Summary
This release fixes critical security issues and adds an ingredient catalogue that drives pantry matching, nutrition, icons and unit conversion
Warning
Back up before updating. On first start Norish builds the ingredient catalogue and links your existing recipe, grocery and pantry ingredients to it. Back up your PostgreSQL database and your uploads folder.
Security
- Better Auth: an account could be taken over by signing up with a password using someone's email before that person signed in with OIDC, Google or GitHub (GHSA-g38m-r43w-p2q7). Password accounts can no longer start signing in with SSO under the same email; linking from user settings is coming. #623
- Next.js: fixes unauthenticated code execution through image optimization (GHSA-2xp9-vwfh-vxw4). Norish doesn't use this feature, so it was mostly unaffected. #623
- Container: the image now runs a current Node 22 on a supported Alpine.
Highlights
- Ingredient catalogue based on Open Food Facts: browse, edit, merge and group ingredients under Settings => Ingredients, with AI help to tidy them up.
- Nutrition without AI: calories, fat, carbs and protein per serving are calculated from CIQUAL, USDA and CoFID. AI only fills in what can't be calculated.
- Smarter pantry matching across names and languages, and the Pantry is now its own page.
- Ingredient icons (optional) and unit conversion without AI.
- 🇺🇦 Ukrainian language support.
Good to know
- Preferences are now stored on the server, per device type. Existing preferences are reset once after updating.
- API docs moved from
/api/docson your server to the API reference. - If your compose file sets
user: "1000:1000", remove that line. Norish now makes the uploads folder writable itself. - New optional env vars:
INGREDIENT_CATALOGUE_URL,INGREDIENT_REVIEW_CONCURRENCY,OBSCURA_NAVIGATION_TIMEOUT_MS. The catalogue needs no configuration.
Thanks to all contributors @zombopanda @skolodziej @AfoxDesignz
Full release notes: https://docs.norish.dev/release-notes/0.25.0-beta