Skip to content

fix: pnpm path for Docker builds#9079

Merged
sriramveeraghanta merged 1 commit into
canaryfrom
fix/pnpm/path/ci
May 14, 2026
Merged

fix: pnpm path for Docker builds#9079
sriramveeraghanta merged 1 commit into
canaryfrom
fix/pnpm/path/ci

Conversation

@sriramveeraghanta
Copy link
Copy Markdown
Member

@sriramveeraghanta sriramveeraghanta commented May 14, 2026 •
edited
Loading

Summary

  • Add $PNPM_HOME/bin to PATH in community Dockerfiles so corepack-installed pnpm binaries are resolvable during Docker builds.

Files updated:

  • apps/admin/Dockerfile.admin
  • apps/live/Dockerfile.live
  • apps/space/Dockerfile.space
  • apps/web/Dockerfile.web

Change: ENV PATH="$PNPM_HOME:$PATH" → ENV PATH="$PNPM_HOME:$PNPM_HOME/bin:$PATH"

Test plan

  • Docker builds succeed for admin, live, space, and web images on CI

@sriramveeraghanta
fix: pnpm path for Docker builds
f7bb94d 
Add $PNPM_HOME/bin to PATH so corepack-installed pnpm binaries are
resolvable during Docker builds.
Copilot AI review requested due to automatic review settings May 14, 2026 19:32
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 14, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 32a926e8-3a2d-499b-963f-1f2828e40ef5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/pnpm/path/ci

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copilot AI reviewed May 14, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds $PNPM_HOME/bin to the PATH in the four community Dockerfiles so that corepack-installed pnpm binaries are resolvable during Docker builds, mirroring the enterprise fix in makeplane/plane-ee#7150.

Changes:

  • Update PATH in admin, live, space, and web Dockerfiles to include $PNPM_HOME/bin.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
apps/admin/Dockerfile.admin Append $PNPM_HOME/bin to PATH for corepack pnpm resolution.
apps/live/Dockerfile.live Append $PNPM_HOME/bin to PATH for corepack pnpm resolution.
apps/space/Dockerfile.space Append $PNPM_HOME/bin to PATH for corepack pnpm resolution.
apps/web/Dockerfile.web Append $PNPM_HOME/bin to PATH for corepack pnpm resolution.

@sriramveeraghanta sriramveeraghanta merged commit 1dabc63 into canary May 14, 2026
6 checks passed
@sriramveeraghanta sriramveeraghanta deleted the fix/pnpm/path/ci branch May 14, 2026 19:35
eyriehq-admin added a commit to eyriehq/plane-plus that referenced this pull request May 19, 2026
@eyriehq-bot @b-saikrishnakanth
@sriramveeraghanta @anmolsinghbhatia @dependabot @PhuongPN6689 @Saurabhkmr98 @eyriehq-admin
chore(upstream): merge Plane v1.3.1 into Plane Plus (dev/v2.2.0) (#45)
4ef2fe4 
* [WEB-6784] feat scrollbar in shortcuts modal (makeplane#8872)

* fix: update border for project timezone

* feat: added scrollbar in keyboard shortcuts modal

* fix: remove unnecessary changes

* fix: remove redundant overflow

* [WEB-6785] fix: update border for project timezone (makeplane#8870)

* chore: remove Intercom integration and chat support components (makeplane#8875)

Intercom is no longer used. This removes all related frontend components,
hooks, custom events, API config, types, and i18n keys.

* chore: update dependencies (Django, cryptography, axios, lodash) (makeplane#8880)

* chore: update dependencies (Django, cryptography, axios, lodash)

- Django 4.2.29 → 4.2.30
- cryptography 46.0.6 → 46.0.7
- axios 1.13.5 → 1.15.0
- lodash 4.17.23 → 4.18.0

* chore: update lodash from 4.18.0 to 4.18.1

* [WEB-6840] feat: skip role & use-case steps for self-hosted instances (makeplane#8890)

* chore(deps): bump pytest (makeplane#8891)

Bumps the pip group with 1 update in the /apps/api/requirements directory: [pytest](https://github.com/pytest-dev/pytest).


Updates `pytest` from 9.0.2 to 9.0.3
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.2...9.0.3)

---
updated-dependencies:
- dependency-name: pytest
  dependency-version: 9.0.3
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* enhance sub-issue query performance with optimized annotations and subqueries (makeplane#8889)

* fix: enforce workspace membership on V2 asset endpoints (makeplane#8885)

WorkspaceFileAssetEndpoint had no authorization checks beyond
authentication, allowing any logged-in user to create, read, patch,
and delete assets in any workspace by slug. DuplicateAssetEndpoint
only authorized the destination workspace, letting users copy assets
from workspaces they don't belong to.

Add @allow_permission decorators to all WorkspaceFileAssetEndpoint
methods and scope DuplicateAssetEndpoint's source asset lookup to
workspaces where the caller is an active member.

Ref: GHSA-qw87-v5w3-6vxx

* fix: replace IS_SELF_MANAGED with WEBHOOK_ALLOWED_IPS allowlist (makeplane#8884)

* fix: replace IS_SELF_MANAGED toggle with explicit WEBHOOK_ALLOWED_IPS allowlist

Instead of blanket-allowing all private IPs on self-managed deployments,
webhook URL validation now blocks all private/internal IPs by default and
only permits specific networks listed in the WEBHOOK_ALLOWED_IPS env
variable (comma-separated IPs/CIDRs).

* fix: address PR review comments for webhook SSRF protection

- Sanitize error messages to avoid leaking internal details to clients
- Guard against TypeError with mixed IPv4/IPv6 allowlist networks
- Re-validate webhook URL at send time to prevent DNS-rebinding
- Add unit tests for mixed-version IP network allowlists

* [SILO-1158] chore: add context for project in relations API (makeplane#8860)

* add context for project in relations API

* modify issue relation serializer

* fix: sanitize filenames in upload paths to prevent path traversal (makeplane#8879)

* fix: sanitize filenames in upload paths to prevent path traversal (GHSA-v57h-5999-w7xp)

Add server-side filename sanitization across all file upload endpoints
to prevent path traversal sequences (../) in user-supplied filenames
from being incorporated into S3 object keys. While S3 keys are flat
strings and not vulnerable to filesystem traversal, this adds
defense-in-depth and prevents S3 key pollution.

Changes:
- Add sanitize_filename() utility in path_validator.py
- Sanitize filenames in get_upload_path() for FileAsset and IssueAttachment models
- Sanitize name parameter in all upload view endpoints

* fix: address PR review feedback on filename sanitization

- Remove unused `import re`
- Normalize backslashes to forward slashes before os.path.basename()
  so Windows-style paths (e.g. ..\..\..\evil.txt) are handled on POSIX
- Strip whitespace before removing leading dots so " .env" is caught
- Return None instead of "unnamed" for empty input so existing
  `if not name` validation guards remain effective
- Add `or "unnamed"` fallback at call sites that lack a name guard

* fix: use random hex name as fallback in get_upload_path instead of "unnamed"

* fix: resolve ruff E501 line too long in DuplicateAssetEndpoint

* chore(ci): suppress CodeQL file coverage deprecation warning (makeplane#8916)

* chore(ci): suppress CodeQL file coverage deprecation warning

Explicitly opt into the new default behavior where CodeQL skips
computing file coverage information on pull requests for improved
analysis performance.

* Update .github/workflows/codeql.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* chore: update CODEOWNERS for apps and deployments (makeplane#8919)

* chore: update CODEOWNERS for apps and deployments

Assign owners per app/area so reviews are routed to the right
maintainers.

* chore: update the codeowners

* chore: add Claude Code skills for PR descriptions and release notes (makeplane#8920)

* chore: add Claude Code skills for PR descriptions and release notes

* chore(skills): update release-notes branches to canary->master and example version to v1.3.0

* chore(skills): address PR review comments

- pr-description: infer base branch from PR metadata, fix Improvement wording, reference template's screenshot placeholder verbatim
- release-notes: add `text` language to unlabeled fenced code block

* chore: bump up the package version

* chore(deps): bump lxml (makeplane#8925)

Bumps the pip group with 1 update in the /apps/api/requirements directory: [lxml](https://github.com/lxml/lxml).


Updates `lxml` from 6.0.0 to 6.1.0
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.0...lxml-6.1.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump axios, uuid and add security overrides (makeplane#8930)

* chore(deps): bump axios, uuid and add security overrides

Bump axios 1.15.0 → 1.15.2 and uuid 13.0.0 → 14.0.0 in the catalog,
and add pnpm overrides pinning postcss >=8.5.10, follow-redirects
>=1.16.0, and routing axios/uuid through the catalog.

* fix: overrides

* fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets (makeplane#9078)

* fix: add WEBHOOK_ALLOWED_HOSTS allowlist for internal webhook targets

The IP-based allowlist alone isn't practical for containerised deployments
where service IPs are dynamic. Adds a hostname-based bypass for trusted
internal services (e.g. Silo via docker-compose / k8s service DNS) and
makes the previously hardcoded ["plane.so"] domain blocklist configurable
via WEBHOOK_DISALLOWED_DOMAINS.

- validate_url accepts allowed_hosts (exact, case-insensitive match;
  skips DNS lookup for trusted names)
- WebhookSerializer wires both settings through and lets allowlisted
  hosts bypass the disallowed-domain check
- Exposes WEBHOOK_ALLOWED_HOSTS in aio/cli deployment env files

* fix: default WEBHOOK_DISALLOWED_DOMAINS to empty for self-hosted

* fix: pass WEBHOOK_ALLOWED_HOSTS to send-time webhook re-validation

* fix: pnpm path for Docker builds (makeplane#9079)

Add $PNPM_HOME/bin to PATH so corepack-installed pnpm binaries are
resolvable during Docker builds.

* fix(brand): replace upstream Plane logos and copy with Plane Plus in onboarding screens

- not-ready-view.tsx: swap gradient-logo.webp (3D Plane diamond) → EyrieHQ icon;
  "Welcome to Plane" → "Welcome to Plane Plus"
- tour/root.tsx: "Welcome to Plane, {name}" → "Welcome to Plane Plus, {name}";
  copy updated to match
- admin/instance-not-ready.tsx: drop PlaneTakeOffImage → EyrieHQ icon;
  "Welcome aboard Plane!" → "Welcome aboard Plane Plus!"
- admin/new-user-popup.tsx: drop TakeoffIcon SVGs + unused theme imports → EyrieHQ icon;
  "Welcome to Plane instance portal" → "Welcome to Plane Plus"

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: b-saikrishnakanth <130811169+b-saikrishnakanth@users.noreply.github.com>
Co-authored-by: sriram veeraghanta <veeraghanta.sriram@gmail.com>
Co-authored-by: Anmol Singh Bhatia <121005188+anmolsinghbhatia@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Phạm Nguyên Phương <69796528+PhuongPN6689@users.noreply.github.com>
Co-authored-by: Saurabh Kumar <70131915+Saurabhkmr98@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: EyrieHQ <eyriehq@eyriehq.com>
Co-authored-by: Surya <surya@eyriehq.com>
@eyriehq-bot eyriehq-bot Bot mentioned this pull request May 19, 2026
Closed
1 task
eyriehq-admin pushed a commit to eyriehq/plane-plus that referenced this pull request May 19, 2026
@eyriehq-bot
fix(docker): add \$PNPM_HOME/bin to PATH in custom Dockerfiles (#47)
468f4f5 
Upstream fixed this in Dockerfile.admin/web/space/live via makeplane#9079 but our
custom Dockerfile.iw-* variants weren't included in that merge. Same fix:
  ENV PATH="\$PNPM_HOME:\$PNPM_HOME/bin:\$PATH"
Without /bin, corepack-installed pnpm binaries aren't resolvable and
pnpm add -g turbo fails with "global bin directory not in PATH".

Co-authored-by: Surya <surya@eyriehq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@gurusainath gurusainath gurusainath approved these changes

@Palanikannan1437 Palanikannan1437 Awaiting requested review from Palanikannan1437

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sriramveeraghanta @gurusainath