Skip to content

homarr

v1.70.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

web docker organization privacy selfhosting servarr

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 11d

Release v1.70.0 updates the undici dependency to version 7.28.0 to fix a security vulnerability.

Why it matters: Undici upgraded from prior versions to 7.28.0 resolves a high‑severity (90) security issue; operators should apply this update promptly.

Summary

AI summary

Broad release touches 1.70.0, deps, chore, and fix.

Changes in this release

Security Critical

Updates dependency undici to v7.28.0, addressing a security vulnerability.

Updates dependency undici to v7.28.0, addressing a security vulnerability.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds Synology integration for health and system monitoring.

Adds Synology integration for health and system monitoring.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds Traefik integration with dedicated widget and optional icons for Gotify notification widget.

Adds Traefik integration with dedicated widget and optional icons for Gotify notification widget.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds Bazarr integration and subtitle status widget.

Adds Bazarr integration and subtitle status widget.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds PatchMon integration and widget.

Adds PatchMon integration and widget.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds per-filesystem storage chart to Beszel system stats widget.

Adds per-filesystem storage chart to Beszel system stats widget.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds missing & queued media widget for Radarr and Sonarr.

Adds missing & queued media widget for Radarr and Sonarr.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes infinite render loop in AppForm on edit page.

Fixes infinite render loop in AppForm on edit page.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes Docker CPU usage reporting to show current usage instead of lifetime average.

Fixes Docker CPU usage reporting to show current usage instead of lifetime average.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes QBittorrent handling of stopped torrent states for pause functionality.

Fixes QBittorrent handling of stopped torrent states for pause functionality.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

1.70.0 (2026-07-10)

What's Changed

  • chore(deps): update dependency posthog-js to ^1.396.1 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6183
  • chore(deps): update testcontainers-node monorepo to ^12.0.4 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6185
  • fix(deps): update tailwindcss monorepo to ^4.3.2 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6190
  • fix(widget-secrets): add missing widget_secret migration and add error notifications by @ajnart in https://github.com/homarr-labs/homarr/pull/6192
  • chore(deps): update dependency posthog-js to ^1.396.2 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6189
  • chore(deps): update dependency undici to v7.28.0 [security] by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6188
  • chore(lang): updated translations from crowdin by @homarr-crowdin[bot] in https://github.com/homarr-labs/homarr/pull/6195
  • chore(lang): updated translations from crowdin by @homarr-crowdin[bot] in https://github.com/homarr-labs/homarr/pull/6216
  • fix(forms): break AppForm infinite render loop on edit page (#6198) by @ajnart in https://github.com/homarr-labs/homarr/pull/6215
  • chore(deps): mega dependency update by @ajnart in https://github.com/homarr-labs/homarr/pull/6212
  • fix(layout): raise AppShellHeader z-index above Indicator dots by @ajnart in https://github.com/homarr-labs/homarr/pull/6218
  • chore: update bug report template by @homarr-releases[bot] in https://github.com/homarr-labs/homarr/pull/6181
  • fix(docs): fix docs build — MDX acorn error and CSS @import ordering by @ajnart in https://github.com/homarr-labs/homarr/pull/6217
  • fix: fix pnpm lockfile by @ajnart in https://github.com/homarr-labs/homarr/pull/6220
  • fix(deps): revert typescript from 7.0.1-rc to ^6.0.3 by @ajnart in https://github.com/homarr-labs/homarr/pull/6221
  • chore(deps): update dependency conventional-changelog-conventionalcommits to ^10.2.0 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6222
  • chore(deps): update dependency cookie to v2.0.1 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6223
  • chore(deps): update dependency posthog-node to ^5.39.2 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6226
  • chore(deps): update dependency @semantic-release/github to ^12.0.9 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6231
  • chore(deps): update dependency lucide-react to ^1.23.0 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6225
  • chore(deps): update dependency posthog-js to ^1.396.4 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6232
  • chore(deps): update nextjs monorepo to v16.2.10 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6238
  • chore(deps): update dependency vite@>=5.0.0 <=5.4.18 to >=8.1.3 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6242
  • ci: skip lint-format-autofix on fork PRs by @tvervest in https://github.com/homarr-labs/homarr/pull/6237
  • feat(demo): allow mutations in demo mode via DEMO_READ_ONLY flag by @ajnart in https://github.com/homarr-labs/homarr/pull/6224
  • fix(query-cache): guard against undefined from superjson.parse on legacy cache entries by @ajnart in https://github.com/homarr-labs/homarr/pull/6228
  • chore(deps): update dependency @scalar/api-reference-react to ^0.9.51 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6243
  • fix(integrations): accept gluetun-latest VPN settings payload by @tvervest in https://github.com/homarr-labs/homarr/pull/6149
  • fix: context menu refresh stays open with loading spinner, cache age reacts to refetch by @ajnart in https://github.com/homarr-labs/homarr/pull/6245
  • feat: add Synology integration support for health/system monitoring by @mrjoshuap in https://github.com/homarr-labs/homarr/pull/6121
  • chore(deps): update dependency @immich/sdk to ^3.0.1 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6251
  • chore(deps): update pnpm to v11.10.0 by @homarr-renovate[bot] in https://github.com/homarr-labs/homarr/pull/6265
  • fix(integrations): sort media requests by last modified instead of creation date by @ajnart in https://github.com/homarr-labs/homarr/pull/6264
  • feat: Add Traefik Integration with dedicated widget and Add optional Icons for Gotify/Notifcation Widget (ONLY GOTIFY) by @Nerdy-Technician in https://github.com/homarr-labs/homarr/pull/6206
  • fix(docker): report current CPU usage instead of the lifetime average by @junkerderprovinz in https://github.com/homarr-labs/homarr/pull/6249
  • fix(qbittorrent): handle v5 stopped torrent states for pause functionality by @ajnart in https://github.com/homarr-labs/homarr/pull/6211
  • feat(widgets): add per-filesystem storage chart to Beszel system stats by @ajnart in https://github.com/homarr-labs/homarr/pull/6209
  • fix(beszel): disable request handler cache for stats to make live mode work by @ajnart in https://github.com/homarr-labs/homarr/pull/6244
  • fix: prevent stale persisted query cache from blocking widget data by @ajnart in https://github.com/homarr-labs/homarr/pull/6273
  • feat(api): expose board automation endpoints by @ajnart in https://github.com/homarr-labs/homarr/pull/6213
  • fix: add utf8 email validation support by @Euclid0192 in https://github.com/homarr-labs/homarr/pull/6239
  • feat: add Bazarr integration and subtitle status widget by @Ayush7614 in https://github.com/homarr-labs/homarr/pull/6156
  • chore: update contributors by @homarr-update-contributors[bot] in https://github.com/homarr-labs/homarr/pull/6272
  • chore: update integrations list readme by @homarr-update-contributors[bot] in https://github.com/homarr-labs/homarr/pull/6258
  • chore(lang): updated translations from crowdin by @homarr-crowdin[bot] in https://github.com/homarr-labs/homarr/pull/6240
  • feat(widgets): add missing & queued media widget for Radarr and Sonarr by @xanyl in https://github.com/homarr-labs/homarr/pull/6078
  • Update Helm chart documentation by @homarr-charts-docs-sync[bot] in https://github.com/homarr-labs/homarr/pull/6261
  • fix(beszel): disable request handler cache by @ajnart in https://github.com/homarr-labs/homarr/pull/6274
  • feat(integrations): add PatchMon integration and widget by @mrjoshuap in https://github.com/homarr-labs/homarr/pull/6119
  • chore: update integrations list readme by @homarr-update-contributors[bot] in https://github.com/homarr-labs/homarr/pull/6275
  • fix(releases): token not applied due to broken allowedRepoIds check by @ajnart in https://github.com/homarr-labs/homarr/pull/6276
  • fix(request-handler): restore media organizer build by @ajnart in https://github.com/homarr-labs/homarr/pull/6277
  • chore(release): automatic release v1.70.0 by @github-actions[bot] in https://github.com/homarr-labs/homarr/pull/6278
  • fix(release): repair v1.70.0 quality failures by @ajnart in https://github.com/homarr-labs/homarr/pull/6279
  • chore(release): automatic release v1.70.0 by @ajnart in https://github.com/homarr-labs/homarr/pull/6280

New Contributors

  • @tvervest made their first contribution in https://github.com/homarr-labs/homarr/pull/6237
  • @mrjoshuap made their first contribution in https://github.com/homarr-labs/homarr/pull/6121
  • @junkerderprovinz made their first contribution in https://github.com/homarr-labs/homarr/pull/6249
  • @Euclid0192 made their first contribution in https://github.com/homarr-labs/homarr/pull/6239
  • @Ayush7614 made their first contribution in https://github.com/homarr-labs/homarr/pull/6156
  • @xanyl made their first contribution in https://github.com/homarr-labs/homarr/pull/6078

Full Changelog: https://github.com/homarr-labs/homarr/compare/v1.69.2...v1.70.0

Security Fixes

  • chore(deps): update dependency undici to v7.28.0 [security]
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track homarr

Get notified when new releases ship.

Sign up free

About homarr

A modern and easy to use dashboard. 40+ integrations. 10K+ icons built in. Authentication out of the box. No YAML, drag and drop configuration.

All releases →

Related context

Beta — feedback welcome: [email protected]