Starstruk Logo MarkStarstruk

v1.2.2

makeplane/planev1.2.2Feb 23, 2026by github-actions[bot]

AI Summary

Security patch release addressing vulnerabilities related to API token rate limits, SSRF in work item links, and unauthorized resource access (IDOR).

Key Highlights

  • Fixed arbitrary modification of API token rate limits.
  • Mitigated SSRF vulnerability in work item link handling.
  • Fixed member information disclosure via public endpoints.

New Features

  • API token rate limit enforcement
  • SSRF vulnerability mitigation
  • Member information disclosure fix

Full Release Notes

### Security patch

- Fixed arbitrary modification of API token rate limits by enforcing server-side validation and authorization checks.
- Mitigated SSRF vulnerability in work item link handling through strict URL validation and outbound request controls.
- Fixed member information disclosure via publicly accessible endpoint by applying proper access control checks.
- Resolved IDOR vulnerabilities in asset and attachment endpoints to prevent unauthorized resource access.
- Upgraded Django to 4.2.28
- Upgraded the cryptography to 46.0.5