Skip to main content
Free demo available - Try PLANKA today!

PLANKA Pro Changelog

What changed in each release of PLANKA Pro, newest first.

Last updated Aug 25, 2026

[2.4.4] - 2026-08-21

This release brings PLANKA Pro level with PLANKA Community 2.2: everything Community gained since Pro 2.4.1 is here, so no feature is missing when moving across. It is built on the 2.4.1 line, not on the current development branch, so it carries these changes and nothing else.

Added

  • Two-factor authentication (TOTP) for non-SSO users: enable in user settings → security with a QR-code-based authenticator app, get 10 one-time recovery codes, and optionally trust a browser for 30 days. Trusted browsers are listed with OS / browser / device info and can be revoked individually; admins can reset 2FA on any user (with step-up password confirmation). OIDC logins are unaffected.
  • Auto-logout on inactivity: pick a timeout (2/5/10/30 min, 12 h, or never) in user settings → preferences; a 30 s warning dialog appears before the session ends, and activity in any open tab keeps you signed in across all of them
  • Open a unified user edit modal in administration → users/guests by clicking a user's name (combines profile, credentials and API key in one place); the administration modal itself now uses the same lighter pointing-tab style
  • Customize the login screen welcome message (Markdown) and cover image directly from administration → general; the separate Login Page tab has been merged in
  • Redesign the user settings modal to match the new look: two-column layout, lockable username/email fields, inline password change with confirmation, and a single save action
  • Show inline error messages when changing username, email, or password (e.g. "already in use", "invalid current password")
  • Allow admins to edit user avatars

Fixed

  • Fix Unicode and emoji characters in user avatar initials
  • Fix S3 request checksum calculation
  • Limit proxy file descriptors to prevent excessive memory allocation

Security

  • Fix a path traversal in the local file manager (CWE-22). Attacker-controlled path segments were joined into the uploads storage path without checking that the result stayed under the uploads root, which allowed arbitrary file reads through the static file routes — on the unauthenticated /shared/* route without any login. Paths are now resolved and confined to the uploads root centrally, and symlinks are resolved and re-checked so one inside the root cannot be used to escape it.

Upgrading from PLANKA Community

npm run server:db:promote now accepts two Community schemas:

  • Community 2.1.0 / 2.1.1 — the last releases with single sign-on. Identity provider links come across intact, and the two-factor columns start at their defaults.
  • Community 2.2.0 / 2.2.1 — trusted devices and TOTP settings come across, and accounts keep their two-factor setup.

If you use OIDC, promote from 2.1.1, the newer of the two. Community 2.2 removed single sign-on: it drops the identity provider links and deactivates the accounts that used them, and that data cannot be recovered afterwards. Any other Community version has to be updated to one of the two above first.

Helm chart

The chart moved to its own OCI repository, so charts and container images are no longer mixed in one place:

  • Container image — docker.planka-services.de/planka/planka-pro
  • Helm chart — docker.planka-services.de/planka/planka-pro-chart

Resource names and labels are unchanged, so helm upgrade on an existing release works as before — only the chart reference has to be updated.

[2.4.1] - 2026-03-26

Fixed

  • Add support to Upgrade from latest Community Version

[2.4.0] - 2026-03-19

Added

  • Add maintenance mode
  • Support running under subpath
  • Add ability to display card ages
  • Allow exposing Swagger specification
  • Configurable HTTP timeout for OIDC

[2.3.4] - 2026-03-01

Fixed

  • Prevent dropzone from overflowing content
  • Update Gravatar hash algorithm
  • Improve backup and restore scripts
  • Improve installation on Windows and containerized environments
  • Improve security by ensuring the outgoing proxy is not accessible from outside

[2.3.3] - 2026-02-17

Fixed

  • Improve connection reliability after the app is idle
  • Allow loading custom End User Terms of Service

[2.3.2] - 2026-01-31

Fixed

  • Ensure correct permission checks when copying or moving cards
  • Fix link card animations and label displays
  • Optimize database indexes to improve performance
  • Improve stability of card drag-and-drop in calendar view

[2.3.1] - 2026-01-17

Fixed

  • Correct calendar row styling and drag-to all-day behavior
  • Properly handle timezones for recurring cards
  • Include location name in board and global search
  • Prevent language conflicts in notifications

[2.3.0] - 2025-12-23

Added

  • New calendar view for planning and scheduling
  • Support for recurring cards with flexible rules
  • Ability to copy, cut, and paste cards (with hotkeys)
  • New link card type with improved visuals and previews
  • Ability to select department and location for users
  • Lazy loading to support an unlimited number of users
  • Customizable logo and login cover
  • Due date offset for recurring cards
  • Interactive map opening when clicking a location
  • Separate tracking and management of guest-only users

Changed

  • Enhanced users modal to display full information
  • More consistent card actions menu layout with separators
  • Made location search more accurate and easier to use