v1.4.1

### ✨  Features

#### **Workspace Member Reactivation Command**

Self-hosted administrators can now restore a deactivated workspace member straight from the command line, without editing the database by hand. Running `reactivate_workspace_member <workspace-slug> <email>` re-enables the membership and reports the role the member is restored to.

- Validates the workspace, the user, and the existing membership before changing anything, with a clear error when any of them is missing
- Safe to re-run — an already-active member is reported as such instead of failing
- Keeps audit fields intact by limiting the write to the membership's active state

### ⬆️  Enhancements

- The workspace-level modules list now returns the member IDs for each module, so module members and member-based filters render correctly on the workspace modules view.
- Work item layouts are now wrapped in an error boundary. If a single layout fails to render, it degrades to a local "Something went wrong" message with a Retry button instead of taking down the whole page.

### 🐞  Bug fixes

- Fixed notifications failing to load on self-hosted deployments, where a missing trailing slash on the notification list request surfaced as a 500 error behind the reverse proxy.
- Fixed filtering modules by member breaking for modules with no members assigned.
- Fixed the layout dropdown button being clipped and overlapping neighbouring controls in the Create View modal.
- Fixed crashes on work items whose labels included an ID that no longer resolves to a label, affecting the properties row, the spreadsheet label column, the peek overview, and draft work items.
- Fixed crashes when a response came back empty or in an unexpected shape, affecting description version history, previous exports, the integrations list, profile activity, and sub-work-items.
- Fixed the previous exports list failing to refresh, and surfaced an error instead of failing silently when the refresh does not go through.
- Fixed profile activity showing a loading state indefinitely instead of an empty state when a user had no activity.

### 🛡️ Security

- Hardened asset uploads on published Space pages. The endpoint previously trusted the client-supplied file size when signing the upload policy, allowing a caller to request a policy larger than the instance's configured `FILE_SIZE_LIMIT`. The size is now clamped to the instance limit and malformed values are rejected.
- Upgraded `cryptography` to 50.0.0 to close a high-severity PKCS#7 Bleichenbacher oracle.
- Upgraded React Router to 7.18.1, resolving denial-of-service, open redirect, cross-site scripting, and constructor injection advisories.
- Upgraded `sharp` to 0.35.3 to pick up high-severity libvips fixes.
- Resolved further high-severity advisories in `fast-uri` (host confusion), `js-yaml` (quadratic CPU denial of service), `linkify-it` (mailto validator denial of service), `postcss` (source map path traversal), and `undici` (information disclosure, CRLF and cookie injection).
- Resolved medium- and low-severity advisories in `sanitize-html` (URI scheme validation bypass), `valibot`, and `body-parser` (request limit bypass).