Skip to content

Heimdall

v2.8.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 17d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

application-dashboard bookmark couchpotato web emby heimdall
+14 more
homepage htpc landing landingpage muximux nginx nzbget organizr plex radarr sabnzbd server sonarr startpage

Affected surfaces

auth deps

ReleasePort's take

Moderate signal
editorial:auto 10d

The release hardens against host header injection and open redirect (CVE‑2025‑50578) while requiring PHP 8.4.

Why it matters: CVE‑2025‑50578 is a high‑severity vulnerability; upgrading to this release and adopting PHP 8.4 mitigates the risk immediately.

Summary

AI summary

Harden against host header injection and open redirect (CVE-2025-50578) and require PHP 8.4.

Changes in this release

Security Critical

Harden against host header injection and open redirect (CVE-2025-50578)

Harden against host header injection and open redirect (CVE-2025-50578)

Source: llm_adapter@2026-07-16

Confidence: high

 —
Breaking High

Upgrade to Laravel 13 and bump version to v2.8.0

Upgrade to Laravel 13 and bump version to v2.8.0

Source: llm_adapter@2026-07-16

Confidence: low

 —
Feature Low

Add autocomplete suggestions support

Add autocomplete suggestions support

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Low

Include tags in item export and restore them on import

Include tags in item export and restore them on import

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Low

Add configurable default tag for the dashboard

Add configurable default tag for the dashboard

Source: llm_adapter@2026-07-16

Confidence: high

 —
Dependency High

Require PHP 8.4 and update security‑flagged dependencies

Require PHP 8.4 and update security‑flagged dependencies

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Return graceful output from get_stats instead of a 500 error

Return graceful output from get_stats instead of a 500 error

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Fix disappearing tiles issue

Fix disappearing tiles issue

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Fix tag list URL when tags are treated as tags

Fix tag list URL when tags are treated as tags

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Medium

Remove search provider dropdown when only one provider exists

Remove search provider dropdown when only one provider exists

Source: llm_adapter@2026-07-16

Confidence: high

 —
Full changelog

What's Changed

  • Fix tag list url when tags are treated as tags by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1507
  • Add autocomplete suggestions support by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1523
  • Remove search provider dropdown when there's only a single provider by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1524
  • fix: proxy options in ItemController by @Nyuwb in https://github.com/linuxserver/Heimdall/pull/1563
  • [2.x] Bound retry and unique-lock lifetimes on UpdateApps and ProcessApps by @JoshSalway in https://github.com/linuxserver/Heimdall/pull/1559
  • Fix CI: pin Node 24 and install frontend deps with npm ci by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1571
  • Return graceful output from get_stats instead of a 500 by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1570
  • Harden against host header injection and open redirect (CVE-2025-50578) by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1568
  • Include tags in item export and restore them on import by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1567
  • Add a configurable default tag for the dashboard by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1572
  • Update security-flagged dependencies and require PHP 8.4 (#1564) by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1569
  • Upgrade to Laravel 13, bump to v2.8.0, and remediate vulnerabilities by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1574
  • Fix to try and mitigate any disappearing tiles by @KodeStar in https://github.com/linuxserver/Heimdall/pull/1575

New Contributors

  • @JoshSalway made their first contribution in https://github.com/linuxserver/Heimdall/pull/1559

Full Changelog: https://github.com/linuxserver/Heimdall/compare/v2.7.6...v2.8.0

Breaking Changes

  • Minimum required runtime: PHP 8.4

Security Fixes

  • CVE-2025-50578 — Harden against host header injection and open redirect
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Heimdall

Get notified when new releases ship.

Sign up free

About Heimdall

An Application dashboard and launcher

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]