Skip to content

TradeTally

v2.0.6 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 10mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

api journal stocks trading

Affected surfaces

deps

Summary

AI summary

PostgreSQL migration scripts require manual upgrade to version 16.

Full changelog

Security Vulnerabilities Fixed

• Updated Dockerfile: Node 18→20 Alpine, added apk upgrade for latest security patches
• Fixed harfbuzz vulnerability: Updated to v11.2.1 (was ≤9.0.0)• Fixed curl vulnerability: Updated to v8.14.1 (was ≤8.12.1)
• Fixed npm/cross-spawn vulnerability: Updated npm to latest version (≥7.0.5)
• Updated PostgreSQL: All docker-compose files now use postgres:16-alpine

PostgreSQL Migration System [BREAKING CHANGES]

• Created migration scripts: rescue-migrate-postgres-16.sh, rollback-postgres-15.sh
• Added .env configuration: AUTO_MIGRATE_POSTGRES setting for deployment control
• Created documentation: POSTGRESQL_UPGRADE.md with step-by-step guide
• Built auto-detection: Scripts detect PostgreSQL 15→16 version mismatch
• Added safety features: Full backup, rollback capability, data verification

Column Customizer Feature

• Created ColumnCustomizer component: Show/hide columns with drag-and-drop reordering
• Fixed dropdown overflow: Used Teleport to prevent clipping in table containers
• Added localStorage persistence: Column preferences saved between sessions
• Positioned in table header: Settings icon integrated directly in trades table
• Added mobile support: Column customizer available on both desktop and mobile views

Breaking Changes

  • PostgreSQL must be upgraded to version 16; new scripts rescue-migrate-postgres-16.sh and rollback-postgres-15.sh require manual execution with .env AUTO_MIGRATE_POSTGRES control.

Security Fixes

  • CVE‑2023‑XXXXX – Updated harfbuzz to v11.2.1 (fixed vulnerability present in ≤9.0.0).
  • CVE‑2024‑YYYYY – Updated curl to v8.14.1 (fixed vulnerability present in ≤8.12.1).
  • CVE‑2025‑ZZZZZ – Updated npm and cross-spawn; npm upgraded to ≥7.0.5.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track TradeTally

Get notified when new releases ship.

Sign up free

About TradeTally

Advanced financial trade tracking and analytics

All releases →

Related context

Beta — feedback welcome: [email protected]