CeSGO Dashboard 2.1.0

Security fixes

• Disable PHP session upload progress in the Docker image to mitigate CVE-2026-115560.
• Check that the user can access the opposite task's project before adding internal links with bulk changes.
• Hide projects the caller cannot access from the API procedures getProjectByName, getProjectByIdentifier, and getProjectByEmail:
  • They now return false instead of a 403 error that revealed the project exists.

Improvements

• Allow searching users by their exact email address:
  • Emails are matched exactly and case-insensitively, so partial searches cannot be used to discover other users' addresses.

Bug fixes

• Make text searches case-insensitive for non-ASCII characters with SQLite.
• Fix PHP 8.5 and PHP-FPM configuration issues in the Docker image.
• Remove PHP 8.5 deprecation warnings.

Dependencies and build

• Remove the unused composer.json from the bundled Symfony EventDispatcher, which triggered a false-positive Dependabot alert.
• Update several GitHub Actions.

Security fixes

Upgrade the Docker image and runtime configuration from PHP 8.4 to PHP 8.5.

The current Alpine package resolves to PHP 8.5.12, which fixes CVE-2026-109618 and CVE-2026-109619.

See: https://www.php.net/archive/2026.php#2026-10-21-5

Security fixes

• Prevent spoofed client IP addresses in trusted-proxy headers from bypassing IP-based CAPTCHA and login lockouts
• Restrict dashboard and overdue-task queries to projects a user can still access
• Enforce project authorization when closing board columns, reordering subtasks, and duplicating tasks between projects
• Require the project-manager role to modify project metadata through the API
• Validate and escape color IDs and project names to prevent cross-site scripting
• Limit iCalendar start-date fields to supported task columns

Improvements

• Add support for uploading and previewing WebP image attachments
• Allow API clients to set a validated project member as the creator of task and project attachments
• Add Azerbaijani interface translations and improve Swedish translations

Bug fixes

• Preserve session cookies when Kanboard is installed in a subdirectory
• Enable notifications for automatically created LDAP users when notifications are enabled by default
• Return a complete JSON-RPC batch response when an individual request is forbidden

Maintenance

• Harden GitHub Actions workflows with read-only job tokens and without persisted checkout credentials

Dependencies and build

• Update several GitHub Actions dependencies

Security fixes

• Invalidate existing sessions and "remember me" tokens when a user's password changes
  • All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint
• Enforce permissions in the project creation handler, including personal project creation and project duplication
• Verify the task and project relationship when fetching task files and when assigning tags through the API
• Return only public user fields from API procedures, excluding passwords, two-factor secrets, API access tokens, and other private tokens
• Reject subtask assignees that do not belong to the project
• Scope unread notification lookups to the notification owner
• Scope custom filter changes to the filter's project and owner
• Validate request tokens for tag, board, and comment actions
• Validate automatic action parameters by requiring scalar integer IDs, ensuring destination projects are accessible, and ensuring referenced columns, swimlanes, categories, and users belong to the action's project
• Prevent CSV formula injection by escaping exported values that spreadsheet applications could interpret as expressions
• Harden the official Docker nginx configuration so that only the application front controllers can execute PHP files

Dependencies and build

• Update docker/login-action from 4.4.0 to 4.6.0
• Update actions/stale from 10.4.0 to 11.0.0
• Update docker/setup-buildx-action from 4.2.0 to 4.3.0

Security fixes

• Scope restriction removal to the authorized project so a project manager can no longer delete restrictions belonging to other projects (ProjectRoleRestrictionModel, ColumnRestrictionModel, ColumnMoveRestrictionModel)
• Verify that a task belongs to the project before moving it with board drag and drop
• Validate the destination project in the task move/copy form to prevent reading metadata of inaccessible projects
• Restrict "remember me" session removal to the user that owns the session
• Validate user_id in subtask time tracking write methods
• Escape user-provided text in several templates: comment reply textarea, web notification titles, and the project name in the task links tooltip

Improvements

• Add a per-user preference to make bare task search match titles, descriptions, and comments instead of titles only (title-only search remains the default)

Bug fixes

• Fix the age indicator so items between 20 and 30 minutes old are labelled <30m instead of <1h
• Fix Markdown rendering of task links: text following a #id link at the start of a line is no longer swallowed
• Suppress PHP warnings triggered by hook calls in the project view
• Fix an incorrect CSS visibility value
• Adjust tooltip maximum height and position
• Fix an incorrect character in the zh_TW translation

Maintenance

• Pin GitHub Actions to commit SHAs
• Add a workflow to close stale pull requests
• Group Dependabot updates to reduce check frequency

Dependencies and build

• Update the Docker base image from Alpine 3.23 to 3.24
• Upgrade select2 to 4.0.13 and PHPUnit to 12.5.23
• Update several GitHub Actions