habitica

v5.48.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 10d Productivity & Wikis

✓ No known CVEs patched

This release patches 1 known CVE

Topics

css express habitica html javascript mongodb

+3 more

nodejs vue vuejs

Summary

AI summary

Updates Client, API, and @SabreCat across a mixed release.

Type	Severity	Summary	CVE
Feature	Medium	Can now access Gem gifting via username lookup Can now access Gem gifting via username lookup Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Overhaul of HTML strings to use variable interpolation instead of hardcoding URLs Overhaul of HTML strings to use variable interpolation instead of hardcoding URLs Source: llm_adapter@2026-07-16 Confidence: high	—
Bugfix	Medium	Don't trigger "leaving Habitica" warning for mailto links Don't trigger "leaving Habitica" warning for mailto links Source: llm_adapter@2026-07-16 Confidence: high	—

Full changelog

Feature: Can now access Gem gifting via lookup of a username (@Hafizzle)
Fix: Overhaul of HTML strings across site to avoid hardcoding URLs in translated text, preferring variable interpolation, for security and futureproofing (@SabreCat)
Fix: Don't trip "leaving Habitica" external site warning for mailto links (@SabreCat)

Overhauled HTML strings to avoid hard‑coded URLs, mitigating potential injection risks

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track habitica

Get notified when new releases ship.

About habitica

A habit tracker app which treats your goals like a Role Playing Game.