This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
ReleasePort's take
Moderate signalThe v0.18.0 release resolves ten ReDoS vulnerabilities in the jwt-utils test suite and hardens the AI Python service.
Why it matters: Patches eliminate high-severity (severityβ―90) ReDoS risks affecting critical testing and production code; operators should apply this update immediately.
Summary
AI summaryBroad release touches π What's New, π§ Technical Improvements, π Translations, and π Bug Fixes.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Resolves 10 ReDoS vulnerabilities in jwt-utils test suite and hardens AI Python service. Resolves 10 ReDoS vulnerabilities in jwt-utils test suite and hardens AI Python service. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Adds Queen History Tracking with list, detail pages, transfer recording, and hive history tab. Adds Queen History Tracking with list, detail pages, transfer recording, and hive history tab. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Introduces Inspection Scores, Frame Observations, and Box Configuration for richer inspection workflow. Introduces Inspection Scores, Frame Observations, and Box Configuration for richer inspection workflow. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Adds AIβpowered inspection suggestions with internationalized prompts and graceful error handling. Adds AIβpowered inspection suggestions with internationalized prompts and graceful error handling. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Enables attaching photos directly to inspections for visual records. Enables attaching photos directly to inspections for visual records. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Overhauls Equipment Planning flow with clearer status tracking and default items. Overhauls Equipment Planning flow with clearer status tracking and default items. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Medium |
Adds initial support for sharing apiaries between users. Adds initial support for sharing apiaries between users. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Feature | Low |
Improves inspection date and time handling: consistent UTC usage, preserves time of day, enhanced reschedule dialog, and direct "Add Inspection" from entry button. Improves inspection date and time handling: consistent UTC usage, preserves time of day, enhanced reschedule dialog, and direct "Add Inspection" from entry button. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
| Feature | Low |
Polishes mobile UI: collapsible sidebar, visible FAB labels, hidden apiary header buttons on small screens, tappable hive rows/names, formatted dates per user preferences, and general layout cleanup. Polishes mobile UI: collapsible sidebar, visible FAB labels, hidden apiary header buttons on small screens, tappable hive rows/names, formatted dates per user preferences, and general layout cleanup. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
| Feature | Low |
Adds translation keys for all new features in supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch) and adds Dutch localization via Weblate. Adds translation keys for all new features in supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch) and adds Dutch localization via Weblate. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
| Bugfix | Medium |
Fixes "Mark as Dead" and "Mark as Lost/Missing" actions to correctly update queen status via API. Fixes "Mark as Dead" and "Mark as Lost/Missing" actions to correctly update queen status via API. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Bugfix | Low |
Resolves `getColor` undefined error by replacing with `getQueenColorClass` in queen information component. Resolves `getColor` undefined error by replacing with `getQueenColorClass` in queen information component. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Bugfix | Low |
Deduplicates queen actions dropdown across mobile and inline views using shared menu component. Deduplicates queen actions dropdown across mobile and inline views using shared menu component. Source: llm_adapter@2026-05-26 Confidence: high |
β |
| Bugfix | Low |
Fixes language switcher readability on dark login background and resolves error screen during signup before onboarding completes. Fixes language switcher readability on dark login background and resolves error screen during signup before onboarding completes. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
| Refactor | Low |
Adds new `QueenMovement` database model, API endpoints for queen history, transfer, and movement history, reusable `QueenColorBadge` component, shared queen constants, and React Query hooks (`useQueenHistory`, `useHiveQueenHistory`, `useRecordQueenTransfer`). Adds new `QueenMovement` database model, API endpoints for queen history, transfer, and movement history, reusable `QueenColorBadge` component, shared queen constants, and React Query hooks (`useQueenHistory`, `useHiveQueenHistory`, `useRecordQueenTransfer`). Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
| Refactor | Low |
Introduces new GitHub Actions workflow to build the `ai-python-image` container, changes Vite to `autoUpdate`, removes API caching from Vite config, and applies SonarCloud qualityβgate fixes and component refactors. Introduces new GitHub Actions workflow to build the `ai-python-image` container, changes Vite to `autoUpdate`, removes API caching from Vite config, and applies SonarCloud qualityβgate fixes and component refactors. Source: granite4.1:30b@2026-05-26-audit Confidence: low |
β |
Full changelog
π What's New
Queen History Tracking
Full queen lifecycle management has arrived! Beekeepers can now track individual queens across hives, record transfers with dates and reasons, and view the complete history of queens in any hive.
- Queen List Page (
/queens) β browse all queens with filtering by status (Active, Replaced, Dead, Unknown) and hive assignment - Queen Detail Page β view detailed queen information including color, marking, year, source, and full movement history between hives
- Queen Transfer β record queen transfers between hives with date, reason, and notes
- Queen History Tab β new tab on the hive detail page showing all queens that have been in the hive, with action buttons to add or replace queens
- Queen marking in the hive detail header is clickable and links directly to the queen detail page
- "View Details" option added to the queen actions dropdown menu
- "Mark as Dead" and "Mark as Lost/Missing" actions now actually update the queen status via the API and set the replaced date (previously no-ops)
Inspection Scores, Frame Observations & Box Configuration
A significant overhaul of the inspection workflow that introduces structured scoring and richer per-frame data:
- Inspection scoring β capture standardized scores during an inspection to track hive condition over time
- Frame-level observations β record observations at the individual frame level (brood pattern, stores, etc.)
- Box configuration β configure the boxes that make up a hive and surface them in inspections
- Pending box updates queue with retry mechanism and safe JSON parsing for resilient offline-tolerant updates
- Score calculation is skipped for subjective apiary inspections so totals reflect real measurements
AI-Powered Inspection Suggestions
AI assistance has been added to the inspection form to help beekeepers fill in observations and recommendations:
- AI suggestions for observation fields, including numeric values
- AI-suggested recommendations powered by a new Python service (
ai-python-image) with its own GHCR build workflow - LLM prompts are now internationalized so suggestions match the user's selected language
- UX polish for missing AI data, visibility of AI suggestions, and merging AI output with user-entered values
- Graceful handling of weather service errors when an apiary has no location set
Equipment Planning Overhaul
A complete rework of equipment management:
- New equipment planning flow with clearer status tracking
- Expanded set of default equipment items so new users start with sensible defaults
- Equipment table is now horizontally scrollable on mobile
Apiary Sharing
Initial support for sharing apiaries between users, laying the groundwork for collaborative beekeeping.
Photos on Inspections
Inspections can now have photos attached directly, so visual records live alongside the observations they relate to (in addition to the standalone photo uploads introduced in v0.17.0).
Inspection Date & Time Improvements
- UTC date handling is now consistent across the app
- Time of day is preserved correctly for all-day inspections
- Reschedule dialog uses the improved date/time picker
- "Add Inspection" is now available directly from the "Add Entry" button
Mobile UI Polish
A round of mobile-specific UX improvements:
- Sidebar collapses when a link is tapped
- Floating Action Button (FAB) action labels show on all screen sizes with proper card background
- Apiary header button labels are hidden on small screens to save space
- Hive table rows and hive names are now tappable links to the hive detail page
- Installation and last-inspection dates are formatted per the user's preferences
- General layout, notifications, and settings cleanup
Email & SMTP Documentation
The README now documents all email-related environment variables, including MAIL_PROVIDER, RESEND_API_KEY, SMTP_REJECT_UNAUTHORIZED, and the existing SMTP settings, making self-hosted email setup clearer.
Login & Onboarding Fixes
- Language switcher buttons on the login screen are now readable on the dark background
- Resolved an error screen that could appear during signup before onboarding completed
π Bug Fixes
- Fixed
getColornot defined error in the queen information component β replaced with the correctgetQueenColorClassfunction - Fixed "Mark as Dead" and "Mark as Lost/Missing" actions which were previously no-ops
- Deduplicated queen actions dropdown in mobile and inline views β now reuses a shared menu component
- Restored Weblate-managed locale formatting and added
.prettierignoreso translation files don't get reformatted out from under translators - Various lint and ESLint fixes across frontend and backend
- Removed unused imports and dead code in equipment and inspection forms
- Fixed JSX structure in the reschedule dialog's
InspectionDateTimePicker
π Security
- Resolved 10 additional ReDoS (regular expression denial of service) vulnerabilities in the
jwt-utilstest suite - Additional security hardening across the AI Python service
π§ Technical Improvements
- New
QueenMovementdatabase model for tracking queen transfers between hives - New API endpoints for queen history (
/api/queens/hive/:hiveId/history), queen movement history (/api/queens/:id/history), and queen transfer (/api/queens/:id/transfer) QueenColorBadgeextracted as a reusable component- Shared queen constants extracted to reduce code duplication
- New React Query hooks:
useQueenHistory,useHiveQueenHistory,useRecordQueenTransfer - AI logic moved into a dedicated hook for reuse
- New GitHub Actions workflow to build the
ai-python-imagecontainer - Vite changed to
autoUpdateand API caching removed from Vite config - Multiple SonarCloud quality-gate fixes and component-duplication refactors
- Translation keys added for all new features across supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch)
π Translations
- Dutch β new language added via Weblate
- French β significant updates via Weblate
- Serbian β extensive updates via Weblate
- Danish β continued contributions
π€ Contributors
A huge thank you to everyone who contributed to this release!
- @Wollycobbles β queen history tracking, inspection date/time enhancements (PR #159), and mobile UI polish (PR #157)
- @MacNite β inspection scores, frame observations, and box configuration (PR #164, #168)
- @JacKruczek β equipment planning overhaul (PR #158) and expanded default equipment items (PR #166)
- @TomsaJ β LLM prompt internationalization (PR #148)
- Weblate translators for Dutch, French, Serbian, and Danish
Track your queens from hive to hive β every transfer, every generation! ππ
Security Fixes
- Resolved 10 ReDoS vulnerabilities in the `jwt-utils` test suite.
- Additional security hardening across the AI Python service.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Hive-Pal
Mobile-first beekeeping management app for tracking hives, inspections, queen records, and equipment with streamlined data entry optimized for field use.
Beta — feedback welcome: [email protected]