release: v1.2.2

[sriramveeraghanta]

Security patch

• Fixed arbitrary modification of API token rate limits by enforcing server-side validation and authorization checks.
• Mitigated SSRF vulnerability in work item link handling through strict URL validation and outbound request controls.
• Fixed member information disclosure via publicly accessible endpoint by applying proper access control checks.
• Resolved IDOR vulnerabilities in asset and attachment endpoints to prevent unauthorized resource access.
• Upgraded Django to 4.2.28
• Upgraded the cryptography to 46.0.5

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch release/v1.2.2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Release bump to v1.2.2 across the monorepo, with a small API hardening to scope FileAsset operations to the workspace/project/issue from the request path.

Changes:

• Bump package/app versions from 1.2.1 to 1.2.2.
• Scope issue attachment deletion to workspace__slug, project_id, and issue_id (returning 404 when not found).
• Scope project asset upload finalization (PATCH) to workspace__slug and project_id.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/utils/package.json	Version bump to 1.2.2
packages/ui/package.json	Version bump to 1.2.2
packages/typescript-config/package.json	Version bump to 1.2.2
packages/types/package.json	Version bump to 1.2.2
packages/tailwind-config/package.json	Version bump to 1.2.2
packages/shared-state/package.json	Version bump to 1.2.2
packages/services/package.json	Version bump to 1.2.2
packages/propel/package.json	Version bump to 1.2.2
packages/logger/package.json	Version bump to 1.2.2
packages/i18n/package.json	Version bump to 1.2.2
packages/hooks/package.json	Version bump to 1.2.2
packages/editor/package.json	Version bump to 1.2.2
packages/constants/package.json	Version bump to 1.2.2
packages/codemods/package.json	Version bump to 1.2.2
package.json	Root version bump to 1.2.2
apps/web/package.json	App version bump to 1.2.2
apps/space/package.json	App version bump to 1.2.2
apps/live/package.json	App version bump to 1.2.2
apps/api/package.json	App version bump to 1.2.2
apps/admin/package.json	App version bump to 1.2.2
apps/api/plane/app/views/issue/attachment.py	Restrict attachment deletion query by workspace/project/issue; 404 when not found
apps/api/plane/app/views/asset/v2.py	Restrict asset patch query by workspace/project