Skip to content

Hive-Pal

v0.18.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

βœ“ No known CVEs patched
Read the diff β†’ Tool health β†’ What is this tool? β†’
This release patches 2 known CVEs

Topics

beekeeping

ReleasePort's take

Moderate signal
editorial:auto 8d

The v0.18.0 release resolves ten ReDoS vulnerabilities in the jwt-utils test suite and hardens the AI Python service.

Why it matters: Patches eliminate high-severity (severityβ€―90) ReDoS risks affecting critical testing and production code; operators should apply this update immediately.

Summary

AI summary

Broad release touches πŸš€ What's New, πŸ”§ Technical Improvements, 🌍 Translations, and πŸ› Bug Fixes.

Changes in this release

Security Critical

Resolves 10 ReDoS vulnerabilities in jwt-utils test suite and hardens AI Python service.

Resolves 10 ReDoS vulnerabilities in jwt-utils test suite and hardens AI Python service.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Adds Queen History Tracking with list, detail pages, transfer recording, and hive history tab.

Adds Queen History Tracking with list, detail pages, transfer recording, and hive history tab.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Introduces Inspection Scores, Frame Observations, and Box Configuration for richer inspection workflow.

Introduces Inspection Scores, Frame Observations, and Box Configuration for richer inspection workflow.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Adds AI‑powered inspection suggestions with internationalized prompts and graceful error handling.

Adds AI‑powered inspection suggestions with internationalized prompts and graceful error handling.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Enables attaching photos directly to inspections for visual records.

Enables attaching photos directly to inspections for visual records.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Overhauls Equipment Planning flow with clearer status tracking and default items.

Overhauls Equipment Planning flow with clearer status tracking and default items.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Medium

Adds initial support for sharing apiaries between users.

Adds initial support for sharing apiaries between users.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Feature Low

Improves inspection date and time handling: consistent UTC usage, preserves time of day, enhanced reschedule dialog, and direct "Add Inspection" from entry button.

Improves inspection date and time handling: consistent UTC usage, preserves time of day, enhanced reschedule dialog, and direct "Add Inspection" from entry button.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Feature Low

Polishes mobile UI: collapsible sidebar, visible FAB labels, hidden apiary header buttons on small screens, tappable hive rows/names, formatted dates per user preferences, and general layout cleanup.

Polishes mobile UI: collapsible sidebar, visible FAB labels, hidden apiary header buttons on small screens, tappable hive rows/names, formatted dates per user preferences, and general layout cleanup.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Feature Low

Adds translation keys for all new features in supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch) and adds Dutch localization via Weblate.

Adds translation keys for all new features in supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch) and adds Dutch localization via Weblate.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Bugfix Medium

Fixes "Mark as Dead" and "Mark as Lost/Missing" actions to correctly update queen status via API.

Fixes "Mark as Dead" and "Mark as Lost/Missing" actions to correctly update queen status via API.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Bugfix Low

Resolves `getColor` undefined error by replacing with `getQueenColorClass` in queen information component.

Resolves `getColor` undefined error by replacing with `getQueenColorClass` in queen information component.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Bugfix Low

Deduplicates queen actions dropdown across mobile and inline views using shared menu component.

Deduplicates queen actions dropdown across mobile and inline views using shared menu component.

Source: llm_adapter@2026-05-26

Confidence: high

β€”
Bugfix Low

Fixes language switcher readability on dark login background and resolves error screen during signup before onboarding completes.

Fixes language switcher readability on dark login background and resolves error screen during signup before onboarding completes.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Refactor Low

Adds new `QueenMovement` database model, API endpoints for queen history, transfer, and movement history, reusable `QueenColorBadge` component, shared queen constants, and React Query hooks (`useQueenHistory`, `useHiveQueenHistory`, `useRecordQueenTransfer`).

Adds new `QueenMovement` database model, API endpoints for queen history, transfer, and movement history, reusable `QueenColorBadge` component, shared queen constants, and React Query hooks (`useQueenHistory`, `useHiveQueenHistory`, `useRecordQueenTransfer`).

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Refactor Low

Introduces new GitHub Actions workflow to build the `ai-python-image` container, changes Vite to `autoUpdate`, removes API caching from Vite config, and applies SonarCloud quality‑gate fixes and component refactors.

Introduces new GitHub Actions workflow to build the `ai-python-image` container, changes Vite to `autoUpdate`, removes API caching from Vite config, and applies SonarCloud quality‑gate fixes and component refactors.

Source: granite4.1:30b@2026-05-26-audit

Confidence: low

β€”
Full changelog

πŸš€ What's New

Queen History Tracking

Full queen lifecycle management has arrived! Beekeepers can now track individual queens across hives, record transfers with dates and reasons, and view the complete history of queens in any hive.

  • Queen List Page (/queens) β€” browse all queens with filtering by status (Active, Replaced, Dead, Unknown) and hive assignment
  • Queen Detail Page β€” view detailed queen information including color, marking, year, source, and full movement history between hives
  • Queen Transfer β€” record queen transfers between hives with date, reason, and notes
  • Queen History Tab β€” new tab on the hive detail page showing all queens that have been in the hive, with action buttons to add or replace queens
  • Queen marking in the hive detail header is clickable and links directly to the queen detail page
  • "View Details" option added to the queen actions dropdown menu
  • "Mark as Dead" and "Mark as Lost/Missing" actions now actually update the queen status via the API and set the replaced date (previously no-ops)

Inspection Scores, Frame Observations & Box Configuration

A significant overhaul of the inspection workflow that introduces structured scoring and richer per-frame data:

  • Inspection scoring β€” capture standardized scores during an inspection to track hive condition over time
  • Frame-level observations β€” record observations at the individual frame level (brood pattern, stores, etc.)
  • Box configuration β€” configure the boxes that make up a hive and surface them in inspections
  • Pending box updates queue with retry mechanism and safe JSON parsing for resilient offline-tolerant updates
  • Score calculation is skipped for subjective apiary inspections so totals reflect real measurements

AI-Powered Inspection Suggestions

AI assistance has been added to the inspection form to help beekeepers fill in observations and recommendations:

  • AI suggestions for observation fields, including numeric values
  • AI-suggested recommendations powered by a new Python service (ai-python-image) with its own GHCR build workflow
  • LLM prompts are now internationalized so suggestions match the user's selected language
  • UX polish for missing AI data, visibility of AI suggestions, and merging AI output with user-entered values
  • Graceful handling of weather service errors when an apiary has no location set

Equipment Planning Overhaul

A complete rework of equipment management:

  • New equipment planning flow with clearer status tracking
  • Expanded set of default equipment items so new users start with sensible defaults
  • Equipment table is now horizontally scrollable on mobile

Apiary Sharing

Initial support for sharing apiaries between users, laying the groundwork for collaborative beekeeping.

Photos on Inspections

Inspections can now have photos attached directly, so visual records live alongside the observations they relate to (in addition to the standalone photo uploads introduced in v0.17.0).

Inspection Date & Time Improvements

  • UTC date handling is now consistent across the app
  • Time of day is preserved correctly for all-day inspections
  • Reschedule dialog uses the improved date/time picker
  • "Add Inspection" is now available directly from the "Add Entry" button

Mobile UI Polish

A round of mobile-specific UX improvements:

  • Sidebar collapses when a link is tapped
  • Floating Action Button (FAB) action labels show on all screen sizes with proper card background
  • Apiary header button labels are hidden on small screens to save space
  • Hive table rows and hive names are now tappable links to the hive detail page
  • Installation and last-inspection dates are formatted per the user's preferences
  • General layout, notifications, and settings cleanup

Email & SMTP Documentation

The README now documents all email-related environment variables, including MAIL_PROVIDER, RESEND_API_KEY, SMTP_REJECT_UNAUTHORIZED, and the existing SMTP settings, making self-hosted email setup clearer.

Login & Onboarding Fixes

  • Language switcher buttons on the login screen are now readable on the dark background
  • Resolved an error screen that could appear during signup before onboarding completed

πŸ› Bug Fixes

  • Fixed getColor not defined error in the queen information component β€” replaced with the correct getQueenColorClass function
  • Fixed "Mark as Dead" and "Mark as Lost/Missing" actions which were previously no-ops
  • Deduplicated queen actions dropdown in mobile and inline views β€” now reuses a shared menu component
  • Restored Weblate-managed locale formatting and added .prettierignore so translation files don't get reformatted out from under translators
  • Various lint and ESLint fixes across frontend and backend
  • Removed unused imports and dead code in equipment and inspection forms
  • Fixed JSX structure in the reschedule dialog's InspectionDateTimePicker

πŸ”’ Security

  • Resolved 10 additional ReDoS (regular expression denial of service) vulnerabilities in the jwt-utils test suite
  • Additional security hardening across the AI Python service

πŸ”§ Technical Improvements

  • New QueenMovement database model for tracking queen transfers between hives
  • New API endpoints for queen history (/api/queens/hive/:hiveId/history), queen movement history (/api/queens/:id/history), and queen transfer (/api/queens/:id/transfer)
  • QueenColorBadge extracted as a reusable component
  • Shared queen constants extracted to reduce code duplication
  • New React Query hooks: useQueenHistory, useHiveQueenHistory, useRecordQueenTransfer
  • AI logic moved into a dedicated hook for reuse
  • New GitHub Actions workflow to build the ai-python-image container
  • Vite changed to autoUpdate and API caching removed from Vite config
  • Multiple SonarCloud quality-gate fixes and component-duplication refactors
  • Translation keys added for all new features across supported languages (English, German, French, Italian, Slovak, Danish, Serbian, Dutch)

🌍 Translations

  • Dutch β€” new language added via Weblate
  • French β€” significant updates via Weblate
  • Serbian β€” extensive updates via Weblate
  • Danish β€” continued contributions

🀝 Contributors

A huge thank you to everyone who contributed to this release!

  • @Wollycobbles β€” queen history tracking, inspection date/time enhancements (PR #159), and mobile UI polish (PR #157)
  • @MacNite β€” inspection scores, frame observations, and box configuration (PR #164, #168)
  • @JacKruczek β€” equipment planning overhaul (PR #158) and expanded default equipment items (PR #166)
  • @TomsaJ β€” LLM prompt internationalization (PR #148)
  • Weblate translators for Dutch, French, Serbian, and Danish

Track your queens from hive to hive β€” every transfer, every generation! πŸπŸ‘‘

Security Fixes

  • Resolved 10 ReDoS vulnerabilities in the `jwt-utils` test suite.
  • Additional security hardening across the AI Python service.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Hive-Pal

Get notified when new releases ship.

Sign up free

About Hive-Pal

Mobile-first beekeeping management app for tracking hives, inspections, queen records, and equipment with streamlined data entry optimized for field use.

All releases β†’

Related context

Related tools

Beta — feedback welcome: [email protected]