2">
               {/* Pinned Items - Draggable */}
               <Sortable

apps/web/core/components/onboarding/header.tsx

@@ -12,6 +12,7 @@ import type { TOnboardingStep } from "@plane/types";
 import { EOnboardingSteps } from "@plane/types";
 import { cn } from "@plane/utils";
 // hooks
+import { useInstance } from "@/hooks/store/use-instance";
 import { useUser } from "@/hooks/store/user";
 // local imports
 import { SwitchAccountDropdown } from "./switch-account-dropdown";
@@ -26,6 +27,8 @@ export const OnboardingHeader = observer(function OnboardingHeader(props: Onboar
   const { currentStep, updateCurrentStep, hasInvitations } = props;
   // store hooks
   const { data: user } = useUser();
+  const { config: instanceConfig } = useInstance();
+  const isSelfManaged = instanceConfig?.is_self_managed;
 
   // handle step back
   const handleStepBack = () => {
@@ -37,7 +40,7 @@ export const OnboardingHeader = observer(function OnboardingHeader(props: Onboar
         updateCurrentStep(EOnboardingSteps.ROLE_SETUP);
         break;
       case EOnboardingSteps.WORKSPACE_CREATE_OR_JOIN:
-        updateCurrentStep(EOnboardingSteps.USE_CASE_SETUP);
+        updateCurrentStep(isSelfManaged ? EOnboardingSteps.PROFILE_SETUP : EOnboardingSteps.USE_CASE_SETUP);
         break;
     }
   };
@@ -45,22 +48,18 @@ export const OnboardingHeader = observer(function OnboardingHeader(props: Onboar
   // can go back
   const canGoBack = ![EOnboardingSteps.PROFILE_SETUP, EOnboardingSteps.INVITE_MEMBERS].includes(currentStep);
 
-  // Get current step number for progress tracking
-  const getCurrentStepNumber = (): number => {
-    const stepOrder: TOnboardingStep[] = [
-      EOnboardingSteps.PROFILE_SETUP,
-      EOnboardingSteps.ROLE_SETUP,
-      EOnboardingSteps.USE_CASE_SETUP,
-      ...(hasInvitations
-        ? [EOnboardingSteps.WORKSPACE_CREATE_OR_JOIN]
-        : [EOnboardingSteps.WORKSPACE_CREATE_OR_JOIN, EOnboardingSteps.INVITE_MEMBERS]),
-    ];
-    return stepOrder.indexOf(currentStep) + 1;
-  };
+  // step order for progress tracking — include INVITE_MEMBERS if user is currently on it
+  const showInviteStep = !hasInvitations || currentStep === EOnboardingSteps.INVITE_MEMBERS;
+  const stepOrder: TOnboardingStep[] = [
+    EOnboardingSteps.PROFILE_SETUP,
+    ...(isSelfManaged ? [] : [EOnboardingSteps.ROLE_SETUP, EOnboardingSteps.USE_CASE_SETUP]),
+    EOnboardingSteps.WORKSPACE_CREATE_OR_JOIN,
+    ...(showInviteStep ? [EOnboardingSteps.INVITE_MEMBERS] : []),
+  ];
 
   // derived values
-  const currentStepNumber = getCurrentStepNumber();
-  const totalSteps = hasInvitations ? 4 : 5; // 4 if invites available, 5 if not
+  const currentStepNumber = stepOrder.indexOf(currentStep) + 1;
+  const totalSteps = stepOrder.length;
   const userName = user?.display_name
     ? user?.display_name
     : user?.first_name

apps/web/core/components/onboarding/root.tsx

@@ -11,6 +11,7 @@ import { TOAST_TYPE, setToast } from "@plane/propel/toast";
 import type { IWorkspaceMemberInvitation, TOnboardingStep, TOnboardingSteps, TUserProfile } from "@plane/types";
 import { EOnboardingSteps } from "@plane/types";
 // hooks
+import { useInstance } from "@/hooks/store/use-instance";
 import { useWorkspace } from "@/hooks/store/use-workspace";
 import { useUser, useUserProfile } from "@/hooks/store/user";
 // local components
@@ -27,8 +28,10 @@ export const OnboardingRoot = observer(function OnboardingRoot({ invitations = [
   const { data: user } = useUser();
   const { data: userProfile, updateUserProfile, finishUserOnboarding } = useUserProfile();
   const { workspaces } = useWorkspace();
+  const { config: instanceConfig } = useInstance();
 
   const workspacesList = Object.values(workspaces ?? {});
+  const isSelfManaged = instanceConfig?.is_self_managed;
 
   // Calculate total steps based on whether invitations are available
   const hasInvitations = invitations.length > 0;
@@ -68,7 +71,14 @@ export const OnboardingRoot = observer(function OnboardingRoot({ invitations = [
     (step: EOnboardingSteps, skipInvites?: boolean) => {
       switch (step) {
         case EOnboardingSteps.PROFILE_SETUP:
-          setCurrentStep(EOnboardingSteps.ROLE_SETUP);
+          if (isSelfManaged) {
+            // Skip role & use case steps for self-hosted
+            stepChange({ profile_complete: true });
+            if (workspacesList.length > 0) finishOnboarding();
+            else setCurrentStep(EOnboardingSteps.WORKSPACE_CREATE_OR_JOIN);
+          } else {
+            setCurrentStep(EOnboardingSteps.ROLE_SETUP);
+          }
           break;
         case EOnboardingSteps.ROLE_SETUP:
           setCurrentStep(EOnboardingSteps.USE_CASE_SETUP);
@@ -91,7 +101,7 @@ export const OnboardingRoot = observer(function OnboardingRoot({ invitations = [
           break;
       }
     },
-    [stepChange, finishOnboarding, workspacesList]
+    [stepChange, finishOnboarding, workspacesList, isSelfManaged]
   );
 
   const updateCurrentStep = (step: EOnboardingSteps) => setCurrentStep(step);

apps/web/core/components/power-k/config/account-commands.ts

@@ -30,8 +30,8 @@ export const usePowerKAccountCommands = (): TPowerKCommandConfig[] => {
     signOut().catch(() =>
       setToast({
         type: TOAST_TYPE.ERROR,
-        title: t("sign_out.toast.error.title"),
-        message: t("sign_out.toast.error.message"),
+        title: t("auth.sign_out.toast.error.title"),
+        message: t("auth.sign_out.toast.error.message"),
       })
     );
     // eslint-disable-next-line react-hooks/exhaustive-deps

apps/web/core/components/power-k/config/help-commands.ts

@@ -9,7 +9,6 @@ import { FileText, GithubIcon, MessageSquare, Rocket } from "lucide-react";
 import type { TPowerKCommandConfig } from "@/components/power-k/core/types";
 // hooks
 import { usePowerK } from "@/hooks/store/use-power-k";
-import { useChatSupport } from "@/hooks/use-chat-support";
 
 /**
  * Help commands - Help related commands
@@ -17,7 +16,6 @@ import { useChatSupport } from "@/hooks/use-chat-support";
 export const usePowerKHelpCommands = (): TPowerKCommandConfig[] => {
   // store
   const { toggleShortcutsListModal } = usePowerK();
-  const { isEnabled: isChatSupportEnabled, openChatSupport } = useChatSupport();
 
   return [
     {
@@ -71,16 +69,5 @@ export const usePowerKHelpCommands = (): TPowerKCommandConfig[] => {
       isVisible: () => true,
       closeOnSelect: true,
     },
-    {
-      id: "chat_with_us",
-      type: "action",
-      group: "help",
-      i18n_title: "power_k.help_actions.chat_with_us",
-      icon: MessageSquare,
-      action: () => openChatSupport(),
-      isEnabled: () => isChatSupportEnabled,
-      isVisible: () => isChatSupportEnabled,
-      closeOnSelect: true,
-    },
   ];
 };

apps/web/core/components/power-k/ui/modal/shortcuts-root.tsx

@@ -8,6 +8,7 @@ import { useState, Fragment } from "react";
 import { Dialog, Transition } from "@headlessui/react";
 // plane imports
 import { CloseIcon, SearchIcon } from "@plane/propel/icons";
+import { ScrollArea } from "@plane/propel/scrollarea";
 import { Input } from "@plane/ui";
 // hooks
 import { usePowerK } from "@/hooks/store/use-power-k";
@@ -61,28 +62,33 @@ export function ShortcutsModal(props: Props) {
               leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
             >
               <Dialog.Panel className="relative flex h-full items-center justify-center">
-                <div className="flex h-[61vh] w-full flex-col space-y-4 overflow-hidden rounded-lg bg-surface-1 p-5 shadow-raised-200 transition-all sm:w-[28rem]">
-                  <Dialog.Title as="h3" className="flex justify-between">
+                <div className="flex h-[61vh] w-full flex-col space-y-4 overflow-hidden rounded-lg bg-surface-1 py-5 shadow-raised-200 transition-all sm:w-[28rem]">
+                  <Dialog.Title as="h3" className="flex justify-between px-5">
                     <span className="text-16 font-medium">Keyboard shortcuts</span>
                     <button type="button" onClick={handleClose}>
                       <CloseIcon className="h-4 w-4 text-secondary hover:text-primary" aria-hidden="true" />
                     </button>
                   </Dialog.Title>
-                  <div className="flex w-full items-center rounded-sm border-[0.5px] border-subtle bg-surface-2 px-2">
-                    <SearchIcon className="h-3.5 w-3.5 text-secondary" />
-                    <Input
-                      id="search"
-                      name="search"
-                      type="text"
-                      value={query}
-                      onChange={(e) => setQuery(e.target.value)}
-                      placeholder="Search for shortcuts"
-                      className="w-full border-none bg-transparent py-1 text-11 text-secondary outline-none"
-                      autoFocus
-                      tabIndex={1}
-                    />
+                  <div className="px-5">
+                    <div className="flex w-full items-center rounded-sm border-[0.5px] border-subtle bg-surface-2 px-2">
+                      <SearchIcon className="h-3.5 w-3.5 text-secondary" />
+                      <Input
+                        id="search"
+                        name="search"
+                        type="text"
+                        value={query}
+                        onChange={(e) => setQuery(e.target.value)}
+                        placeholder="Search for shortcuts"
+                        className="w-full border-none bg-transparent py-1 text-11 text-secondary outline-none"
+                        autoFocus
+                        tabIndex={1}
+                      />
+                    </div>
                   </div>
-                  <ShortcutRenderer searchQuery={query} commands={allCommandsWithShortcuts} />
+
+                  <ScrollArea size="sm" rootClassName="overflow-y-scroll px-5">
+                    <ShortcutRenderer searchQuery={query} commands={allCommandsWithShortcuts} />
+                  </ScrollArea>
                 </div>
               </Dialog.Panel>
             </Transition.Child>

apps/web/core/components/power-k/ui/renderer/shortcut.tsx

@@ -78,7 +78,7 @@ export function ShortcutRenderer(props: Props) {
   const isShortcutsEmpty = groupedCommands.length === 0;
 
   return (
-    <div className="flex flex-col gap-y-3 overflow-y-auto">
+    <div className="flex flex-col gap-y-3">
       {!isShortcutsEmpty ? (
         groupedCommands.map((group) => (
           <div key={group.key}>

apps/web/core/components/profile/activity/profile-activity-list.tsx

@@ -1,194 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-import { useEffect } from "react";
-import { observer } from "mobx-react";
-import Link from "next/link";
-import useSWR from "swr";
-// icons
-import { History, MessageSquare } from "lucide-react";
-import { calculateTimeAgo, getFileURL } from "@plane/utils";
-// hooks
-import { ActivityIcon, ActivityMessage } from "@/components/core/activity";
-import { RichTextEditor } from "@/components/editor/rich-text";
-import { ActivitySettingsLoader } from "@/components/ui/loader/settings/activity";
-// constants
-import { USER_ACTIVITY } from "@/constants/fetch-keys";
-// hooks
-import { useUser } from "@/hooks/store/user";
-// services
-import { UserService } from "@/services/user.service";
-const userService = new UserService();
-
-type Props = {
-  cursor: string;
-  perPage: number;
-  updateResultsCount: (count: number) => void;
-  updateTotalPages: (count: number) => void;
-  updateEmptyState: (state: boolean) => void;
-};
-
-export const ProfileActivityListPage = observer(function ProfileActivityListPage(props: Props) {
-  const { cursor, perPage, updateResultsCount, updateTotalPages, updateEmptyState } = props;
-  // store hooks
-  const { data: currentUser } = useUser();
-
-  const { data: userProfileActivity } = useSWR(
-    USER_ACTIVITY({
-      cursor,
-    }),
-    () =>
-      userService.getUserActivity({
-        cursor,
-        per_page: perPage,
-      })
-  );
-
-  useEffect(() => {
-    if (!userProfileActivity) return;
-
-    // if no results found then show empty state
-    if (userProfileActivity.total_results === 0) updateEmptyState(true);
-
-    updateTotalPages(userProfileActivity.total_pages);
-    updateResultsCount(userProfileActivity.results.length);
-  }, [updateResultsCount, updateTotalPages, userProfileActivity, updateEmptyState]);
-
-  // TODO: refactor this component
-  return (
-    <>
-      {userProfileActivity ? (
-        <ul role="list">
-          {userProfileActivity.results.map((activityItem: any) => {
-            if (activityItem.field === "comment")
-              return (
-                <div key={activityItem.id} className="mt-2">
-                  <div className="relative flex items-start space-x-3">
-                    <div className="relative px-1">
-                      {activityItem.field ? (
-                        activityItem.new_value === "restore" && <History className="h-3.5 w-3.5 text-secondary" />
-                      ) : activityItem.actor_detail.avatar_url && activityItem.actor_detail.avatar_url !== "" ? (
-                        <img
-                          src={getFileURL(activityItem.actor_detail.avatar_url)}
-                          alt={activityItem.actor_detail.display_name}
-                          height={30}
-                          width={30}
-                          className="grid h-7 w-7 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3"
-                        />
-                      ) : (
-                        <div className="grid h-7 w-7 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3 capitalize">
-                          {activityItem.actor_detail.display_name?.[0]}
-                        </div>
-                      )}
-
-                      <span className="flex h-6 w-6 items-center justify-center rounded-full bg-layer-3 p-2 text-secondary">
-                        <MessageSquare className="!text-20 text-secondary" aria-hidden="true" />
-                      </span>
-                    </div>
-                    <div className="min-w-0 flex-1">
-                      <div>
-                        <div className="text-11">
-                          {activityItem.actor_detail.is_bot
-                            ? activityItem.actor_detail.first_name + " Bot"
-                            : activityItem.actor_detail.display_name}
-                        </div>
-                        <p className="mt-0.5 text-11 text-secondary">
-                          Commented {calculateTimeAgo(activityItem.created_at)}
-                        </p>
-                      </div>
-                      <div className="issue-comments-section p-0">
-                        <RichTextEditor
-                          editable={false}
-                          id={activityItem.id}
-                          initialValue={
-                            activityItem?.new_value !== "" ? activityItem.new_value : activityItem.old_value
-                          }
-                          containerClassName="text-11 bg-surface-1"
-                          workspaceId={activityItem?.workspace_detail?.id?.toString() ?? ""}
-                          workspaceSlug={activityItem?.workspace_detail?.slug?.toString() ?? ""}
-                          projectId={activityItem.project ?? ""}
-                        />
-                      </div>
-                    </div>
-                  </div>
-                </div>
-              );
-
-            const message = <ActivityMessage activity={activityItem} showIssue />;
-
-            if ("field" in activityItem && activityItem.field !== "updated_by")
-              return (
-                <li key={activityItem.id}>
-                  <div className="relative pb-1">
-                    <div className="relative flex items-start space-x-2">
-                      <>
-                        <div>
-                          <div className="relative mt-4 px-1.5">
-                            <div className="mt-1.5">
-                              <div className="flex h-6 w-6 items-center justify-center rounded-lg border border-subtle shadow-raised-100">
-                                {activityItem.field ? (
-                                  activityItem.new_value === "restore" ? (
-                                    <History className="h-5 w-5 text-secondary" />
-                                  ) : (
-                                    <ActivityIcon activity={activityItem} />
-                                  )
-                                ) : activityItem.actor_detail.avatar_url &&
-                                  activityItem.actor_detail.avatar_url !== "" ? (
-                                  <img
-                                    src={getFileURL(activityItem.actor_detail.avatar_url)}
-                                    alt={activityItem.actor_detail.display_name}
-                                    height={24}
-                                    width={24}
-                                    className="h-full w-full rounded-full object-cover"
-                                  />
-                                ) : (
-                                  <div className="grid h-6 w-6 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3 text-11 capitalize">
-                                    {activityItem.actor_detail.display_name?.[0]}
-                                  </div>
-                                )}
-                              </div>
-                            </div>
-                          </div>
-                        </div>
-                        <div className="min-w-0 flex-1 border-b border-subtle py-4">
-                          <div className="text-caption-md-regular break-words text-secondary">
-                            {activityItem.field === "archived_at" && activityItem.new_value !== "restore" ? (
-                              <span className="text-gray font-medium">Plane</span>
-                            ) : activityItem.actor_detail.is_bot ? (
-                              <span className="text-gray font-medium">{activityItem.actor_detail.first_name} Bot</span>
-                            ) : (
-                              <Link
-                                href={`/${activityItem.workspace_detail.slug}/profile/${activityItem.actor_detail.id}`}
-                                className="inline"
-                              >
-                                <span className="text-gray font-medium">
-                                  {currentUser?.id === activityItem.actor_detail.id
-                                    ? "You"
-                                    : activityItem.actor_detail.display_name}
-                                </span>
-                              </Link>
-                            )}{" "}
-                            <div className="inline gap-1">
-                              {message}{" "}
-                              <span className="flex-shrink-0 whitespace-nowrap">
-                                {calculateTimeAgo(activityItem.created_at)}
-                              </span>
-                            </div>
-                          </div>
-                        </div>
-                      </>
-                    </div>
-                  </div>
-                </li>
-              );
-          })}
-        </ul>
-      ) : (
-        <ActivitySettingsLoader />
-      )}
-    </>
-  );
-});

apps/web/core/components/profile/overview/priority-distribution.tsx

@@ -54,7 +54,7 @@ export function ProfilePriorityDistribution({ userProfile }: Props) {
               ]}
               xAxis={{
                 key: "name",
-                label: t("profile.stats.priority_distribution.priority"),
+                label: t("common.priority"),
               }}
               yAxis={{
                 key: "count",

apps/web/core/components/project/applied-filters/root.tsx

@@ -98,7 +98,7 @@ export function ProjectAppliedFiltersList(props: Props) {
         {/* Applied display filters */}
         {appliedDisplayFilters.length > 0 && (
           <Tag key="project_display_filters">
-            <span className="text-11 text-tertiary">{t("projects.label", { count: 2 })}</span>
+            <span className="text-11 text-tertiary">{t("common.projects")}</span>
             <AppliedProjectDisplayFilters
               editable={isEditingAllowed}
               values={appliedDisplayFilters}

apps/web/core/components/project/form.tsx

@@ -418,7 +418,7 @@ export function ProjectDetailsForm(props: IProjectDetailsForm) {
                       onChange(value);
                     }}
                     error={Boolean(errors.timezone)}
-                    buttonClassName="border-none"
+                    buttonClassName="!border-subtle !shadow-none font-medium rounded-md"
                     disabled={!isAdmin}
                   />
                 </>

apps/web/core/components/settings/profile/content/pages/activity/activity-list.tsx

@@ -1,194 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-import { useEffect } from "react";
-import { observer } from "mobx-react";
-import Link from "next/link";
-import useSWR from "swr";
-// icons
-import { History, MessageSquare } from "lucide-react";
-import { calculateTimeAgo, getFileURL } from "@plane/utils";
-// hooks
-import { ActivityIcon, ActivityMessage } from "@/components/core/activity";
-import { RichTextEditor } from "@/components/editor/rich-text";
-import { ActivitySettingsLoader } from "@/components/ui/loader/settings/activity";
-// constants
-import { USER_ACTIVITY } from "@/constants/fetch-keys";
-// hooks
-import { useUserProfile } from "@/hooks/store/user/user-user-profile";
-// services
-import { UserService } from "@/services/user.service";
-const userService = new UserService();
-
-type Props = {
-  cursor: string;
-  perPage: number;
-  updateResultsCount: (count: number) => void;
-  updateTotalPages: (count: number) => void;
-  updateEmptyState: (state: boolean) => void;
-};
-
-export const ActivityProfileSettingsList = observer(function ProfileActivityListPage(props: Props) {
-  const { cursor, perPage, updateResultsCount, updateTotalPages, updateEmptyState } = props;
-  // store hooks
-  const { data: currentUser } = useUserProfile();
-
-  const { data: userProfileActivity } = useSWR(
-    USER_ACTIVITY({
-      cursor,
-    }),
-    () =>
-      userService.getUserActivity({
-        cursor,
-        per_page: perPage,
-      })
-  );
-
-  useEffect(() => {
-    if (!userProfileActivity) return;
-
-    // if no results found then show empty state
-    if (userProfileActivity.total_results === 0) updateEmptyState(true);
-
-    updateTotalPages(userProfileActivity.total_pages);
-    updateResultsCount(userProfileActivity.results.length);
-  }, [updateResultsCount, updateTotalPages, userProfileActivity, updateEmptyState]);
-
-  // TODO: refactor this component
-  return (
-    <>
-      {userProfileActivity ? (
-        <ul>
-          {userProfileActivity.results.map((activityItem: any) => {
-            if (activityItem.field === "comment")
-              return (
-                <div key={activityItem.id} className="mt-2">
-                  <div className="relative flex items-start space-x-3">
-                    <div className="relative px-1">
-                      {activityItem.field ? (
-                        activityItem.new_value === "restore" && <History className="h-3.5 w-3.5 text-secondary" />
-                      ) : activityItem.actor_detail.avatar_url && activityItem.actor_detail.avatar_url !== "" ? (
-                        <img
-                          src={getFileURL(activityItem.actor_detail.avatar_url)}
-                          alt={activityItem.actor_detail.display_name}
-                          height={30}
-                          width={30}
-                          className="grid h-7 w-7 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3"
-                        />
-                      ) : (
-                        <div className="grid h-7 w-7 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3 capitalize">
-                          {activityItem.actor_detail.display_name?.[0]}
-                        </div>
-                      )}
-
-                      <span className="flex h-6 w-6 items-center justify-center rounded-full bg-layer-3 p-2 text-secondary">
-                        <MessageSquare className="!text-20 text-secondary" aria-hidden="true" />
-                      </span>
-                    </div>
-                    <div className="min-w-0 flex-1">
-                      <div>
-                        <div className="text-11">
-                          {activityItem.actor_detail.is_bot
-                            ? activityItem.actor_detail.first_name + " Bot"
-                            : activityItem.actor_detail.display_name}
-                        </div>
-                        <p className="mt-0.5 text-11 text-secondary">
-                          Commented {calculateTimeAgo(activityItem.created_at)}
-                        </p>
-                      </div>
-                      <div className="issue-comments-section p-0">
-                        <RichTextEditor
-                          editable={false}
-                          id={activityItem.id}
-                          initialValue={
-                            activityItem?.new_value !== "" ? activityItem.new_value : activityItem.old_value
-                          }
-                          containerClassName="text-11 bg-surface-1"
-                          workspaceId={activityItem?.workspace_detail?.id?.toString() ?? ""}
-                          workspaceSlug={activityItem?.workspace_detail?.slug?.toString() ?? ""}
-                          projectId={activityItem.project ?? ""}
-                        />
-                      </div>
-                    </div>
-                  </div>
-                </div>
-              );
-
-            const message = <ActivityMessage activity={activityItem} showIssue />;
-
-            if ("field" in activityItem && activityItem.field !== "updated_by")
-              return (
-                <li key={activityItem.id}>
-                  <div className="relative pb-1">
-                    <div className="relative flex items-start space-x-2">
-                      <>
-                        <div>
-                          <div className="relative mt-4 px-1.5">
-                            <div className="mt-1.5">
-                              <div className="flex h-6 w-6 items-center justify-center rounded-lg border border-subtle shadow-raised-100">
-                                {activityItem.field ? (
-                                  activityItem.new_value === "restore" ? (
-                                    <History className="h-5 w-5 text-secondary" />
-                                  ) : (
-                                    <ActivityIcon activity={activityItem} />
-                                  )
-                                ) : activityItem.actor_detail.avatar_url &&
-                                  activityItem.actor_detail.avatar_url !== "" ? (
-                                  <img
-                                    src={getFileURL(activityItem.actor_detail.avatar_url)}
-                                    alt={activityItem.actor_detail.display_name}
-                                    height={24}
-                                    width={24}
-                                    className="h-full w-full rounded-full object-cover"
-                                  />
-                                ) : (
-                                  <div className="grid h-6 w-6 place-items-center rounded-full border-2 border-subtle-1 bg-layer-3 text-11 capitalize">
-                                    {activityItem.actor_detail.display_name?.[0]}
-                                  </div>
-                                )}
-                              </div>
-                            </div>
-                          </div>
-                        </div>
-                        <div className="min-w-0 flex-1 border-b border-subtle py-4">
-                          <div className="text-caption-md-regular break-words text-secondary">
-                            {activityItem.field === "archived_at" && activityItem.new_value !== "restore" ? (
-                              <span className="text-gray font-medium">Plane</span>
-                            ) : activityItem.actor_detail.is_bot ? (
-                              <span className="text-gray font-medium">{activityItem.actor_detail.first_name} Bot</span>
-                            ) : (
-                              <Link
-                                href={`/${activityItem.workspace_detail.slug}/profile/${activityItem.actor_detail.id}`}
-                                className="inline"
-                              >
-                                <span className="text-gray font-medium">
-                                  {currentUser?.id === activityItem.actor_detail.id
-                                    ? "You"
-                                    : activityItem.actor_detail.display_name}
-                                </span>
-                              </Link>
-                            )}{" "}
-                            <div className="inline gap-1">
-                              {message}{" "}
-                              <span className="flex-shrink-0 whitespace-nowrap">
-                                {calculateTimeAgo(activityItem.created_at)}
-                              </span>
-                            </div>
-                          </div>
-                        </div>
-                      </>
-                    </div>
-                  </div>
-                </li>
-              );
-          })}
-        </ul>
-      ) : (
-        <ActivitySettingsLoader />
-      )}
-    </>
-  );
-});

apps/web/core/components/settings/profile/content/pages/activity/root.tsx

@@ -1,95 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-import { useState } from "react";
-import { ChevronDown } from "lucide-react";
-import { observer } from "mobx-react";
-import { useTheme } from "next-themes";
-// plane imports
-import { useTranslation } from "@plane/i18n";
-import { Button } from "@plane/propel/button";
-// assets
-import darkActivityAsset from "@/app/assets/empty-state/profile/activity-dark.webp?url";
-import lightActivityAsset from "@/app/assets/empty-state/profile/activity-light.webp?url";
-// components
-import { DetailedEmptyState } from "@/components/empty-state/detailed-empty-state-root";
-import { ProfileSettingsHeading } from "@/components/settings/profile/heading";
-// local imports
-import { ActivityProfileSettingsList } from "./activity-list";
-
-const PER_PAGE = 100;
-
-export const ActivityProfileSettings = observer(function ActivityProfileSettings() {
-  // states
-  const [pageCount, setPageCount] = useState(1);
-  const [totalPages, setTotalPages] = useState(0);
-  const [resultsCount, setResultsCount] = useState(0);
-  const [isEmpty, setIsEmpty] = useState(false);
-  // theme hook
-  const { resolvedTheme } = useTheme();
-  // plane hooks
-  const { t } = useTranslation();
-  // derived values
-  const resolvedPath = resolvedTheme === "light" ? lightActivityAsset : darkActivityAsset;
-
-  const updateTotalPages = (count: number) => setTotalPages(count);
-
-  const updateResultsCount = (count: number) => setResultsCount(count);
-
-  const updateEmptyState = (isEmpty: boolean) => setIsEmpty(isEmpty);
-
-  const handleLoadMore = () => setPageCount((prev) => prev + 1);
-
-  const activityPages: React.ReactNode[] = [];
-  for (let i = 0; i < pageCount; i++)
-    activityPages.push(
-      <ActivityProfileSettingsList
-        key={i}
-        cursor={`${PER_PAGE}:${i}:0`}
-        perPage={PER_PAGE}
-        updateResultsCount={updateResultsCount}
-        updateTotalPages={updateTotalPages}
-        updateEmptyState={updateEmptyState}
-      />
-    );
-
-  const isLoadMoreVisible = pageCount < totalPages && resultsCount !== 0;
-
-  if (isEmpty) {
-    return (
-      <div className="flex size-full flex-col gap-y-7">
-        <ProfileSettingsHeading
-          title={t("account_settings.activity.heading")}
-          description={t("account_settings.activity.description")}
-        />
-        <DetailedEmptyState
-          title={""}
-          description={""}
-          assetPath={resolvedPath}
-          className="mx-auto min-h-fit w-full justify-center p-0!"
-          size="base"
-        />
-      </div>
-    );
-  }
-
-  return (
-    <div className="size-full">
-      <ProfileSettingsHeading
-        title={t("account_settings.activity.heading")}
-        description={t("account_settings.activity.description")}
-      />
-      <div className="mt-7 w-full">{activityPages}</div>
-      {isLoadMoreVisible && (
-        <div className="mt-4 flex w-full items-center justify-center">
-          <Button variant="ghost" onClick={handleLoadMore} appendIcon={<ChevronDown />}>
-            {t("load_more")}
-          </Button>
-        </div>
-      )}
-    </div>
-  );
-});

apps/web/core/components/settings/profile/content/pages/api-tokens.tsx

@@ -38,7 +38,7 @@ export const APITokensProfileSettings = observer(function APITokensProfileSettin
     <div className="size-full">
       <CreateApiTokenModal isOpen={isCreateTokenModalOpen} onClose={() => setIsCreateTokenModalOpen(false)} />
       <ProfileSettingsHeading
-        title={t("account_settings.api_tokens.heading")}
+        title={t("account_settings.api_tokens.title")}
         description={t("account_settings.api_tokens.description")}
         control={
           <Button variant="primary" size="lg" onClick={() => setIsCreateTokenModalOpen(true)}>

apps/web/core/components/settings/profile/content/pages/index.ts

@@ -13,6 +13,5 @@ export const PROFILE_SETTINGS_PAGES_MAP: Record<TProfileSettingsTabs, React.Lazy
   preferences: lazy(() => import("./preferences").then((m) => ({ default: m.PreferencesProfileSettings }))),
   notifications: lazy(() => import("./notifications").then((m) => ({ default: m.NotificationsProfileSettings }))),
   security: lazy(() => import("./security").then((m) => ({ default: m.SecurityProfileSettings }))),
-  activity: lazy(() => import("./activity").then((m) => ({ default: m.ActivityProfileSettings }))),
   "api-tokens": lazy(() => import("./api-tokens").then((m) => ({ default: m.APITokensProfileSettings }))),
 };

apps/web/core/components/settings/profile/content/pages/security.tsx

@@ -99,15 +99,17 @@ export const SecurityProfileSettings = observer(function SecurityProfileSettings
 
       setToast({
         type: TOAST_TYPE.ERROR,
-        title: errorInfo?.title ?? t("auth.common.password.toast.error.title"),
+        title: errorInfo?.title ?? t("auth.common.password.toast.change_password.error.title"),
         message:
-          typeof errorInfo?.message === "string" ? errorInfo.message : t("auth.common.password.toast.error.message"),
+          typeof errorInfo?.message === "string"
+            ? errorInfo.message
+            : t("auth.common.password.toast.change_password.error.message"),
       });
 
       if (code && passwordErrors.includes(code as EAuthenticationErrorCodes)) {
         setError("new_password", {
           type: "manual",
-          message: errorInfo?.message?.toString() || t("auth.common.password.toast.error.message"),
+          message: errorInfo?.message?.toString() || t("auth.common.password.toast.change_password.error.message"),
         });
       }
     }

apps/web/core/components/settings/profile/sidebar/item-categories.tsx

@@ -6,11 +6,15 @@
 
 import type React from "react";
 import type { LucideIcon } from "lucide-react";
-import { Activity, Bell, CircleUser, KeyRound, LockIcon, Settings2 } from "lucide-react";
+import { Bell, CircleUser, KeyRound, LockIcon, Settings2 } from "lucide-react";
 import { observer } from "mobx-react";
 import { useParams } from "react-router";
 // plane imports
-import { GROUPED_PROFILE_SETTINGS, PROFILE_SETTINGS_CATEGORIES } from "@plane/constants";
+import {
+  GROUPED_PROFILE_SETTINGS,
+  PROFILE_SETTINGS_CATEGORIES,
+  PROFILE_SETTINGS_CATEGORY_LABELS,
+} from "@plane/constants";
 import { useTranslation } from "@plane/i18n";
 import type { ISvgIcons } from "@plane/propel/icons";
 import type { TProfileSettingsTabs } from "@plane/types";
@@ -21,7 +25,6 @@ import { ProfileSettingsSidebarWorkspaceOptions } from "./workspace-options";
 const ICONS: Record<TProfileSettingsTabs, LucideIcon | React.FC<ISvgIcons>> = {
   general: CircleUser,
   security: LockIcon,
-  activity: Activity,
   preferences: Settings2,
   notifications: Bell,
   "api-tokens": KeyRound,
@@ -50,7 +53,9 @@ export const ProfileSettingsSidebarItemCategories = observer(function ProfileSet
 
         return (
           <div key={category} className="shrink-0">
-            <div className="p-2 text-caption-md-medium text-tertiary capitalize">{t(category)}</div>
+            <div className="p-2 text-caption-md-medium text-tertiary capitalize">
+              {t(PROFILE_SETTINGS_CATEGORY_LABELS[category])}
+            </div>
             <div className="flex flex-col">
               {categoryItems.map((item) => (
                 <SettingsSidebarItem

apps/web/core/components/settings/profile/sidebar/workspace-options.tsx

@@ -22,7 +22,7 @@ export const ProfileSettingsSidebarWorkspaceOptions = observer(function ProfileS
 
   return (
     <div className="shrink-0">
-      <div className="p-2 text-caption-md-medium text-tertiary capitalize">{t("workspace")}</div>
+      <div className="p-2 text-caption-md-medium text-tertiary capitalize">{t("common.workspace")}</div>
       <div className="flex flex-col">
         {Object.values(workspaces).map((workspace) => (
           <SettingsSidebarItem

apps/web/core/components/settings/project/sidebar/item-categories.tsx

@@ -8,7 +8,12 @@ import { observer } from "mobx-react";
 import { usePathname } from "next/navigation";
 import { useParams } from "react-router";
 // plane imports
-import { EUserPermissionsLevel, GROUPED_PROJECT_SETTINGS, PROJECT_SETTINGS_CATEGORIES } from "@plane/constants";
+import {
+  EUserPermissionsLevel,
+  GROUPED_PROJECT_SETTINGS,
+  PROJECT_SETTINGS_CATEGORIES,
+  PROJECT_SETTINGS_CATEGORY_LABELS,
+} from "@plane/constants";
 import { useTranslation } from "@plane/i18n";
 // components
 import { SettingsSidebarItem } from "@/components/settings/sidebar/item";
@@ -45,7 +50,9 @@ export const ProjectSettingsSidebarItemCategories = observer(function ProjectSet
 
         return (
           <div key={category} className="shrink-0 py-3 first:pt-0 last:pb-0">
-            <div className="p-2 text-caption-md-medium text-tertiary capitalize">{t(category)}</div>
+            <div className="p-2 text-caption-md-medium text-tertiary capitalize">
+              {t(PROJECT_SETTINGS_CATEGORY_LABELS[category])}
+            </div>
             <div className="flex flex-col">
               {accessibleItems.map((item) => {
                 const isItemActive =

apps/web/core/components/settings/workspace/sidebar/item-categories.tsx

@@ -8,7 +8,12 @@ import { observer } from "mobx-react";
 import { usePathname } from "next/navigation";
 import { useParams } from "react-router";
 // plane imports
-import { EUserPermissionsLevel, GROUPED_WORKSPACE_SETTINGS, WORKSPACE_SETTINGS_CATEGORIES } from "@plane/constants";
+import {
+  EUserPermissionsLevel,
+  GROUPED_WORKSPACE_SETTINGS,
+  WORKSPACE_SETTINGS_CATEGORIES,
+  WORKSPACE_SETTINGS_CATEGORY_LABELS,
+} from "@plane/constants";
 import { useTranslation } from "@plane/i18n";
 import { joinUrlPath } from "@plane/utils";
 // components
@@ -39,7 +44,9 @@ export const WorkspaceSettingsSidebarItemCategories = observer(function Workspac
 
         return (
           <div key={category} className="shrink-0 py-3 first:pt-0 last:pb-0">
-            <div className="p-2 text-caption-md-medium text-tertiary capitalize">{t(category)}</div>
+            <div className="p-2 text-caption-md-medium text-tertiary capitalize">
+              {t(WORKSPACE_SETTINGS_CATEGORY_LABELS[category])}
+            </div>
             <div className="flex flex-col">
               {accessibleItems.map((item) => {
                 const isItemActive =

apps/web/core/components/workspace-notifications/sidebar/notification-card/options/snooze/root.tsx

@@ -58,7 +58,7 @@ export const NotificationItemSnoozeOption = observer(function NotificationItemSn
         await unSnoozeNotification(workspaceSlug);
         setToast({
           title: `${t("common.success")}!`,
-          message: t("notification.toasts.un_snoozed"),
+          message: t("notification.toasts.unsnoozed"),
           type: TOAST_TYPE.SUCCESS,
         });
       } catch (e) {

apps/web/core/components/workspace/sidebar/help-section/root.tsx

@@ -6,7 +6,7 @@
 
 import React, { useState } from "react";
 import { observer } from "mobx-react";
-import { HelpCircle, MessagesSquare, User } from "lucide-react";
+import { HelpCircle, User } from "lucide-react";
 import { useTranslation } from "@plane/i18n";
 import { PageIcon } from "@plane/propel/icons";
 // ui
@@ -16,7 +16,6 @@ import { ProductUpdatesModal } from "@/components/global";
 import { AppSidebarItem } from "@/components/sidebar/sidebar-item";
 // hooks
 import { usePowerK } from "@/hooks/store/use-power-k";
-import { useChatSupport } from "@/hooks/use-chat-support";
 // plane web components
 import { PlaneVersionNumber } from "@/plane-web/components/global";
 
@@ -24,7 +23,6 @@ export const HelpMenuRoot = observer(function HelpMenuRoot() {
   // store hooks
   const { t } = useTranslation();
   const { toggleShortcutsListModal } = usePowerK();
-  const { openChatSupport, isEnabled: isChatSupportEnabled } = useChatSupport();
   // states
   const [isNeedHelpOpen, setIsNeedHelpOpen] = useState(false);
   const [isProductUpdatesModalOpen, setProductUpdatesModalOpen] = useState(false);
@@ -56,18 +54,6 @@ export const HelpMenuRoot = observer(function HelpMenuRoot() {
             <span className="text-11">{t("documentation")}</span>
           </div>
         </CustomMenu.MenuItem>
-        {isChatSupportEnabled && (
-          <CustomMenu.MenuItem>
-            <button
-              type="button"
-              onClick={openChatSupport}
-              className="flex w-full items-center gap-x-2 rounded-sm text-11 hover:bg-layer-1"
-            >
-              <MessagesSquare className="h-3.5 w-3.5 text-secondary" />
-              <span className="text-11">{t("message_support")}</span>
-            </button>
-          </CustomMenu.MenuItem>
-        )}
         <CustomMenu.MenuItem onClick={() => window.open("mailto:sales@plane.so", "_blank")}>
           <div className="flex items-center gap-x-2 rounded-sm text-11">
             <User className="h-3.5 w-3.5 text-secondary" size={14} />

apps/web/core/components/workspace/sidebar/sidebar-menu-items.tsx

@@ -114,7 +114,7 @@ export const SidebarMenuItems = observer(function SidebarMenuItems() {
                 : "aria_labels.app_sidebar.open_workspace_menu"
             )}
           >
-            <span className="text-13 font-semibold">{t("workspace")}</span>
+            <span className="text-13 font-semibold">{t("common.workspace")}</span>
           </Disclosure.Button>
           <div className="pointer-events-none flex items-center opacity-0 group-hover:pointer-events-auto group-hover:opacity-100">
             <Disclosure.Button

apps/web/core/components/workspace/sidebar/user-menu-root.tsx

@@ -41,8 +41,8 @@ export const UserMenuRoot = observer(function UserMenuRoot() {
     signOut().catch(() =>
       setToast({
         type: TOAST_TYPE.ERROR,
-        title: t("sign_out.toast.error.title"),
-        message: t("sign_out.toast.error.message"),
+        title: t("auth.sign_out.toast.error.title"),
+        message: t("auth.sign_out.toast.error.message"),
       })
     );
   };

apps/web/core/components/workspace/sidebar/workspace-menu-header.tsx

@@ -52,7 +52,7 @@ export const SidebarWorkspaceMenuHeader = observer(function SidebarWorkspaceMenu
         className="sticky top-0 z-10 flex w-full flex-1 items-center justify-between gap-1 py-1.5 text-13 font-semibold text-placeholder"
         onClick={() => toggleWorkspaceMenu(!isWorkspaceMenuOpen)}
       >
-        <span>{t("workspace")}</span>
+        <span>{t("common.workspace")}</span>
       </Disclosure.Button>
       <CustomMenu
         customButton={

apps/web/core/components/workspace/sidebar/workspace-menu-root.tsx

@@ -55,8 +55,8 @@ export const WorkspaceMenuRoot = observer(function WorkspaceMenuRoot(props: Work
     await signOut().catch(() =>
       setToast({
         type: TOAST_TYPE.ERROR,
-        title: t("sign_out.toast.error.title"),
-        message: t("sign_out.toast.error.message"),
+        title: t("auth.sign_out.toast.error.title"),
+        message: t("auth.sign_out.toast.error.message"),
       })
     );
   };

apps/web/core/custom-events/chat-support.ts

@@ -1,19 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-type ChatSupportType = "open";
-
-type ChatSupportEventType = `chat-support:${ChatSupportType}`;
-
-export const CHAT_SUPPORT_EVENTS = {
-  open: "chat-support:open",
-} satisfies Record<ChatSupportType, ChatSupportEventType>;
-
-export class ChatSupportEvent extends CustomEvent<ChatSupportType> {
-  constructor(type: ChatSupportType) {
-    super(CHAT_SUPPORT_EVENTS[type]);
-  }
-}

apps/web/core/hooks/use-chat-support.ts

@@ -1,31 +0,0 @@
-/**
- * Copyright (c) 2023-present Plane Software, Inc. and contributors
- * SPDX-License-Identifier: AGPL-3.0-only
- * See the LICENSE file for details.
- */
-
-import { useCallback } from "react";
-// custom events
-import { ChatSupportEvent } from "@/custom-events/chat-support";
-// hooks
-import { useInstance } from "@/hooks/store/use-instance";
-import { useUser } from "@/hooks/store/user";
-
-export interface IUseChatSupport {
-  openChatSupport: () => void;
-  isEnabled: boolean;
-}
-
-export const useChatSupport = (): IUseChatSupport => {
-  const { data: user } = useUser();
-  const { config } = useInstance();
-  // derived values
-  const isEnabled = Boolean(user && config?.is_intercom_enabled && config?.intercom_app_id);
-
-  const openChatSupport = useCallback(() => {
-    if (!isEnabled) return;
-    window.dispatchEvent(new ChatSupportEvent("open"));
-  }, [isEnabled]);
-
-  return { openChatSupport, isEnabled };
-};

apps/web/core/lib/wrappers/store-wrapper.tsx

@@ -9,8 +9,6 @@ import { useEffect, useRef } from "react";
 import { observer } from "mobx-react";
 import { useParams } from "next/navigation";
 import { useTheme } from "next-themes";
-import type { TLanguage } from "@plane/i18n";
-import { useTranslation } from "@plane/i18n";
 // helpers
 import { applyCustomTheme, clearCustomTheme } from "@plane/utils";
 // hooks
@@ -32,8 +30,6 @@ function StoreWrapper(props: TStoreWrapper) {
   const { setQuery } = useRouterParams();
   const { sidebarCollapsed, toggleSidebar } = useAppTheme();
   const { data: userProfile } = useUserProfile();
-  const { changeLanguage } = useTranslation();
-
   // Track if we've initialized theme from server (one-time only)
   const hasInitializedThemeRef = useRef(false);
   // Track current user to reset on logout/login
@@ -107,11 +103,6 @@ function StoreWrapper(props: TStoreWrapper) {
     previousThemeRef.current = currentTheme;
   }, [userProfile?.theme]);
 
-  useEffect(() => {
-    if (!userProfile?.language) return;
-    changeLanguage(userProfile?.language as TLanguage);
-  }, [userProfile?.language, changeLanguage]);
-
   useEffect(() => {
     if (!params) return;
     setQuery(params);

apps/web/core/services/user.service.ts

@@ -145,14 +145,6 @@ export class UserService extends APIService {
       });
   }
 
-  async getUserActivity(params: { per_page: number; cursor?: string }): Promise<IUserActivityResponse> {
-    return this.get("/api/users/me/activities/", { params })
-      .then((response) => response?.data)
-      .catch((error) => {
-        throw error?.response?.data;
-      });
-  }
-
   async changePassword(token: string, data: { old_password?: string; new_password: string }): Promise<any> {
     return this.post(`/auth/change-password/`, data, {
       headers: {

apps/web/core/store/root.store.ts

@@ -6,7 +6,7 @@
 
 import { enableStaticRendering } from "mobx-react";
 // plane imports
-import { FALLBACK_LANGUAGE, LANGUAGE_STORAGE_KEY } from "@plane/i18n";
+import { FALLBACK_LANGUAGE, setLanguage } from "@plane/i18n";
 import type { IWorkItemFilterStore } from "@plane/shared-state";
 import { WorkItemFilterStore } from "@plane/shared-state";
 // plane web store
@@ -137,7 +137,7 @@ export class CoreRootStore {
   resetOnSignOut() {
     // handling the system theme when user logged out from the app
     localStorage.setItem("theme", "system");
-    localStorage.setItem(LANGUAGE_STORAGE_KEY, FALLBACK_LANGUAGE);
+    void setLanguage(FALLBACK_LANGUAGE);
     this.router = new RouterStore();
     this.commandPalette = new CommandPaletteStore();
     this.instance = new InstanceStore();

apps/web/core/store/user/profile.store.ts

@@ -6,6 +6,9 @@
 
 import { cloneDeep, set } from "lodash-es";
 import { action, makeObservable, observable, runInAction } from "mobx";
+// plane imports
+import { setLanguage } from "@plane/i18n";
+import type { TLanguage } from "@plane/i18n";
 // types
 import type { IUserTheme, TUserProfile } from "@plane/types";
 import { EStartOfTheWeek } from "@plane/types";
@@ -108,6 +111,9 @@ export class ProfileStore implements IUserProfileStore {
         this.isLoading = false;
         this.data = userProfile;
       });
+      if (userProfile.language) {
+        void setLanguage(userProfile.language as TLanguage);
+      }
       return userProfile;
     } catch (error) {
       runInAction(() => {
@@ -132,6 +138,9 @@ export class ProfileStore implements IUserProfileStore {
       if (currentUserProfileData) {
         this.mutateUserProfile(data);
       }
+      if (data.language) {
+        void setLanguage(data.language as TLanguage);
+      }
       const userProfile = await this.userService.updateCurrentUserProfile(data);
       return userProfile;
     } catch {

apps/web/nginx/nginx.conf

@@ -11,7 +11,7 @@ http {
 
   set_real_ip_from        0.0.0.0/0;
   real_ip_recursive       on;
-  real_ip_header          X-Forward-For;
+  real_ip_header          X-Forwarded-For;
   limit_req_zone          $binary_remote_addr zone=mylimit:10m rate=10r/s;
 
   access_log /dev/stdout;

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "web",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "license": "AGPL-3.0",
   "type": "module",

deployments/aio/community/Dockerfile

@@ -59,7 +59,7 @@ RUN mkdir -p /app/logs/access && \
     mkdir -p /app/data && \
     chmod +x /app/start.sh
 
-VOLUME ['/app/data', '/app/logs']
+VOLUME ["/app/data", "/app/logs"]
 
 EXPOSE 80 443
 

deployments/aio/community/variables.env

@@ -51,3 +51,12 @@ API_KEY_RATE_LIMIT=60/minute
 
 # Live Server Secret Key
 LIVE_SERVER_SECRET_KEY=htbqvBJAgpm9bzvf3r4urJer0ENReatceh
+
+# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
+# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
+WEBHOOK_ALLOWED_IPS=
+
+# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
+# SSRF check. Useful for trusted internal services whose container/service IPs are
+# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
+WEBHOOK_ALLOWED_HOSTS=

deployments/cli/community/docker-compose.yml

@@ -58,6 +58,8 @@ x-app-env: &app-env
   API_KEY_RATE_LIMIT: ${API_KEY_RATE_LIMIT:-60/minute}
   MINIO_ENDPOINT_SSL: ${MINIO_ENDPOINT_SSL:-0}
   LIVE_SERVER_SECRET_KEY: ${LIVE_SERVER_SECRET_KEY:-2FiJk1U2aiVPEQtzLehYGlTSnTnrs7LW}
+  WEBHOOK_ALLOWED_IPS: ${WEBHOOK_ALLOWED_IPS:-}
+  WEBHOOK_ALLOWED_HOSTS: ${WEBHOOK_ALLOWED_HOSTS:-}
 
 services:
   web:

deployments/cli/community/variables.env

@@ -80,3 +80,12 @@ API_KEY_RATE_LIMIT=60/minute
 # Live server environment variables
 # WARNING: You must set a secure value for LIVE_SERVER_SECRET_KEY in production environments.
 LIVE_SERVER_SECRET_KEY=
+
+# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
+# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
+WEBHOOK_ALLOWED_IPS=
+
+# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
+# SSRF check. Useful for trusted internal services whose container/service IPs are
+# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
+WEBHOOK_ALLOWED_HOSTS=

package.json

@@ -1,6 +1,6 @@
 {
   "name": "plane",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "private": true,
   "description": "Open-source project management that unlocks customer value",
   "license": "AGPL-3.0",
@@ -44,15 +44,12 @@
       "mdast-util-to-hast": "13.2.1",
       "valibot": "1.2.0",
       "glob": "11.1.0",
-      "js-yaml": "4.1.1",
       "brace-expansion": "5.0.5",
       "nanoid": "3.3.8",
       "esbuild": "0.25.0",
       "@babel/helpers": "7.26.10",
       "@babel/runtime": "7.26.10",
       "chokidar": "3.6.0",
-      "happy-dom": "20.0.2",
-      "tar-fs": "3.0.9",
       "prosemirror-view": "1.40.0",
       "@types/express": "4.17.23",
       "typescript": "catalog:",
@@ -61,8 +58,7 @@
       "diff": "5.2.2",
       "webpack": "5.104.1",
       "lodash-es": "catalog:",
-      "@isaacs/brace-expansion": "5.0.1",
-      "lodash": "4.17.23",
+      "lodash": "4.18.1",
       "markdown-it": "14.1.1",
       "rollup": "4.59.0",
       "minimatch@3": "3.1.4",
@@ -76,7 +72,11 @@
       "yaml@1": "1.10.3",
       "yaml@2": "2.8.3",
       "path-to-regexp": "0.1.13",
-      "defu": "6.1.5"
+      "defu": "6.1.5",
+      "postcss": "8.5.10",
+      "axios": "catalog:",
+      "follow-redirects": "1.16.0",
+      "uuid": "catalog:"
     },
     "onlyBuiltDependencies": [
       "@parcel/watcher",