kanboard

Security fixes

• Scope restriction removal to the authorized project so a project manager can no longer delete restrictions belonging to other projects (ProjectRoleRestrictionModel, ColumnRestrictionModel, ColumnMoveRestrictionModel)
• Verify that a task belongs to the project before moving it with board drag and drop
• Validate the destination project in the task move/copy form to prevent reading metadata of inaccessible projects
• Restrict "remember me" session removal to the user that owns the session
• Validate user_id in subtask time tracking write methods
• Escape user-provided text in several templates: comment reply textarea, web notification titles, and the project name in the task links tooltip

Improvements

• Add a per-user preference to make bare task search match titles, descriptions, and comments instead of titles only (title-only search remains the default)

Bug fixes

• Fix the age indicator so items between 20 and 30 minutes old are labelled <30m instead of <1h
• Fix Markdown rendering of task links: text following a #id link at the start of a line is no longer swallowed
• Suppress PHP warnings triggered by hook calls in the project view
• Fix an incorrect CSS visibility value
• Adjust tooltip maximum height and position
• Fix an incorrect character in the zh_TW translation

Maintenance

• Pin GitHub Actions to commit SHAs
• Add a workflow to close stale pull requests
• Group Dependabot updates to reduce check frequency

Dependencies and build

• Update the Docker base image from Alpine 3.23 to 3.24
• Upgrade select2 to 4.0.13 and PHPUnit to 12.5.23
• Update several GitHub Actions