Fider v0.36.0
⚠️ Security
This release includes several security fixes — upgrading is recommended.
- SSRF hardening — block server-side request forgery via custom OAuth provider Token/Profile URLs.
- XSS fix — prevent potential malicious script execution in rendered content (plus a DOMPurify update).
- Invite scoping — invite-token verification is now scoped to the tenant.
- Pro gating — custom invite copy is restricted to pro tenants.
✨ Features
- Roadmap — a new public roadmap view (pro-only on the cloud instance)
- Self-service board deletion — owners on multi-site instances can schedule deletion of their own board, with a grace period, a cancel link, and a confirmation email.
- Tag administration — improved tag management UI, icons, and styling.
- Tenant description template — a configurable description template in tenant settings.
- SMTP implicit TLS (SMTPS) — optional implicit-TLS / port-465 support for outbound email.
- Longer comments — the comment length limit was raised to 4000 characters (create and edit aligned).
🐛 Fixes & improvements
- Show images placed at the very beginning of post content.
- Append attachments supplied via
POST /api/v1/poststo the end of the post description. - New navigation header: stop notification icons wrapping onto a second row.
- Content-moderation indicator adjustments.
- Corrected "Powered by Fider" version-string formatting.
- Internal fixes:
ToModelhandling, danger-zone copy escaping.
🔧 Upgrade notes
A standard deploy (run migrations + restart) is all that's required.
- Database migrations: 2 new migrations are included — run them as usual (
make migrate). - New optional environment variables (both backward compatible — no action needed unless you want them):
EMAIL_SMTP_ENABLE_IMPLICIT_TLS(defaultfalse) — enable for SMTPS / port 465.STRIPE_UK_VAT_TAX_RATE_ID— hosted billing only; UK VAT is skipped if unset.
- No new background services or workers — the board-deletion cleanup runs as an in-process scheduled job.
🧹 Maintenance
- Dependency and CI/action group updates, lockfile stabilization, and updated translations.
Full changelog: v0.35.0...v0.36.0
New Contributors
- @jeffreyvdhondel made their first contribution in #1564
- @anderslarssonvbg made their first contribution in #1556
- @hungtcs made their first contribution in #1554
Full Changelog: v0.35.0...v0.36.0