chore: add reload logic

apps/admin/app/(all)/(dashboard)/layout.tsx

@@ -11,7 +11,7 @@ import { Outlet } from "react-router";
 // components
 import { AdminHeader } from "@/components/common/header";
 import { LogoSpinner } from "@/components/common/logo-spinner";
-import { NewUserPopup } from "@/components/common/new-user-popup";
+import { NewUserPopup } from "@/components/new-user-popup";
 // hooks
 import { useUser } from "@/hooks/store";
 // local components

apps/admin/app/(all)/(home)/sign-in-form.tsx

@@ -16,7 +16,7 @@ import { Input, Spinner } from "@plane/ui";
 // components
 import { Banner } from "@/components/common/banner";
 // local components
-import { FormHeader } from "@/components/instance/form-header";
+import { FormHeader } from "../../../core/components/instance/form-header";
 import { AuthBanner } from "./auth-banner";
 import { AuthHeader } from "./auth-header";
 import { authErrorHandler } from "./auth-helpers";

apps/admin/ce/store/root.store.ts

@@ -0,0 +1,25 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+import { enableStaticRendering } from "mobx-react";
+// stores
+import { CoreRootStore } from "@/store/root.store";
+
+enableStaticRendering(typeof window === "undefined");
+
+export class RootStore extends CoreRootStore {
+  constructor() {
+    super();
+  }
+
+  hydrate(initialData: any) {
+    super.hydrate(initialData);
+  }
+
+  resetOnSignOut() {
+    super.resetOnSignOut();
+  }
+}

apps/admin/core/components/common/header/index.tsx

@@ -10,7 +10,7 @@ import { Menu, Settings } from "lucide-react";
 // icons
 import { Breadcrumbs } from "@plane/ui";
 // components
-import { BreadcrumbLink } from "../breadcrumb-link";
+import { BreadcrumbLink } from "@/components/common/breadcrumb-link";
 // hooks
 import { useTheme } from "@/hooks/store";
 // local imports

apps/admin/core/components/instance/setup-form.tsx

@@ -16,8 +16,8 @@ import { Checkbox, Input, PasswordStrengthIndicator, Spinner } from "@plane/ui";
 import { getPasswordStrength } from "@plane/utils";
 // components
 import { AuthHeader } from "@/app/(all)/(home)/auth-header";
-import { Banner } from "../common/banner";
-import { FormHeader } from "./form-header";
+import { Banner } from "@/components/common/banner";
+import { FormHeader } from "@/components/instance/form-header";
 
 // service initialization
 const authService = new AuthService();

apps/admin/core/providers/store.provider.tsx

@@ -6,7 +6,7 @@
 
 import { createContext } from "react";
 // plane admin store
-import { RootStore } from "../store/root.store";
+import { RootStore } from "@/plane-admin/store/root.store";
 
 let rootStore = new RootStore();
 

apps/admin/core/store/instance.store.ts

@@ -19,7 +19,7 @@ import type {
   IInstanceConfig,
 } from "@plane/types";
 // root store
-import type { RootStore } from "@/store/root.store";
+import type { CoreRootStore } from "@/store/root.store";
 
 export interface IInstanceStore {
   // issues
@@ -53,7 +53,7 @@ export class InstanceStore implements IInstanceStore {
   // service
   instanceService;
 
-  constructor(private store: RootStore) {
+  constructor(private store: CoreRootStore) {
     makeObservable(this, {
       // observable
       isLoading: observable.ref,

apps/admin/core/store/root.store.ts

@@ -17,7 +17,7 @@ import { WorkspaceStore } from "./workspace.store";
 
 enableStaticRendering(typeof window === "undefined");
 
-export class RootStore {
+export abstract class CoreRootStore {
   theme: IThemeStore;
   instance: IInstanceStore;
   user: IUserStore;

apps/admin/core/store/theme.store.ts

@@ -6,7 +6,7 @@
 
 import { action, observable, makeObservable } from "mobx";
 // root store
-import type { RootStore } from "./root.store";
+import type { CoreRootStore } from "@/store/root.store";
 
 type TTheme = "dark" | "light";
 export interface IThemeStore {
@@ -27,7 +27,7 @@ export class ThemeStore implements IThemeStore {
   isSidebarCollapsed: boolean | undefined = undefined;
   theme: string | undefined = undefined;
 
-  constructor(private store: RootStore) {
+  constructor(private store: CoreRootStore) {
     makeObservable(this, {
       // observables
       isNewUserPopup: observable.ref,

apps/admin/core/store/user.store.ts

@@ -11,7 +11,7 @@ import { EUserStatus } from "@plane/constants";
 import { AuthService, UserService } from "@plane/services";
 import type { IUser } from "@plane/types";
 // root store
-import type { RootStore } from "@/store/root.store";
+import type { CoreRootStore } from "@/store/root.store";
 
 export interface IUserStore {
   // observables
@@ -36,7 +36,7 @@ export class UserStore implements IUserStore {
   userService;
   authService;
 
-  constructor(private store: RootStore) {
+  constructor(private store: CoreRootStore) {
     makeObservable(this, {
       // observables
       isLoading: observable.ref,

apps/admin/core/store/workspace.store.ts

@@ -10,7 +10,7 @@ import { action, observable, runInAction, makeObservable, computed } from "mobx"
 import { InstanceWorkspaceService } from "@plane/services";
 import type { IWorkspace, TLoader, TPaginationInfo } from "@plane/types";
 // root store
-import type { RootStore } from "@/store/root.store";
+import type { CoreRootStore } from "@/store/root.store";
 
 export interface IWorkspaceStore {
   // observables
@@ -37,7 +37,7 @@ export class WorkspaceStore implements IWorkspaceStore {
   // services
   instanceWorkspaceService;
 
-  constructor(private store: RootStore) {
+  constructor(private store: CoreRootStore) {
     makeObservable(this, {
       // observables
       loader: observable,

apps/admin/ee/store/root.store.ts

@@ -0,0 +1,7 @@
+/**
+ * Copyright (c) 2023-present Plane Software, Inc. and contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ * See the LICENSE file for details.
+ */
+
+export * from "ce/store/root.store";

apps/admin/tsconfig.json

@@ -9,7 +9,12 @@
     "types": ["vite/client"],
     "paths": {
       "package.json": ["./package.json"],
-      "@/*": ["./*"]
+      "ce/*": ["./ce/*"],
+      "@/app/*": ["./app/*"],
+      "@/*": ["./core/*"],
+      "@/plane-admin/*": ["./ce/*"],
+      "@/ce/*": ["./ce/*"],
+      "@/styles/*": ["./styles/*"]
     }
   },
   "include": ["**/*", "**/.server/**/*", "**/.client/**/*", ".react-router/types/**/*"],

apps/api/plane/app/serializers/api.py

@@ -19,9 +19,6 @@ class APITokenSerializer(BaseSerializer):
             "updated_at",
             "workspace",
             "user",
-            "is_active",
-            "last_used",
-            "user_type",
         ]
 
 

apps/api/plane/app/views/project/base.py

@@ -50,10 +50,11 @@ class ProjectViewSet(BaseViewSet):
     use_read_replica = True
 
     def get_queryset(self):
-        sort_order = ProjectUserProperty.objects.filter(
-            user=self.request.user,
+        sort_order = ProjectMember.objects.filter(
+            member=self.request.user,
             project_id=OuterRef("pk"),
             workspace__slug=self.kwargs.get("slug"),
+            is_active=True,
         ).values("sort_order")
         return self.filter_queryset(
             super()
@@ -139,10 +140,11 @@ class ProjectViewSet(BaseViewSet):
 
     @allow_permission(allowed_roles=[ROLE.ADMIN, ROLE.MEMBER, ROLE.GUEST], level="WORKSPACE")
     def list(self, request, slug):
-        sort_order = ProjectUserProperty.objects.filter(
-            user=self.request.user,
+        sort_order = ProjectMember.objects.filter(
+            member=self.request.user,
             project_id=OuterRef("pk"),
             workspace__slug=self.kwargs.get("slug"),
+            is_active=True,
         ).values("sort_order")
 
         projects = (

apps/api/plane/app/views/workspace/base.py

@@ -49,7 +49,6 @@ from plane.bgtasks.workspace_seed_task import workspace_seed
 from plane.bgtasks.event_tracking_task import track_event
 from plane.utils.url import contains_url
 from plane.utils.analytics_events import WORKSPACE_CREATED, WORKSPACE_DELETED
-from plane.utils.csv_utils import sanitize_csv_row
 
 
 class WorkSpaceViewSet(BaseViewSet):
@@ -82,14 +81,12 @@ class WorkSpaceViewSet(BaseViewSet):
 
     def create(self, request):
         try:
-            (DISABLE_WORKSPACE_CREATION,) = get_configuration_value(
-                [
-                    {
-                        "key": "DISABLE_WORKSPACE_CREATION",
-                        "default": os.environ.get("DISABLE_WORKSPACE_CREATION", "0"),
-                    }
-                ]
-            )
+            (DISABLE_WORKSPACE_CREATION,) = get_configuration_value([
+                {
+                    "key": "DISABLE_WORKSPACE_CREATION",
+                    "default": os.environ.get("DISABLE_WORKSPACE_CREATION", "0"),
+                }
+            ])
 
             if DISABLE_WORKSPACE_CREATION == "1":
                 return Response(
@@ -372,7 +369,7 @@ class ExportWorkspaceUserActivityEndpoint(BaseAPIView):
         """Generate CSV buffer from rows."""
         csv_buffer = io.StringIO()
         writer = csv.writer(csv_buffer, delimiter=",", quoting=csv.QUOTE_ALL)
-        [writer.writerow(sanitize_csv_row(row)) for row in rows]
+        [writer.writerow(row) for row in rows]
         csv_buffer.seek(0)
         return csv_buffer
 

apps/api/plane/app/views/workspace/module.py

@@ -46,7 +46,7 @@ class WorkspaceModulesEndpoint(BaseAPIView):
             )
             .annotate(
                 completed_issues=Count(
-                    "issue_module",
+                    "issue_module__issue__state__group",
                     filter=Q(
                         issue_module__issue__state__group="completed",
                         issue_module__issue__archived_at__isnull=True,
@@ -58,7 +58,7 @@ class WorkspaceModulesEndpoint(BaseAPIView):
             )
             .annotate(
                 cancelled_issues=Count(
-                    "issue_module",
+                    "issue_module__issue__state__group",
                     filter=Q(
                         issue_module__issue__state__group="cancelled",
                         issue_module__issue__archived_at__isnull=True,
@@ -70,7 +70,7 @@ class WorkspaceModulesEndpoint(BaseAPIView):
             )
             .annotate(
                 started_issues=Count(
-                    "issue_module",
+                    "issue_module__issue__state__group",
                     filter=Q(
                         issue_module__issue__state__group="started",
                         issue_module__issue__archived_at__isnull=True,
@@ -82,7 +82,7 @@ class WorkspaceModulesEndpoint(BaseAPIView):
             )
             .annotate(
                 unstarted_issues=Count(
-                    "issue_module",
+                    "issue_module__issue__state__group",
                     filter=Q(
                         issue_module__issue__state__group="unstarted",
                         issue_module__issue__archived_at__isnull=True,
@@ -94,7 +94,7 @@ class WorkspaceModulesEndpoint(BaseAPIView):
             )
             .annotate(
                 backlog_issues=Count(
-                    "issue_module",
+                    "issue_module__issue__state__group",
                     filter=Q(
                         issue_module__issue__state__group="backlog",
                         issue_module__issue__archived_at__isnull=True,

apps/api/plane/bgtasks/analytic_plot_export.py

@@ -24,7 +24,6 @@ from plane.license.utils.instance_value import get_email_configuration
 from plane.utils.analytics_plot import build_graph_plot
 from plane.utils.exception_logger import log_exception
 from plane.utils.issue_filters import issue_filters
-from plane.utils.csv_utils import sanitize_csv_row
 
 row_mapping = {
     "state__name": "State",
@@ -181,7 +180,7 @@ def generate_csv_from_rows(rows):
     """Generate CSV buffer from rows."""
     csv_buffer = io.StringIO()
     writer = csv.writer(csv_buffer, delimiter=",", quoting=csv.QUOTE_ALL)
-    [writer.writerow(sanitize_csv_row(row)) for row in rows]
+    [writer.writerow(row) for row in rows]
     return csv_buffer
 
 

apps/api/plane/bgtasks/work_item_link_task.py

@@ -4,7 +4,6 @@
 
 # Python imports
 import logging
-import socket
 
 # Third party imports
 from celery import shared_task
@@ -27,7 +26,7 @@ DEFAULT_FAVICON = "PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoP
 def validate_url_ip(url: str) -> None:
     """
     Validate that a URL doesn't point to a private/internal IP address.
-    Resolves hostnames to IPs before checking.
+    Only checks if the hostname is a direct IP address.
 
     Args:
         url: The URL to validate
@@ -39,31 +38,17 @@ def validate_url_ip(url: str) -> None:
     hostname = parsed.hostname
 
     if not hostname:
-        raise ValueError("Invalid URL: No hostname found")
-
-    # Only allow HTTP and HTTPS to prevent file://, gopher://, etc.
-    if parsed.scheme not in ("http", "https"):
-        raise ValueError("Invalid URL scheme. Only HTTP and HTTPS are allowed")
-
-    # Resolve hostname to IP addresses — this catches domain names that
-    # point to internal IPs (e.g. attacker.com -> 169.254.169.254)
+        return
 
     try:
-        addr_info = socket.getaddrinfo(hostname, None)
-    except socket.gaierror:
-        raise ValueError("Hostname could not be resolved")
+        ip = ipaddress.ip_address(hostname)
+    except ValueError:
+        # Not an IP address (it's a domain name), nothing to check here
+        return
 
-    if not addr_info:
-        raise ValueError("No IP addresses found for the hostname")
-
-    # Check every resolved IP against blocked ranges to prevent SSRF
-    for addr in addr_info:
-        ip = ipaddress.ip_address(addr[4][0])
-        if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local:
-            raise ValueError("Access to private/internal networks is not allowed")
-
-
-MAX_REDIRECTS = 5
+    # It IS an IP address - check if it's private/internal
+    if ip.is_private or ip.is_loopback or ip.is_reserved:
+        raise ValueError("Access to private/internal networks is not allowed")
 
 
 def crawl_work_item_link_title_and_favicon(url: str) -> Dict[str, Any]:
@@ -89,23 +74,11 @@ def crawl_work_item_link_title_and_favicon(url: str) -> Dict[str, Any]:
         validate_url_ip(final_url)
 
         try:
-            # Manually follow redirects to validate each URL before requesting
-            redirect_count = 0
-            response = requests.get(final_url, headers=headers, timeout=1, allow_redirects=False)
+            response = requests.get(final_url, headers=headers, timeout=1)
+            final_url = response.url  # Get the final URL after any redirects
 
-            while response.is_redirect and redirect_count < MAX_REDIRECTS:
-                redirect_url = response.headers.get("Location")
-                if not redirect_url:
-                    break
-                # Resolve relative redirects against current URL
-                final_url = urljoin(final_url, redirect_url)
-                # Validate the redirect target BEFORE making the request
-                validate_url_ip(final_url)
-                redirect_count += 1
-                response = requests.get(final_url, headers=headers, timeout=1, allow_redirects=False)
-
-            if redirect_count >= MAX_REDIRECTS:
-                logger.warning(f"Too many redirects for URL: {url}")
+            # check for redirected url also
+            validate_url_ip(final_url)
 
             soup = BeautifulSoup(response.content, "html.parser")
             title_tag = soup.find("title")
@@ -161,9 +134,7 @@ def find_favicon_url(soup: Optional[BeautifulSoup], base_url: str) -> Optional[s
         for selector in favicon_selectors:
             favicon_tag = soup.select_one(selector)
             if favicon_tag and favicon_tag.get("href"):
-                favicon_href = urljoin(base_url, favicon_tag["href"])
-                validate_url_ip(favicon_href)
-                return favicon_href
+                return urljoin(base_url, favicon_tag["href"])
 
     # Fallback to /favicon.ico
     parsed_url = urlparse(base_url)
@@ -171,9 +142,7 @@ def find_favicon_url(soup: Optional[BeautifulSoup], base_url: str) -> Optional[s
 
     # Check if fallback exists
     try:
-        validate_url_ip(fallback_url)
-        response = requests.head(fallback_url, timeout=2, allow_redirects=False)
-
+        response = requests.head(fallback_url, timeout=2)
         if response.status_code == 200:
             return fallback_url
     except requests.RequestException as e:
@@ -204,8 +173,6 @@ def fetch_and_encode_favicon(
                 "favicon_base64": f"data:image/svg+xml;base64,{DEFAULT_FAVICON}",
             }
 
-        validate_url_ip(favicon_url)
-
         response = requests.get(favicon_url, headers=headers, timeout=1)
 
         # Get content type

apps/api/plane/db/migrations/0119_alter_estimatepoint_key.py

@@ -1,19 +0,0 @@
-# Generated by Django 4.2.27 on 2026-02-09 09:37
-
-import django.core.validators
-from django.db import migrations, models
-
-
-class Migration(migrations.Migration):
-
-    dependencies = [
-        ('db', '0118_remove_workspaceuserproperties_product_tour_and_more'),
-    ]
-
-    operations = [
-        migrations.AlterField(
-            model_name='estimatepoint',
-            name='key',
-            field=models.IntegerField(default=0, validators=[django.core.validators.MinValueValidator(0)]),
-        ),
-    ]

apps/api/plane/db/models/estimate.py

@@ -38,7 +38,7 @@ class Estimate(ProjectBaseModel):
 
 class EstimatePoint(ProjectBaseModel):
     estimate = models.ForeignKey("db.Estimate", on_delete=models.CASCADE, related_name="points")
-    key = models.IntegerField(default=0, validators=[MinValueValidator(0)])
+    key = models.IntegerField(default=0, validators=[MinValueValidator(0), MaxValueValidator(12)])
     description = models.TextField(blank=True)
     value = models.CharField(max_length=255)
 

apps/api/plane/tests/contract/app/test_api_token.py

@@ -142,7 +142,7 @@ class TestApiTokenEndpoint:
         """Test retrieving a specific API token"""
         # Arrange
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
+        url = reverse("api-tokens", kwargs={"pk": create_api_token_for_user.pk})
 
         # Act
         response = session_client.get(url)
@@ -159,7 +159,7 @@ class TestApiTokenEndpoint:
         # Arrange
         session_client.force_authenticate(user=create_user)
         fake_pk = uuid4()
-        url = reverse("api-tokens-details", kwargs={"pk": fake_pk})
+        url = reverse("api-tokens", kwargs={"pk": fake_pk})
 
         # Act
         response = session_client.get(url)
@@ -178,7 +178,7 @@ class TestApiTokenEndpoint:
         other_user = User.objects.create(email=unique_email, username=unique_username)
         other_token = APIToken.objects.create(label="Other Token", user=other_user, user_type=0)
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": other_token.pk})
+        url = reverse("api-tokens", kwargs={"pk": other_token.pk})
 
         # Act
         response = session_client.get(url)
@@ -192,7 +192,7 @@ class TestApiTokenEndpoint:
         """Test successful API token deletion"""
         # Arrange
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
+        url = reverse("api-tokens", kwargs={"pk": create_api_token_for_user.pk})
 
         # Act
         response = session_client.delete(url)
@@ -207,7 +207,7 @@ class TestApiTokenEndpoint:
         # Arrange
         session_client.force_authenticate(user=create_user)
         fake_pk = uuid4()
-        url = reverse("api-tokens-details", kwargs={"pk": fake_pk})
+        url = reverse("api-tokens", kwargs={"pk": fake_pk})
 
         # Act
         response = session_client.delete(url)
@@ -226,7 +226,7 @@ class TestApiTokenEndpoint:
         other_user = User.objects.create(email=unique_email, username=unique_username)
         other_token = APIToken.objects.create(label="Other Token", user=other_user, user_type=0)
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": other_token.pk})
+        url = reverse("api-tokens", kwargs={"pk": other_token.pk})
 
         # Act
         response = session_client.delete(url)
@@ -242,7 +242,7 @@ class TestApiTokenEndpoint:
         # Arrange
         service_token = APIToken.objects.create(label="Service Token", user=create_user, user_type=0, is_service=True)
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": service_token.pk})
+        url = reverse("api-tokens", kwargs={"pk": service_token.pk})
 
         # Act
         response = session_client.delete(url)
@@ -258,7 +258,7 @@ class TestApiTokenEndpoint:
         """Test successful API token update"""
         # Arrange
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
+        url = reverse("api-tokens", kwargs={"pk": create_api_token_for_user.pk})
         update_data = {
             "label": "Updated Token Label",
             "description": "Updated description",
@@ -282,7 +282,7 @@ class TestApiTokenEndpoint:
         """Test partial API token update"""
         # Arrange
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
+        url = reverse("api-tokens", kwargs={"pk": create_api_token_for_user.pk})
         original_description = create_api_token_for_user.description
         update_data = {"label": "Only Label Updated"}
 
@@ -300,7 +300,7 @@ class TestApiTokenEndpoint:
         # Arrange
         session_client.force_authenticate(user=create_user)
         fake_pk = uuid4()
-        url = reverse("api-tokens-details", kwargs={"pk": fake_pk})
+        url = reverse("api-tokens", kwargs={"pk": fake_pk})
         update_data = {"label": "New Label"}
 
         # Act
@@ -320,7 +320,7 @@ class TestApiTokenEndpoint:
         other_user = User.objects.create(email=unique_email, username=unique_username)
         other_token = APIToken.objects.create(label="Other Token", user=other_user, user_type=0)
         session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": other_token.pk})
+        url = reverse("api-tokens", kwargs={"pk": other_token.pk})
         update_data = {"label": "Hacked Label"}
 
         # Act
@@ -333,56 +333,6 @@ class TestApiTokenEndpoint:
         other_token.refresh_from_db()
         assert other_token.label == "Other Token"
 
-    @pytest.mark.django_db
-    def test_patch_cannot_modify_token(self, session_client, create_user, create_api_token_for_user):
-        """Test that token value cannot be modified via PATCH"""
-        # Arrange
-        session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
-        original_token = create_api_token_for_user.token
-        update_data = {"token": "plane_api_malicious_token_value"}
-
-        # Act
-        response = session_client.patch(url, update_data, format="json")
-
-        # Assert
-        assert response.status_code == status.HTTP_200_OK
-        create_api_token_for_user.refresh_from_db()
-        assert create_api_token_for_user.token == original_token
-
-    @pytest.mark.django_db
-    def test_patch_cannot_modify_user_type(self, session_client, create_user, create_api_token_for_user):
-        """Test that user_type cannot be modified via PATCH"""
-        # Arrange
-        session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": create_api_token_for_user.pk})
-        update_data = {"user_type": 1}
-
-        # Act
-        response = session_client.patch(url, update_data, format="json")
-
-        # Assert
-        assert response.status_code == status.HTTP_200_OK
-        create_api_token_for_user.refresh_from_db()
-        assert create_api_token_for_user.user_type == 0
-
-    @pytest.mark.django_db
-    def test_patch_cannot_modify_service_token(self, session_client, create_user):
-        """Test that service tokens cannot be modified through user token endpoint"""
-        # Arrange
-        service_token = APIToken.objects.create(label="Service Token", user=create_user, user_type=0, is_service=True)
-        session_client.force_authenticate(user=create_user)
-        url = reverse("api-tokens-details", kwargs={"pk": service_token.pk})
-        update_data = {"label": "Hacked Service Token"}
-
-        # Act
-        response = session_client.patch(url, update_data, format="json")
-
-        # Assert
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        service_token.refresh_from_db()
-        assert service_token.label == "Service Token"
-
     # Authentication tests
     @pytest.mark.django_db
     def test_all_endpoints_require_authentication(self, api_client):
@@ -391,9 +341,9 @@ class TestApiTokenEndpoint:
         endpoints = [
             (reverse("api-tokens"), "get"),
             (reverse("api-tokens"), "post"),
-            (reverse("api-tokens-details", kwargs={"pk": uuid4()}), "get"),
-            (reverse("api-tokens-details", kwargs={"pk": uuid4()}), "patch"),
-            (reverse("api-tokens-details", kwargs={"pk": uuid4()}), "delete"),
+            (reverse("api-tokens", kwargs={"pk": uuid4()}), "get"),
+            (reverse("api-tokens", kwargs={"pk": uuid4()}), "patch"),
+            (reverse("api-tokens", kwargs={"pk": uuid4()}), "delete"),
         ]
 
         # Act & Assert

apps/api/plane/utils/content_validator.py

@@ -139,6 +139,8 @@ ATTRIBUTES = {
         "rowspan",
         "colwidth",
         "background",
+        "hideContent",
+        "hidecontent",
         "style",
     },
     "td": {
@@ -148,6 +150,8 @@ ATTRIBUTES = {
         "background",
         "textColor",
         "textcolor",
+        "hideContent",
+        "hidecontent",
         "style",
     },
     "tr": {"background", "textColor", "textcolor", "style"},

apps/api/plane/utils/csv_utils.py

@@ -1,26 +0,0 @@
-# Copyright (c) 2023-present Plane Software, Inc. and contributors
-# SPDX-License-Identifier: AGPL-3.0-only
-# See the LICENSE file for details.
-
-# CSV utility functions for safe export
-# Characters that trigger formula evaluation in spreadsheet applications
-_CSV_FORMULA_TRIGGERS = frozenset(("=", "+", "-", "@", "\t", "\r", "\n"))
-
-
-def sanitize_csv_value(value):
-    """Sanitize a value for CSV export to prevent formula injection.
-
-    Prefixes string values starting with formula-triggering characters
-    with a single quote so spreadsheet applications treat them as text
-    instead of evaluating them as formulas.
-
-    See: https://owasp.org/www-community/attacks/CSV_Injection
-    """
-    if isinstance(value, str) and value and value[0] in _CSV_FORMULA_TRIGGERS:
-        return "'" + value
-    return value
-
-
-def sanitize_csv_row(row):
-    """Sanitize all values in a CSV row."""
-    return [sanitize_csv_value(v) for v in row]

apps/api/plane/utils/exporters/formatters.py

@@ -9,9 +9,6 @@ from typing import Any, Dict, List, Type
 
 from openpyxl import Workbook
 
-# Module imports
-from plane.utils.csv_utils import sanitize_csv_row
-
 
 class BaseFormatter:
     """Base class for export formatters."""
@@ -87,7 +84,7 @@ class CSVFormatter(BaseFormatter):
         buf = io.StringIO()
         writer = csv.writer(buf, delimiter=",", quoting=csv.QUOTE_ALL)
         for row in data:
-            writer.writerow(sanitize_csv_row(row))
+            writer.writerow(row)
         buf.seek(0)
         return buf.getvalue()
 

apps/api/plane/utils/porters/formatters.py

@@ -18,10 +18,6 @@ from typing import Any, Dict, List, Union
 from openpyxl import Workbook, load_workbook
 
 
-# Module imports
-from plane.utils.csv_utils import sanitize_csv_row, sanitize_csv_value
-
-
 class BaseFormatter(ABC):
     @abstractmethod
     def encode(self, data: List[Dict]) -> Union[str, bytes]:
@@ -132,12 +128,11 @@ class CSVFormatter(BaseFormatter):
 
             # Write data rows in the same field order
             for row in data:
-                writer.writerow(sanitize_csv_row([row.get(key, "") for key in fieldnames]))
+                writer.writerow([row.get(key, "") for key in fieldnames])
         else:
             writer = csv.DictWriter(output, fieldnames=fieldnames, delimiter=self.delimiter)
             writer.writeheader()
-            for row in data:
-                writer.writerow({k: sanitize_csv_value(row.get(k, "")) for k in fieldnames})
+            writer.writerows(data)
 
         return output.getvalue()
 

apps/api/requirements/base.txt

@@ -1,7 +1,7 @@
 # base requirements
 
 # django
-Django==4.2.28
+Django==4.2.27
 # rest framework
 djangorestframework==3.15.2
 # postgres
@@ -51,7 +51,7 @@ beautifulsoup4==4.12.3
 # analytics
 posthog==3.5.0
 # crypto
-cryptography==46.0.5
+cryptography==44.0.1
 # html validator
 lxml==6.0.0
 # s3

apps/live/src/lib/pdf/node-renderers.tsx

@@ -358,6 +358,7 @@ export const nodeRenderers: NodeRendererRegistry = {
       </Text>
     );
   },
+
 };
 
 type InternalRenderContext = {

apps/live/src/services/page/core.service.ts

@@ -5,11 +5,17 @@
  */
 
 import { logger } from "@plane/logger";
-import type { TDocumentPayload, TPage } from "@plane/types";
+import type { TPage } from "@plane/types";
 // services
 import { AppError } from "@/lib/errors";
 import { APIService } from "../api.service";
 
+export type TPageDescriptionPayload = {
+  description_binary: string;
+  description_html: string;
+  description: object;
+};
+
 export type TUserMention = {
   id: string;
   display_name: string;
@@ -115,7 +121,7 @@ export abstract class PageCoreService extends APIService {
     }
   }
 
-  async updateDescriptionBinary(pageId: string, data: TDocumentPayload): Promise<any> {
+  async updateDescriptionBinary(pageId: string, data: TPageDescriptionPayload): Promise<any> {
     try {
       const response = await this.patch(`${this.basePath}/pages/${pageId}/description/`, data, {
         headers: this.getHeader(),

apps/live/tests/lib/pdf/pdf-rendering.test.ts

@@ -728,5 +728,6 @@ describe("PDF Rendering Integration", () => {
 
       expect(text).toContain("Text after image");
     });
+
   });
 });