sriram veeraghanta 9a30a07cf5 fix(api): enforce workspace membership on GenericAssetEndpoint (#9212) ...

The public REST API GenericAssetEndpoint (/api/v1/workspaces/<slug>/assets/)
declared no permission class, inheriting only IsAuthenticated. Since
APIKeyAuthentication does not bind a token to a workspace and the workspace is
read straight from the URL slug, any valid Personal Access Token could read
(GET), create (POST), and modify (PATCH) assets in a workspace the caller is
not a member of — a cross-workspace IDOR, the public-API sibling of the
CVE-2026-46558 dashboard asset fix.

Add permission_classes = [WorkspaceUserPermission] so every method requires
active workspace membership, matching the dashboard fix semantics. Also add
contract regression tests covering cross-workspace GET/POST/PATCH (now 403)
and a positive control confirming members retain access.

Also ignore the local /security/ advisory notes folder.

2026-06-04 18:49:39 +05:30

..

admin

fix: declare @tailwindcss/postcss in admin/space/web for Docker builds (#9189)

2026-06-01 16:44:16 +05:30

api

fix(api): enforce workspace membership on GenericAssetEndpoint (#9212)

2026-06-04 18:49:39 +05:30

live

fix: bump npm deps to resolve Dependabot advisories (#9191)

2026-06-01 18:37:35 +05:30

proxy

fix: security vulnerabilities for plane docker images (#9140)

2026-05-26 14:25:01 +05:30

space

fix: declare @tailwindcss/postcss in admin/space/web for Docker builds (#9189)

2026-06-01 16:44:16 +05:30

web

fix: handle error message for special characters in Identifier of Project (#9059)

2026-06-03 17:26:18 +05:30