Curated summary: CHANGELOG.md
Security
Dependency bumps to resolve upstream advisories; none reachable from a running server (see Notes for checks done).
| Package | Version | Advisory | Notes |
|---|---|---|---|
anyio
| 4.14.2 | CVE-2026-63374, CVE-2026-64847 | TLS client and process-pool code aren't used |
urllib3
| 2.8.0 | CVE-2026-97687, CVE-2026-97688, CVE-2026-97689 | A compromised download host could hang a build |
fsspec
| 2026.9.0 | CVE-2026-104851 | reference:// filesystem isn't used here
|
setuptools
| 84.2.1 | GHSA-xmj3-9gf7-h52w | uv lockfile would reject any tampered wheels |
nltk
| 3.10.4 | GHSA-j456-xh4h-cpf2 | Weka classifier isn't used here |
certifi and filelock also bumped.
What's Changed
- build(deps): bump the actions group with 4 updates by @dependabot[bot] in #541
- docs: point the Zotero-TTS link at its new name, Zotero-OpenReader by @xujialiu in #544
- fix(inference): free MPS memory between requests by @chowes in #547
- fix: deepwiki badge by @remsky in #548
- Added Home Assistant app link under the Community section of the README by @YaannnTech in #549
- Fix startup URL showing default port instead of configured port by @Christian-Sidak in #546
- fix(web): preserve IME input in voice-tag controls by @abaichuan1017 in #550
- fix(web): keep find/replace out of IME composition by @bfs2021 in #557
New Contributors
- @xujialiu made their first contribution in #544
- @chowes made their first contribution in #547
- @YaannnTech made their first contribution in #549
- @abaichuan1017 made their first contribution in #550
- @bfs2021 made their first contribution in #557
Full Changelog: v0.9.0...v0.9.1