v2.2.1

PLANKA Community 2.2.1 — Security release

This is an emergency release fixing a security vulnerability. We recommend
updating as soon as possible.

Security

• Fixed a path traversal vulnerability (CWE-22) in the JWT-protected static
  file routes (/user-avatars, /background-images, /favicons). On instances
  using local file storage, an authenticated user could read arbitrary files
  readable by the PLANKA process. Fixed by enforcing that resolved paths stay
  within the uploads root. S3-backed storage was not affected.

  Reported responsibly by Alpastx — thank you.

  Details: [GHSA link]

Full Changelog: v2.2.0...v2.2.1

v2.2.0

PLANKA Community 2.2.0

⚠️ Breaking changes — read before updating

1. OIDC/SSO has been removed from PLANKA Community.

• After updating, all SSO-based users are deactivated, because they no longer
  have a password login.
• An admin can restore access by setting a password for each affected user and
  reactivating them.
• If your only admin account is SSO-based, you will be locked out. Create a
  new admin user first (via script or environment variables) before updating:
  https://docs.planka.cloud/docs/configuration/admin-user
• If SSO is critical for your team, plan this migration before you update.
• Background and reasoning: #1754 · OIDC/SSO is now part of PLANKA Pro:
  https://planka.app/pro

2. Node.js 24 is now required for source/manual installations. Docker users
are unaffected. Update your Node.js runtime before upgrading.

Added

• Two-factor authentication (TOTP) for local accounts — set up with an
  authenticator app, ten one-time recovery codes, and admin reset.
• Auto-logout on inactivity — configurable timeout with a warning before
  sign-out; activity in any tab keeps you signed in.
• Trusted devices — optionally trust a browser to skip 2FA for a set period;
  trusted browsers can be listed and revoked individually.

Changed

• User editing in administration is now a single unified modal (profile,
  credentials and API key in one dialog).
• Dependencies updated; CI aligned with Node 24.

Removed

• OIDC/SSO (moved to PLANKA Pro).
• armv7 Docker image builds.

Full Changelog: 2.1.1...v2.2.0

planka-2.2.0

A Helm chart to deploy PLANKA and it's dependencies.

v2.1.1

What's Changed

• feat: Add Pro features discovery banner by @daniel-hiller
• refactor(docker): Remove global npm installation from Dockerfiles by @daniel-hiller
• fix(s3): Add requestChecksumCalculation config option by @meltyshev
• fix(proxy): Limit Squid file descriptors to prevent excessive memory allocation by @meltyshev
• build(client): Allow specifying proxy target by @meltyshev
• Update de-DE Translation by @SeDi343 in #1597
• Update German Language by @SeDi343 in #1602
• PLANKA: Add User Avatar Change for Admins by @SeDi343 in #1604
• build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /client by @dependabot[bot] in #1595
• build(deps-dev): Bump flatted from 3.4.1 to 3.4.2 in /server by @dependabot[bot] in #1603
• build(deps): Bump svgo from 3.3.2 to 3.3.3 in /client by @dependabot[bot] in #1564
• build(deps): Bump immutable from 5.1.4 to 5.1.5 in /client by @dependabot[bot] in #1563
• build(deps): Bump rollup from 4.57.1 to 4.59.0 in /client by @dependabot[bot] in #1559
• build(deps): Bump fast-xml-parser and @aws-sdk/xml-builder in /server by @dependabot[bot] in #1632
• build(deps): Bump nodemailer from 7.0.13 to 8.0.5 in /server by @dependabot[bot] in #1631
• build(deps-dev): Bump picomatch from 2.3.1 to 2.3.2 in /client by @dependabot[bot] in #1607
• build(deps): Bump picomatch from 2.3.1 to 2.3.2 in /server by @dependabot[bot] in #1608
• build(deps): Bump lodash from 4.17.23 to 4.18.1 in /server by @dependabot[bot] in #1629
• build(deps): Bump lodash from 4.17.23 to 4.18.1 in /client by @dependabot[bot] in #1630
• build(deps): Bump lodash-es from 4.17.23 to 4.18.1 in /client by @dependabot[bot] in #1624
• build(deps): Bump brace-expansion from 2.0.2 to 2.0.3 by @dependabot[bot] in #1628
• build(deps): Bump brace-expansion from 1.1.12 to 1.1.13 in /server by @dependabot[bot] in #1617
• build(deps): Bump vite from 7.3.1 to 7.3.2 in /client by @dependabot[bot] in #1627
• build(deps): Bump yaml from 2.8.2 to 2.8.3 in /server by @dependabot[bot] in #1610
• build(deps): Bump yaml from 2.8.2 to 2.8.3 in /client by @dependabot[bot] in #1611
• build(deps): Bump yaml from 2.8.2 to 2.8.3 by @dependabot[bot] in #1612
• build(deps): Bump bn.js in /client by @dependabot[bot] in #1551
• fix: unicode/emoji characters in user avatar initials by @HannesOberreiter in #1635
• build(deps): Bump path-to-regexp and @sailshq/router in /server by @dependabot[bot] in #1637
• build(deps): Bump underscore and @sailshq/nedb in /server by @dependabot[bot] in #1638

New Contributors

• @SeDi343 made their first contribution in #1597

Full Changelog: v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: Add ability to expose Swagger specification (#1577)
• feat: Support running under subpath (#1451)
• feat(helm): Add inline custom terms configuration, fix symlink detection (#1585)
• feat: Add ability to display card ages
• fix(oidc): Add configurable HTTP timeout for OIDC client (#1575)
• docs: Remove accidental dollar sign from Swagger route definitions

New Contributors

• @Br1an67 made their first contribution in #1575
• @roberfi made their first contribution in #1451

Full Changelog: v2.0.3...v2.1.0

planka-2.1.0

A Helm chart to deploy PLANKA and it's dependencies.

v2.0.3

Security Release

• Fixed an issue where the outgoing proxy could be accessed from outside the server in host-network Docker deployments (network_mode: host), potentially allowing external parties to relay requests.
• The proxy now only accepts connections from the local server, preventing accidental exposure while keeping internal functionality intact.
• Users should update to PLANKA >= 2.0.3 to be protected.
• More details and credits: Security Advisory
• Reported by Luke via responsible disclosure.

What's Changed

• fix(proxy): Prevent external access to outgoing proxy in host-network mode

Full Changelog: v2.0.2...v2.0.3

planka-2.0.3

A Helm chart to deploy PLANKA and it's dependencies.

v2.0.2

What's Changed

• fix(backup): Improve backup/restore scripts, allow specifying backup directory (#1541)
• fix(dropzone): Prevent dropzone from overflowing content
• fix(platform): Make app compatible with Windows
• fix(helm): Add writable temp directory mounts when readOnlyRootFilesystem is enabled (#1542)
• fix(gravatar): Update hash algorithm to SHA-256 for improved security (#1550)

New Contributors

• @seals187 made their first contribution in #1541
• @SnoozeFreddo made their first contribution in #1542

Full Changelog: v2.0.1...v2.0.2

planka-2.0.2

A Helm chart to deploy PLANKA and it's dependencies.