TradeTally

v2.6.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Productivity & Wikis

✓ No known CVEs patched

This release patches 1 known CVE

Topics

api journal stocks trading

Affected surfaces

deps breaking_upgrade

Summary

AI summary

Updates Included changes, Verification, and TradeTally v2.6.2 across a mixed release.

Full changelog

Remediated backend dependency vulnerabilities identified during Snyk review by removing vulnerable runtime paths and refreshing the dependency graph.
Replaced runtime Swagger spec generation with a checked-in generated OpenAPI spec artifact to eliminate the vulnerable swagger-jsdoc dependency while keeping /api-docs working.
Removed the unused autocannon dependency from the backend dependency set.
Hardened background schedulers and queue workers so long-lived timers do not block clean shutdown, and removed Jest forceExit now that test teardown is clean.
Bumped backend and frontend versions to 2.6.2 for release detection.
Hardened the marketing unsubscribe flow and added registration copy clarifying marketing email deliverability behavior.
Added unsubscribe-related backend test coverage for controller, service, scheduler, and email behavior.
Included the continuous futures migration repair already present in the patch release range.

Removed the vulnerable `swagger-jsdoc` dependency; runtime Swagger generation replaced with a checked-in OpenAPI spec artifact.

Removed vulnerable runtime paths identified by Snyk, eliminating dependency vulnerabilities.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track TradeTally

Get notified when new releases ship.

About TradeTally

Advanced financial trade tracking and analytics