Skip to content

ryot

v10.3.16 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

exercise-tracker fitness-tracker integrations media-tracking tracker

Affected surfaces

auth

Summary

AI summary

Broad release touches http://github.com/IgnisDa/ryot/commit/51d9484aa4f7455e92d22593c36a0bab793840aa, http://github.com/IgnisDa/ryot/commit/957981ebe5e417bd7f2a2fb7101f7e87d4cdd194, http://github.com/IgnisDa/ryot/commit/0ae7a792ae7d3c058c7aa9f55f2dca2fb2ebe36d, and http://github.com/IgnisDa/ryot/commit/009b65468ffbb8e07e77ce0fcd395984be3c543f.

Full changelog

What's Changed

  • 51d9484aa - Trakt import aborts on a collection item with all-null ids (#1785)
  • 957981ebe - Fix suggestion links never getting inserted (#1778)
  • 0ae7a792a - chore: delete metadata suggestions before committing them
  • 009b65468 - Make green glow only in calendar (#1772)
  • 963907764 - Fix non-shows watched glow in Calendar (#1770)
  • 961b40215 - refactor: remove httpOnly and secure flags from twoFactorSessionStorage cookie
  • ae9d02d29 - Get Jellyfin Sink working with TVDB (#1767)
  • 86e35975f - Quality: Sensitive data logging in production (#1765)
  • ef0d999ba - Allow Jellyfin sink plugin to work with TVDB (#1764)
  • bfb8c711b - Refactor API response handling in TvdbService (#1761)
  • 2a067a56b - Add dynamic web search hyperlink for media items (#1757)
  • 4468495de - refactor: update providersConsumedOn to filter out falsy values in editSeenItem schema (#1753)
  • 9f31ae41b - Upsert calendar events and propagate database errors in background jobs (#1751)
  • 366f730cc - Fix jemalloc support for RPI5 and unsupported system page size (#1748)
  • 3b01bfd44 - Fix OIDC authentication with internal CA and improve job storage type clarity (#1745)
  • 9594e54f7 - Decrease side padding and improve card responsiveness (#1742)
  • 28fab1bd9 - Make possible to edit workout template comments (#1731)
  • 7934f774c - Template and Workout names are too truncated in Desktop and Mobile Views (#1730)
  • 8a3450e1f - Glow watched items in calendar with green (#1729)
  • 5eb06679d - Add autofocus attribute to submit button (mark as seen) (#1726)
  • 27993dfad - Merge pull request #1722 from IgnisDa:IgnisDa/issue1717
  • 64cb81cc4 - fix: prevent kodi scrobbling when video duration is zero
  • fdd5d357b - ci: Run CI
  • c3af712bb - refactor: remove unused Extensions from imports and update make_memory_job_storage to return JobStorage
  • a8348596c - refactor: update make_memory_job_storage to return Arc<Mutex<Option<MemoryStorage>>>
  • 3a13243fa - ci: Run CI
  • 4c8c0108b - refactor: remove unused RandomId from imports and simplify memory job storage sender initialization
  • 69b482b2d - ci: Run CI
  • 81e62653b - refactor: remove apalis-codec and apalis-file-storage dependencies from Cargo.toml
  • 240b892e2 - refactor: remove nanoid dependency from fitness service
  • 192e217e6 - refactor: replace apalis-file-storage with apalis-core for job storage and update dependencies
  • 4718b7e21 - feat: replace apalis-sqlite with apalis-file-storage for job storage
  • e3bab4cdd - Revert "Implement single application job locking and sharding (#1709)"
  • 66cefc90d - Merge pull request #1720 from IgnisDa:IgnisDa/issue1719
  • 7c8bc82f2 - refactor: simplify workout template ID handling in upsert_workout_template
  • 75dad280b - refactor: rename create_or_update_user_workout_template to upsert_workout_template for consistency
  • a31607aa5 - feat: validate workout template existence before updating or creating
  • 7d5a39c3c - feat: enhance workout input mapping by including assets, comment, supersets, and template ID
  • 9b92e8bb1 - fix(import): restore generic JSON workout template round-tripping
  • aee3eded3 - feat: update user list retrieval to include user ID and adjust admin user handling
  • 2074b8e72 - feat: add user impersonation link generation functionality
  • ff3343503 - fix(docker): prune runtime workspace dependencies
  • 18531d55c - feat: specify exact turbo version in Dockerfiles and update build-plugin.sh
  • e289935df - Remove Moon and migrate to Turbo (#1710)
  • d35ff6244 - feat: update moonrepo CLI version to 1.39.2 in Dockerfiles and workflow
  • a8e532ab7 - Implement single application job locking and sharding (#1709)
  • d354d4c0a - feat(integration): add username filtering for Jellyfin sink

Breaking Changes

  • Removed httpOnly and secure flags from the `twoFactorSessionStorage` cookie

Security Fixes

  • Quality: Sensitive data logging disabled in production (#1765)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track ryot

Get notified when new releases ship.

Sign up free

About ryot

Roll your own tracker!

All releases →

Related context

Earlier breaking changes

  • v10.3.18 Removes Moon build system and migrates to Turbo.

Beta — feedback welcome: [email protected]