🍴🍴🍴🍴🍴🍴
🎉 Highlights
Security Fixes
#6743 fixes two security issues
- A security issue which allows users to access arbitrary system files
- Updates SafeMarkdown to be more aggressive with which HTML attributes we allow
Both security issues required access to Mealie in order to exploit them.
✨ New features
- feat: Optionally include URL when importing via HTML/JSON @michael-genson (#6709)
🐛 Bug fixes
- fix: Disable submit on enter when editing timeline events @michael-genson (#6707)
- fix: Improved bulk deletion by reducing refreshs @davidschinkel (#6634)
- fix: Put tooltips behind app bar @michael-genson (#6711)
- fix: More lenient postgres override parsing @michael-genson (#6712)
- fix: localize text validators message @p0lycarpio (#6719)
- fix: Security Patches @michael-genson (#6743)
🧰 Maintenance
10 changes
- chore(l10n): New Crowdin updates @hay-kot (#6706)
- chore: Miscellaneous cleanup @michael-genson (#6708)
- chore(l10n): New Crowdin updates @hay-kot (#6710)
- chore(l10n): Crowdin locale sync @github-actions (#6716)
- chore(l10n): New Crowdin updates @hay-kot (#6722)
- chore(l10n): New Crowdin updates @hay-kot (#6725)
- chore(auto): Update pre-commit hooks @github-actions (#6724)
- chore(l10n): New Crowdin updates @hay-kot (#6729)
- chore(l10n): New Crowdin updates @hay-kot (#6733)
- chore(l10n): New Crowdin updates @hay-kot (#6736)
⬆️ Dependency updates
8 changes
- fix(deps): update dependency fastapi to v0.124.4 @renovate (#6702)
- fix(deps): update dependency authlib to v1.6.6 @renovate (#6700)
- fix(deps): update dependency tzdata to v2025.3 @renovate (#6713)
- chore(deps): update dependency mypy to v1.19.1 @renovate (#6723)
- chore(deps): update dependency pre-commit to v4.5.1 @renovate (#6734)
- fix(deps): update dependency fastapi to v0.125.0 @renovate (#6740)
- chore(deps): update dependency ruff to v0.14.10 @renovate (#6742)
- fix(deps): update dependency openai to v2.13.0 @renovate (#6726)