Kanboard 1.2.43

• fix: verify the session hasn't expired before returning data
• fix: avoid PHP 8.4 deprecation notices in third-party libraries
• fix: avoid Composer warnings regarding PSR compatibility
• feat(locale): add missing Brazilian Portuguese translations
• ci: run GitHub Actions tests with ubuntu-24.04
• chore: don't export-ignore the ChangeLog
• build(deps): bump symfony/service-contracts from 2.5.3 to 2.5.4
• build(deps): bump symfony/event-dispatcher-contracts from 2.5.3 to 2.5.4
• build(deps): bump symfony/deprecation-contracts from 2.5.3 to 2.5.4
• build(deps): bump alpine from 3.20 to 3.21

Kanboard 1.2.42

• fix: validate translation filename before loading locales
• fix: avoid path traversal in FileStorage
• feat: add Peruvian Sol to the list of currencies
• build(deps): bump symfony/finder from 5.4.43 to 5.4.45
• build(deps-dev): bump symfony/stopwatch from 5.4.40 to 5.4.45

Kanboard 1.2.41

• feat: add new plugin hooks in project forms
• feat: add option to add BOM at the beginning of CSV files (required for Microsoft Excel)
• feat: validate app config form values
• feat: add cancel button on 2FA code validation screen
• fix: add CSRF check to the logout endpoint
• fix: add HTML escaping when displaying exception message
• fix: add URL validation for external task links
• fix: correct broken migration logic for Sqlite

Kanboard 1.2.40

• build(deps): bump symfony/finder from 5.4.42 to 5.4.43
• chore: add php83-xmlwriter package to the Docker image
• ci: update GitHub pull-request template
• fix: avoid PHP error if no subtask in progress is found
• fix: avoid potential XSS and HTML injection in comment replies
• fix: prevent duplicated columns when enabling per-swimlane column task limits
• fix(api): check comment visibility in API procedures
• fix(api): verify comment ownership in API procedures
• fix(mssql): escape identifiers in timesheet queries
• fix(mssql): use ANSI OFFSET/FETCH syntax for pagination queries
• fix(test): use explicit ORDER BY for queries returning multiple rows
• test: add unit tests for Subtask Time Tracking query methods
• test: ensure pagination produces correct chunks

Kanboard 1.2.39

• fix: remove CSS which caused responsive issues on mobile
• fix: incorrect template condition that set the username field to read only for remote users
• fix: tasks count across swimlanes was incorrect
• fix: avoid warning from libpng when loading PNG image with incorrect iCCP profiles
• feat: improve column header task counts
• feat: add apple-mobile-web-app-capable meta tag
• build(deps): bump symfony/finder from 5.4.40 to 5.4.42

Kanboard 1.2.38

• fix: avoid browser caching issue when showing file attachments
• fix: comments visibility was not taken into consideration on event activities page
• fix: send comment via email was broken due to missing comment visibility logic implemented in v1.2.36
• feat(locale): update Greek translations
• feat(locale): update Italian translations
• build(deps): bump symfony/console from 5.4.40 to 5.4.41
• build(deps): bump docker/build-push-action from 5 to 6

Kanboard 1.2.37

• Add CSRF check and remove project_id form value for addUser and addGroup actions (CVE-2024-36399)
• Update symfony/* dependencies
• Update Docker image to Alpine 3.20
• Update Russian and Hungarian translation
• Add color_id argument to createCategory and updateCategory API procedures
• Add link to create a comment before the list
• Fix: unable to create comments with "c" shortcut or "Add a comment" menu

Kanboard 1.2.36

• Add comments visibility
• Add explicit int casting to avoid PHP 8 TypeError when having empty automatic action parameters
• Add new config option DASHBOARD_MAX_PROJECTS
• Add reply feature to comments
• Fix search bar layout when adding more buttons via third-party plugins
• Introduce a Git hook to automatically update version.txt during Git checkout
• Performance improvements:
  • Don't count closed tasks when rendering the board
  • Force the use of the cache when there is no custom roles
• Use unique plugin name instead of plugin title for plugin registry logic
• Update dependencies

Kanboard 1.2.35

• Add missing HTML escaping when showing group membership in user profile (CVE-2024-22720)
• Update Dutch translation
• Update Bulgarian translation
• Bump phpunit/phpunit from 9.6.15 to 9.6.16
• Bump symfony/console from 5.4.32 to 5.4.34

Kanboard 1.2.34

• Upgrade Docker image to Alpine 3.19 and PHP 8.3
• API: Avoid PHP notice when searching for a project name that does not exist
• Update Bulgarian translation
• Bump symfony/console from 5.4.28 to 5.4.32
• Bump phpunit/phpunit from 9.6.13 to 9.6.15