Kanboard 1.2.55

Release date: October 20, 2026

Changes

Prevent spoofed client IP addresses in trusted-proxy headers from bypassing IP-based CAPTCHA and login lockouts
Restrict dashboard and overdue-task queries to projects a user can still access
Enforce project authorization when closing board columns, reordering subtasks, and duplicating tasks between projects
Require the project-manager role to modify project metadata through the API
Validate and escape color IDs and project names to prevent cross-site scripting
Limit iCalendar start-date fields to supported task columns

Add support for uploading and previewing WebP image attachments
Allow API clients to set a validated project member as the creator of task and project attachments
Add Azerbaijani interface translations and improve Swedish translations

Preserve session cookies when Kanboard is installed in a subdirectory
Enable notifications for automatically created LDAP users when notifications are enabled by default
Return a complete JSON-RPC batch response when an individual request is forbidden

Harden GitHub Actions workflows with read-only job tokens and without persisted checkout credentials