This release includes 4 security fixes for security teams reviewing exposed deployments.
Published 3mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 4 known CVEs
Topics
api
journal
stocks
trading
Affected surfaces
auth
deps
Summary
AI summaryUpdates What's New, Bug Fixes, and Security & Infrastructure across a mixed release.
Full changelog
What's New
Features
- Behavioral Analytics & Playbook Adherence - Add playbook adherence reviews and behavioral analytics
- TraderVue CSV Import - Import trades from TraderVue CSV exports
- AvaTrade Parser - Add AvaTrade parser and CSV localization layer for non-English exports
- Multiple IBKR Flex Query Connections - Support multiple IBKR Flex Query connections per user
- Partial Exit Analytics - New analytics page for partial exits with min eligible trades filter
- Watchlist 8 Pillars Auto-Analysis - Automatically load and persist 8 Pillars analysis for watchlists
- Guided Onboarding Flow - Add guided onboarding and sample data management
- In-App Support Contact Form - Replace mailto link with in-app support contact form
- Twenty CRM & Invoice Ninja Sync - Add Twenty CRM and Invoice Ninja sync services
- Subscription Management - Add direct cancel and reactivate subscription endpoints
- Account Aliases - Add account aliases to global account filter
- Pro Tier Enforcement - Enforce Pro tier on API keys, webhooks, leaderboards, and partial exits
- Review Request Emails & Testimonials - Add review request email and testimonials system
- Homepage Redesign - Redesign homepage to lead with behavioral analytics
- User Activity Tracking - Add granular user activity tracking for marketing, analytics, and CRM
- Admin Enhancements - Modernize admin analytics with auto-refresh, consolidated cards, and server-side user filtering
- Email Improvements - Add subscription welcome email, tier-tagged support links, email logging, and brand colors
- Unlinked Account Identifiers - Add unlinked account identifiers and sample data endpoints
- Import View Overhaul - Improved UX and expanded broker support
- Active Connections Indicator - Add active connections indicator to platform analytics page
Bug Fixes
- Fix P&L showing $0 in trade detail and sync quick-add accounts
- Preserve execution data on split trades (#283)
- Scope duplicate detection per account during import (#282)
- Prevent groupTrades() from merging separate round-trips of same option
- Correct P&L calculation for commission rebates and execution consistency
- Use exact trade P&L in calendar view when all exits are on same date
- Sanitize Alpha Vantage "None" strings in dividend date fields
- Same-day Schwab sync returning 0 transactions (#274)
- Merge duplicate open positions caused by incomplete option metadata (#266)
- Reduce import page load time for faster file picker response (#259)
- Repair 2FA login broken by auth hardening
- Improve import UX, OAuth feedback, checkout error handling, and billing button visibility
- Dynamically generate dashboard month filter options
- Auto-login for new accounts
Security & Infrastructure
- Harden auth, webhooks, billing, and logging
- Address security scan findings across frontend and backend
- Harden backup file handling
- Remove stale analytics integration, replaced by PostHog
- Restore multi-arch Docker builds (amd64 + arm64)
- Pin Docker base image to alpine3.21 to resolve zlib vulnerabilities
- Add release automation workflows
- Reduce prod API error noise
- Bump GitHub Actions to latest versions
Full Changelog
https://github.com/GeneBO98/tradetally/compare/v2.2.1...v2.3.0
Breaking Changes
- Remove stale analytics integration (replaced by PostHog)
- Pin Docker base image to alpine3.21 (requires compatible runtime)
Security Fixes
- Harden auth, webhooks, billing, and logging
- Address security scan findings across frontend and backend
- Harden backup file handling
- Pin Docker base image to alpine3.21 to resolve zlib vulnerabilities
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]