shaarli/Shaarli v0.16.4

on GitHub

v0.16.4 - 2026-07-31

Security

• prevent /admin/metadata endpoint from fetching metadata from private/reserved IPs (SSRF), including through redirects or DNS rebinding, require CSRF token
• fix stored XSS via general.header_link configuration value, sanitize against javascript: URIs
• update npm dependencies

Fixed

• fix nullable type deprecation warnings from PHP 8.4

Changed

• refactor Docker documentation

Full Changelog: v0.16.3...v0.16.4