Skip to content

dashy

v4.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 22d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

web docker self-hosted homepage mit nodejs
+5 more
organization productivity pwa startpage vue

Affected surfaces

auth deps

Summary

AI summary

Fixes XSS in workspace URL parameter.

Full changelog

What's Changed

  • Custom API widget by @lissy93 in https://github.com/lissy93/dashy/pull/2197
  • Bump the minor-and-patch group with 11 updates by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2200
  • Fixes OIDC admin permissions for GitLab by @lissy93 in https://github.com/lissy93/dashy/pull/2203
  • Support for automatic background OIDC token renewal by @lissy93 in https://github.com/lissy93/dashy/pull/2204
  • Clearer authentication docs by @lissy93 in https://github.com/lissy93/dashy/pull/2206
  • Local item URL fallbacks by @Troublesis in https://github.com/lissy93/dashy/pull/2207
  • Fixes XSS in workspace url param by @lissy93 in https://github.com/lissy93/dashy/pull/2208
  • First version of REST API by @lissy93 in https://github.com/lissy93/dashy/pull/2209
  • Option for overriding allowed issuers by @lissy93 in https://github.com/lissy93/dashy/pull/2211
  • Bump dompurify from 3.4.9 to 3.4.11 by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2215
  • Bump @babel/core from 7.29.0 to 7.29.7 by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2213
  • Bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2212
  • Bump lissy93/repo-mirror-action from 1.5.0 to 1.6.0 by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2218
  • Improved OIDC error handling by @lissy93 in https://github.com/lissy93/dashy/pull/2222
  • Bump vitest from 4.1.8 to 4.1.9 in the vitest group by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2224
  • Typo in README.md by @silicattinho in https://github.com/lissy93/dashy/pull/2223
  • Bump the minor-and-patch group across 1 directory with 19 updates by @dependabot[bot] in https://github.com/lissy93/dashy/pull/2225
  • Improved deployment docs by @lissy93 in https://github.com/lissy93/dashy/pull/2214
  • Adds widget for GPU monitoring glances by @lissy93 in https://github.com/lissy93/dashy/pull/2227

New Contributors

  • @silicattinho made their first contribution in https://github.com/lissy93/dashy/pull/2223
  • @Troublesis made their first contribution in #2205 (merged in #2207)

Full Changelog: https://github.com/lissy93/dashy/compare/4.3.0...4.4.0

Security Fixes

  • Fixes XSS in workspace url param
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track dashy

Get notified when new releases ship.

Sign up free

About dashy

A self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more!

All releases →

Related context

Beta — feedback welcome: [email protected]