This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
ReleasePort's take
Moderate signalThe release patches an unsafe URL construction vulnerability in the background component and introduces several new features such as rate limits on upload APIs, suppressed system notifications tags, and updated Helm chart variables.
Why it matters: Fixes a critical security flaw (severity 90) that could enable malicious URL injection; adopt v3.3.13 immediately to protect affected components.
Summary
AI summaryUpdates deps, db_update, and https://4gaboards.com/posts/2026_07_15_4gaBoardsRelease_3.3.13 across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes unsafe URL construction vulnerability in background component. Fixes unsafe URL construction vulnerability in background component. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds suppressed system notifications tags and full‑precision due dates in user preferences (database update). Adds suppressed system notifications tags and full‑precision due dates in user preferences (database update). Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds rate limits, maxBytes limits, sharp limits, and board import extraction limits to upload endpoints. Adds rate limits, maxBytes limits, sharp limits, and board import extraction limits to upload endpoints. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds new variables to deployment.yaml. Adds new variables to deployment.yaml. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Feature | Low |
Adds Redis support to Helm chart. Adds Redis support to Helm chart. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates Helm release PostgreSQL to version 18.7.13. Updates Helm release PostgreSQL to version 18.7.13. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates Helm release Redis to version 27.0.15. Updates Helm release Redis to version 27.0.15. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Dependency | Low |
Updates dependency webpack‑dev‑server to version 6. Updates dependency webpack‑dev‑server to version 6. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes Getting Started Project requiring reload before showing missing boardMembership. Fixes Getting Started Project requiring reload before showing missing boardMembership. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Bugfix | Medium |
Fixes undefined system-notifications endpoint when NODE_ENV and HOST_NOTIFICATIONS_URL are unset. Fixes undefined system-notifications endpoint when NODE_ENV and HOST_NOTIFICATIONS_URL are unset. Source: llm_adapter@2026-07-15 Confidence: high |
— |
| Refactor | Low |
Moved isSafeUrl utility to utils module. Moved isSafeUrl utility to utils module. Source: granite4.1:30b@2026-07-15-audit Confidence: low |
— |
Full changelog
Changes since last release:
- 🐞 fix(security): unsafe url construction in background component en db455dd @tomaioo
- 🐝 refactor: Moved isSafeUrl to utils 672fab7
- 🐞 fix: Getting Started Project required reload before showing (missing boardMembership) ebab08a
- 🌟 feat: Added suppressed system notifications tags and show full precision due dates in user prefs (db_update) 7e79ef7
- 🎨 style: One line Task DueDate 9724ce0
- 🎨 style: Minor changes b325024
- 💄 chore(deps): update helm release postgresql to v18.7.12 211d54d @renovate-bot
- 🐞 fix(deps): update dependency webpack-dev-server to v6 f5b6ac3 @renovate-bot
- 💄 chore(deps): update dependency @opentelemetry/core to v2.9.0 1ece3f4 @renovate-bot
- 💄 chore(deps): update docker/login-action action to v4.4.0 d56eea4 @renovate-bot
- 💄 chore(deps): update dependency webpack to v5.108.4 2958d31 @renovate-bot
- 💄 chore(deps): update dependency browserslist to v4.28.5 7225201 @renovate-bot
- 🌟 feat: Updated boards restore/backup scripts 9d3ce2c
- 💢 ci: Added minimumReleaseAge to renovatebot config 13834a2
- 💄 chore: Bumped docker compose postgres version 3e5cba6
- 🐞 fix: Fixed undefined system-notifications endpoint when NODE_ENV not set and HOST_NOTIFICATIONS_URL not set 906b0bf
- 💄 chore(deps): update dependency @azure/msal-node to v5.4.0 12f5078 @renovate-bot
- 📄 Merge pull request #1043 from RARgames/renovate/azure-ad-microsoft-authentication-library-for-js-monorepo 3e37cdb
- 💄 chore(deps): update dependency eslint-plugin-perfectionist to v5.10.0 b0cde86 @renovate-bot
- 📄 Merge pull request #1041 from RARgames/renovate/eslint-plugin-perfectionist-5.x-lockfile b2f1172
- 🌟 feat: Added NODE_ENV production in sample .env 7087a57
- 🌟 feat: Updated config 59e1879
- 💄 chore(deps): update helm release postgresql to v18.7.13 e3c5ad3 @renovate-bot
- 📄 Merge pull request #1045 from RARgames/renovate/postgresql-18.x 6cac1e1
- 💄 chore(deps): update dependency i18next to v26.3.6 63ce978 @renovate-bot
- 📄 Merge pull request #1044 from RARgames/renovate/i18next-26.x-lockfile 79c9b8a
- 💄 chore(deps): update dependency browserslist to v4.28.6 f00d540 @renovate-bot
- 📄 Merge pull request #1047 from RARgames/renovate/browserslist-4.x-lockfile 06a9862
- 💄 chore(deps): update dependency node-cron to v4.6.0 122eb25 @renovate-bot
- 📄 Merge pull request #1009 from RARgames/renovate/node-cron-4.x-lockfile 578da9b
- 💄 chore(deps): update dependency @floating-ui/react to v0.27.20 ab8dd97 @renovate-bot
- 📄 Merge pull request #1046 from RARgames/renovate/floating-ui-react-0.x-lockfile b35a2fe
- 💄 chore(deps): update dependency filesize to v11.0.22 980a0f2 @renovate-bot
- 📄 Merge pull request #1049 from RARgames/renovate/filesize-11.x-lockfile 3cbb3a9
- 💄 chore(deps): update dependency postcss to v8.5.17 29fd395 @renovate-bot
- 📄 Merge pull request #1050 from RARgames/renovate/postcss-8.x-lockfile 71bfc99
- 💄 chore(deps): update dependency react-i18next to v17.0.9 6f27d7e @renovate-bot
- 📄 Merge pull request #1052 from RARgames/renovate/react-i18next-17.x-lockfile 3f5b5c8
- 💄 chore(deps): update dependency prettier to v3.9.5 0c67c1d @renovate-bot
- 📄 Merge pull request #1051 from RARgames/renovate/prettier-3.x-lockfile c026579
- 🐞 fix: Use findOrCreate instead of create to prevent warning (reported multiple times in issues) c9f627a
- 🌟 feat: Added rate limits for upload endpoints, maxBytes limits, sharp limits, board import extraction limits - thanks @phamkhanhhung1998 0f02795
- 🌟 feat: Added new variables to deployment.yaml 940bad8
- 🌟 feat: Added redis to helm chart 8e3883e
- 💄 chore(deps): update dependency tar to v7.5.20 ebae71b @renovate-bot
- 📄 Merge pull request #1053 from RARgames/renovate/tar-7.x-lockfile 36cde1b
- 🐞 fix(deps): update dependency @hyperdx/browser to ^0.25.0 64bc065 @renovate-bot
- 📄 Merge pull request #1054 from RARgames/renovate/hyperdx-browser-0.x db5bb5b
- 💄 chore(deps): update dependency postcss to v8.5.19 f795514 @renovate-bot
- 📄 Merge pull request #1055 from RARgames/renovate/postcss-8.x-lockfile e40c731
- 💄 chore(deps): update softprops/action-gh-release action to v3.0.2 d2988d2 @renovate-bot
- 📄 Merge pull request #1057 from RARgames/renovate/softprops-action-gh-release-3.x 5a84558
- 💄 chore(deps): update actions/setup-node action to v6.5.0 64b8b6f @renovate-bot
- 📄 Merge pull request #1058 from RARgames/renovate/actions-setup-node-6.x 51f5967
- 💄 chore(deps): update helm release redis to v27.0.15 924b64a @renovate-bot
- 📄 Merge pull request #1056 from RARgames/renovate/redis-27.x bdfb876
- 💄 chore(deps): update actions/setup-node action to v7 2223c04 @renovate-bot
- 📄 Merge pull request #1059 from RARgames/renovate/actions-setup-node-7.x 9e62b3a
- 💄 chore(deps): update dependency eslint to v9.39.5 7304a28 @renovate-bot
- 📄 Merge pull request #1048 from RARgames/renovate/eslint-monorepo 6907159
- 🐞 fix(deps): update dependency react-dropzone to v17 62fafbd @renovate-bot
- 📄 Merge pull request #1060 from RARgames/renovate/react-dropzone-17.x 6663b80
- 💄 chore(deps): update dependency react-router to v7.18.1 8f8a502 @renovate-bot
- 📄 Merge pull request #999 from RARgames/renovate/react-router-monorepo e81da2e
- 💄 [PATCH] chore: Bumped deps 125918a
Install this release using: docker pull ghcr.io/rargames/4gaboards:3.3.13
View the changelog summary on the: 4ga Boards Blog
Security Fixes
- Fixed unsafe URL construction in background component – mitigates potential injection vulnerability.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About 4gaBoards
Straightforward realtime kanban boards management for intuitive task tracking. 4ga Boards features an elegant dark mode, collapsible todo lists, and multitasking tools to supercharge your team's productivity.
Beta — feedback welcome: [email protected]