Skip to content

TradeTally

v2.2.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 5mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

api journal stocks trading

Affected surfaces

auth deps

Summary

AI summary

Updates Bug Fixes, New Features, and Performance & Infrastructure across a mixed release.

Full changelog

New Features

  • Tastytrade CSV Parser - Full support for importing trades from Tastytrade, including correct average price calculation (divides out multiplier for options)
  • TradingView Parser Improvements - Case-insensitive header matching, handles missing Closing Time field, support for TradingView Performance and Paper trading exports
  • TradeStation Support - Added CSV parser for TradeStation exports
  • Persistent Historical Price Cache - New historical_prices database table stores all fetched OHLCV data permanently. Alpha Vantage chart requests now check DB before calling the API, dramatically reducing usage of the 25 calls/day free tier limit. Finnhub quotes, crypto quotes, and the price monitoring service all persist prices to this cache automatically
  • Price-First Position Quotes - Open positions and holdings now read from the price_monitoring cache (updated every 30 seconds) before hitting Finnhub, significantly reducing API calls
  • Deferred Email Verification - New users get a 7-day grace period before email verification is enforced, simplifying the registration flow
  • Email Template Redesign - Modern minimal email templates with consistent branding
  • Email Unsubscribe - Users can now unsubscribe from email communications directly from email links
  • Import Help UX - When a supported broker import returns 0 trades, a "Need Help?" section appears with links to documentation and a pre-filled support ticket
  • Charts on Trade Creation - Support for adding charts and images to trades during creation (not just after)
  • Manual Premium Input for Open Options - Auto-calculated P&L is hidden for open options; users can input manual premium instead
  • Dockerignore - Added .dockerignore file for faster, smaller Docker builds

Bug Fixes

  • Fixed CUSIP queue race condition causing duplicate processing
  • Fixed IBKR partial exit trades creating mixed execution format
  • Fixed missing side field for IBKR partial-close executions in edit form
  • Fixed missing entryTime in partial-close executions across all parsers
  • Fixed IBKR broker sync CSV parser issues
  • Fixed TradingView parser failing on case-sensitive headers
  • Fixed trade filters defaulting incorrectly (now defaults to All Time) and active filter count
  • Fixed journal calendar date handling and Tastytrade date parsing
  • Fixed back button reliability and date dropdown element on dashboard
  • Fixed JWT user lookup in flexibleAuth middleware
  • Fixed registration validation and password placeholder display
  • Fixed AI provider configuration for OpenAI
  • Fixed update-native.sh compatibility with sh and working directory
  • Resolved npm dependency vulnerabilities via overrides

Performance & Infrastructure

  • Analytics Performance Indexes - New database indexes for faster analytics queries
  • Trade Dropdown Optimization - Switched trade dropdown functions to reduce page load times
  • Frontend Performance - Multiple rounds of performance improvements across views
  • Removed Unused Finnhub Methods - Cleaned up dead API code
  • Repository Cleanup - Moved scripts to scripts/ directory, removed stale utility files, deleted legacy migration scripts and test data
  • SEO Improvements - Updated meta tags, sitemap, robots.txt, and public-facing pages
  • Docker CI Workflow - Refactored for clearer branch/tag build triggers (develop -> nightly, main -> latest, tags -> versioned)

Security

  • Secret Handling Hardened - Sensitive values are now redacted in all logging output
  • API Key Auth on Trade Endpoints - Main trade endpoints now accept API key authentication
  • Dependency Updates - Express 4.22.0 -> 4.22.1, Vue 3.5.26 -> 3.5.27, plus frontend/backend vulnerability fixes

UI/UX

  • Public Pages Overhaul - Redesigned landing, features, pricing, and FAQ pages
  • Frontend Design Updates - Refreshed styling across multiple views
  • Dashboard Improvements - Better layout and date dropdown behavior

Migration Notes

  • Run npm run migrate to create the new historical_prices and analytics index tables
  • No breaking API changes
  • Docker image: potentialmidas/tradetally:2.2.0 (pinned) or potentialmidas/tradetally:latest

Security Fixes

  • Secret handling hardened – sensitive values redacted in all logs
  • API key authentication added to main trade endpoints
  • Dependency updates (Express 4.22.1, Vue 3.5.27) including vulnerability fixes

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TradeTally

Get notified when new releases ship.

Sign up free

About TradeTally

Advanced financial trade tracking and analytics

All releases →

Related context

Beta — feedback welcome: [email protected]