Important security updates
This release addresses various vulnerabilities. Please update to the latest version as soon as you can.
One of the main changes is that scraping from private address (such as your local network) are now forbidden by default. You can override this by setting the IP addresses you wish to scrape from in ALLOWED_IPS. Generally, this is not necessary for nearly anyone running Wishlist.
New features
- The list card got a bit of a refresh
- New error toast will surface when adding an item and the details could not be scraped
- List owners can now edit and remove claims on their items if the "show claims for list owner" is enabled for the group
What's Changed
- pin pnpm by @cmintey in #761
- docs: Update development documenation by @skeletonkey in #743
- feat: list layout — availability/claimed counts, progress bar, hide owner by @skeletonkey in #752
- Translations update from Hosted Weblate by @weblate in #758
- Update packages by @renovate[bot] in #760
- Update actions/setup-node action to v7 by @renovate[bot] in #762
- feat: claim management by @cmintey in #709
- Surface an error when product info can't be scraped by @fmurodov in #770
- Update dependency fuzzysort to v4 by @renovate[bot] in #769
- Update node by @renovate[bot] in #759
- Update packages by @renovate[bot] in #765
- Translations update from Hosted Weblate by @weblate in #767
- Translations update from Hosted Weblate by @weblate in #772
- Translations update from Hosted Weblate by @weblate in #774
- Update packages by @renovate[bot] in #775
- Docs: Replace helm chart with an up-to-date fork in README by @fox1e-dev in #773
- fix: prevent path traversal by @cmintey in #779
- Update pnpm to v12 by @renovate[bot] in #776
- fix: add ssrf protection to external URLs by @cmintey in #783
- Update packages by @renovate[bot] in #780
- Update dependency @types/node to ^24.13.5 by @renovate[bot] in #781
- add additional checks on various APIs by @cmintey in #778
- Translations update from Hosted Weblate by @weblate in #784
- feat: rework list card slightly by @cmintey in #785
- fix(tests): fix list card tests by @cmintey in #786
New Contributors
- @skeletonkey made their first contribution in #743
- @fmurodov made their first contribution in #770
- @fox1e-dev made their first contribution in #773
Full Changelog: v0.66.0...v0.67.0