🍴🍴🍴🍴🍴🍴

Welcome to the latest release of Mealie! We have tons of new features packed into this one, as well as a large collection of bug fixes. Check them out below 👇

🚨 BREAKING CHANGE

Mealie now checks where its own outgoing requests are going. Anything the server fetches on your behalf, such as importing a recipe from a URL, downloading a recipe image, sending a webhook, or running a recipe action, is only allowed to reach addresses on the public internet.

Webhooks and recipe actions were not checked before, and the checks on recipe imports were narrower than they are now. If any of these pointed at something on your own network, they will stop working after this update.

If you need a target on your own network to keep working, allow it explicitly with HTTP_ALLOW_LIST, which accepts hostnames or CIDRs. To keep a Tailscale host reachable, for example:

HTTP_ALLOW_LIST=100.64.0.0/10

For more information, check out the docs and the in-app announcement.

🎉 Highlights

You can now add substitutions to your ingredients. We support two kinds of substitutions:

Recipe-specific substitutions:

Common substitutions (not tied to specific recipe, edited on the data management page):

Substitutions are (optionally) considered in the recipe finder, too!

You can now link recipe notes to individual steps:

🚨 Breaking changes

• fix: harden server-initiated HTTP against SSRF and DNS rebinding @hay-kot (#7914)

✨ New features

• feat: use OIDC avatars @doenke (#7624)
• feat: Bottom sheets @miah120 (#7939)
• feat: ingredient substitutions @michael-genson (#8265)
• feat: adjust ingredient spacing @michael-genson (#8318)
• feat: pluralize substitutions if main ingredient is pluralized @michael-genson (#8317)
• feat: filter meal plan rules by food label @Xyolyp (#8126)
• feat: add recipe note linking to recipe instructions @jallier (#7591)
• feat: Show calendar hint when adding to meal plan @miah120 (#8274)

🐛 Bug fixes

• fix: shopping list entry fixes @michael-genson (#8280)
• fix: QueryFilter improvements @p0lycarpio (#8281)
• fix: cascade group deletion to households and recipes @derekdiliu (#8283)
• fix: correct MultiPurposeLabel.foods/shopping_list_items relationship cardinality @bferd (#8226)
• fix: update bulk add dialog translations on locale change @feilongcheng (#8097)
• fix: prevent OpenAI ingredient parser from splitting plus quantities @roastedTomato (#8138)
• fix: harden server-initiated HTTP against SSRF and DNS rebinding @hay-kot (#7914)
• fix: harden public filtering @michael-genson (#8286)
• fix: show progress on ingredient parser review buttons @Xyolyp (#8172)
• fix: import Recipe Keeper categories and yields @henry1113nz (#8299)
• fix: Allow submenus to be accessed via keyboard and mobile @miah120 (#8300)
• fix: coerce null food/unit description to empty string @chiliec (#8309)
• fix: filter related fields with EXISTS instead of joins @derekdiliu (#8297)
• fix: substitution recipe ref handling @michael-genson (#8311)
• fix: inconsistent token usage @michael-genson (#8314)
• fix: fix missing images / keep recipes.image in sync with the images on disk @ImanuelBertrand (#8276)
• fix: ignore blank Paprika ingredient lines @justadityaraj (#8213)
• fix: ingredient note spacing with swap icon @michael-genson (#8315)
• fix: pin pnpm version for corepack @roastedTomato (#8322)
• fix: prevent random sort click-through @YibingZhang325 (#8325)
• fix: update recipe creation page translations on locale change @feilongcheng (#8273)
• fix: wrap long URLs in recipe card descriptions @feilongcheng (#8330)
• fix: auto_init merges model_config.exclude with default {"id"} instead of replacing it @blue-mtn-dog (#8336)
• fix: fix notifier UI form reactivity @michael-genson (#8341)
• fix: preserve recipe ingredient navigation state @roastedTomato (#8323)
• fix: apply a submitted API key when updating an AI provider @adman234 (#8344)
• fix: remove stacked variant on number inputs @p0lycarpio (#8359)
• fix: prevent creating shopping lists with empty names and disable submit button @Luna-81 (#8363)
• fix: aggregate to-many orderings instead of joining @derekdiliu (#8332)
• fix: don't default to the English-only parser in other languages @Xyolyp (#8173)
• fix: return a 422 instead of a 500 when a recipe PUT omits the name @henry1113nz (#8298)
• fix: rescue markdown-fenced responses when a provider ignores strict schema output @lcs-crr (#8133)
• fix: Show permission error ,when food creation fails @Luna-81 (#8370)
• fix: webhooks dont fire around midnight @michael-genson (#8379)
• fix: Add permission checks for Group & Household members, hide totalUsers card for non-managers @Luna-81 (#8348)

🧰 Maintenance

📚 Documentation

• docs: clarify secondary theme color usage @nzyz995 (#8310)

🔨 Internal development

• dev: add docker-in-docker to dev container @michael-genson (#8303)
• dev: publish more logs for OIDC E2E error @michael-genson (#8313)

⬆️ Dependency updates

🙏 New Contributors

• @doenke made their first contribution in #7624
• @roastedTomato made their first contribution in #8138
• @Xyolyp made their first contribution in #8172
• @svathsa21 made their first contribution in #8296
• @blue-mtn-dog made their first contribution in #8336
• @adman234 made their first contribution in #8344
• @jallier made their first contribution in #7591

🍴🍴🍴🍴🍴🍴