Kanboard 1.2.57

Changes

Security fixes

• Disable PHP session upload progress in the Docker image to mitigate CVE-2026-115560.
• Check that the user can access the opposite task's project before adding internal links with bulk changes.
• Hide projects the caller cannot access from the API procedures getProjectByName, getProjectByIdentifier, and getProjectByEmail:
  • They now return false instead of a 403 error that revealed the project exists.

Improvements

• Allow searching users by their exact email address:
  • Emails are matched exactly and case-insensitively, so partial searches cannot be used to discover other users' addresses.

Bug fixes

• Make text searches case-insensitive for non-ASCII characters with SQLite.
• Fix PHP 8.5 and PHP-FPM configuration issues in the Docker image.
• Remove PHP 8.5 deprecation warnings.

Dependencies and build

• Remove the unused composer.json from the bundled Symfony EventDispatcher, which triggered a false-positive Dependabot alert.
• Update several GitHub Actions.

Links

• https://github.com/kanboard/kanboard/tree/v1.2.57
• https://github.com/kanboard/kanboard/archive/refs/tags/v1.2.57.zip
• https://github.com/kanboard/kanboard/archive/refs/tags/v1.2.57.tar.gz

Docker Images

• docker pull docker.io/kanboard/kanboard:v1.2.57
• docker pull ghcr.io/kanboard/kanboard:v1.2.57
• docker pull quay.io/kanboard/kanboard:v1.2.57