It’s a Plan
Deploy
Open navigation
Changelog

v1.8.0

View on GitHub

Highlights

Pro edition

It's a Plan Pro is available. It extends It's a Plan for small and large teams that need more control and flexibility. The license pays for the work on Community, the free edition. The license applies to the instance and has no limit on seats or on anything else.

To install Pro or move an existing instance to Pro, deploy the Pro images and enter the license key in God mode → License. An existing instance keeps its data. The Railway template installs Pro by default. The steps for Docker Compose, Coolify, and Helm are in the README. Pricing and license terms are at itsaplan.dev/pro.

Security

This release fixes 3 high advisories. Update every instance.

  • GHSA-h3gg-j88j-8xj3 (high): when the OIDC provider sent email_verified as the string "false", the instance counted the address as verified. A person with an unverified address at the provider could sign in to the confirmed account with the same address, the instance owner's included.
  • GHSA-g3vx-r554-vh75 (high): a run of an internal agent in one project could read and change issues, comments, checklists, cycles, and initiatives in the other projects of the agent. A member of one project could start such a run.
  • GHSA-fc57-vm5q-5r3v (high): a member who shared one project with an agent could regenerate its API key, edit it, change its tools or skills, and delete it. The new key acted as the agent in all its projects, also in projects where the member was not a member.
  • Dependencies: Next.js 16.4.2 fixes GHSA-2464-fhr4-w9xw and GHSA-p3m5-59mp-jv5r. DOMPurify 3.4.17 fixes GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr. Hono 4.13.11 fixes GHSA-5r4p-p66f-jhc7, and ip-address 10.7.4 fixes GHSA-rxp7-6hxx-x8q5.

Also in this release

  • The agent list and the agent settings show edit, delete, regenerate key, and the invocation secret only to a person who can use them.

Breaking changes

  • An internal agent run refuses an issue, comment, checklist, cycle, or initiative of a project other than the project of the run, with 403.
  • To edit or delete an agent, regenerate its key, set its tools or skills, or read, rotate, or test its invocation secret, a person must be a team owner or manager, or a member of every project of the agent.

Contributors

Thank you to everyone who contributed to this release.

Code

@pasqualtroncone

Requests and reports

@pasqualtroncone

v1.7.0All releases