Skip to content

TradeTally

v2.3.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 3mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

api journal stocks trading

Affected surfaces

auth deps

Summary

AI summary

Updates What's New, Bug Fixes, and Security & Infrastructure across a mixed release.

Full changelog

What's New

Features

  • Behavioral Analytics & Playbook Adherence - Add playbook adherence reviews and behavioral analytics
  • TraderVue CSV Import - Import trades from TraderVue CSV exports
  • AvaTrade Parser - Add AvaTrade parser and CSV localization layer for non-English exports
  • Multiple IBKR Flex Query Connections - Support multiple IBKR Flex Query connections per user
  • Partial Exit Analytics - New analytics page for partial exits with min eligible trades filter
  • Watchlist 8 Pillars Auto-Analysis - Automatically load and persist 8 Pillars analysis for watchlists
  • Guided Onboarding Flow - Add guided onboarding and sample data management
  • In-App Support Contact Form - Replace mailto link with in-app support contact form
  • Twenty CRM & Invoice Ninja Sync - Add Twenty CRM and Invoice Ninja sync services
  • Subscription Management - Add direct cancel and reactivate subscription endpoints
  • Account Aliases - Add account aliases to global account filter
  • Pro Tier Enforcement - Enforce Pro tier on API keys, webhooks, leaderboards, and partial exits
  • Review Request Emails & Testimonials - Add review request email and testimonials system
  • Homepage Redesign - Redesign homepage to lead with behavioral analytics
  • User Activity Tracking - Add granular user activity tracking for marketing, analytics, and CRM
  • Admin Enhancements - Modernize admin analytics with auto-refresh, consolidated cards, and server-side user filtering
  • Email Improvements - Add subscription welcome email, tier-tagged support links, email logging, and brand colors
  • Unlinked Account Identifiers - Add unlinked account identifiers and sample data endpoints
  • Import View Overhaul - Improved UX and expanded broker support
  • Active Connections Indicator - Add active connections indicator to platform analytics page

Bug Fixes

  • Fix P&L showing $0 in trade detail and sync quick-add accounts
  • Preserve execution data on split trades (#283)
  • Scope duplicate detection per account during import (#282)
  • Prevent groupTrades() from merging separate round-trips of same option
  • Correct P&L calculation for commission rebates and execution consistency
  • Use exact trade P&L in calendar view when all exits are on same date
  • Sanitize Alpha Vantage "None" strings in dividend date fields
  • Same-day Schwab sync returning 0 transactions (#274)
  • Merge duplicate open positions caused by incomplete option metadata (#266)
  • Reduce import page load time for faster file picker response (#259)
  • Repair 2FA login broken by auth hardening
  • Improve import UX, OAuth feedback, checkout error handling, and billing button visibility
  • Dynamically generate dashboard month filter options
  • Auto-login for new accounts

Security & Infrastructure

  • Harden auth, webhooks, billing, and logging
  • Address security scan findings across frontend and backend
  • Harden backup file handling
  • Remove stale analytics integration, replaced by PostHog
  • Restore multi-arch Docker builds (amd64 + arm64)
  • Pin Docker base image to alpine3.21 to resolve zlib vulnerabilities
  • Add release automation workflows
  • Reduce prod API error noise
  • Bump GitHub Actions to latest versions

Full Changelog

https://github.com/GeneBO98/tradetally/compare/v2.2.1...v2.3.0

Breaking Changes

  • Remove stale analytics integration (replaced by PostHog)
  • Pin Docker base image to alpine3.21 (requires compatible runtime)

Security Fixes

  • Harden auth, webhooks, billing, and logging
  • Address security scan findings across frontend and backend
  • Harden backup file handling
  • Pin Docker base image to alpine3.21 to resolve zlib vulnerabilities

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TradeTally

Get notified when new releases ship.

Sign up free

About TradeTally

Advanced financial trade tracking and analytics

All releases →

Related context

Beta — feedback welcome: [email protected]