This release includes 3 security fixes for security teams reviewing exposed deployments.
Published 1mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 3 known CVEs
Topics
meal-plans
recipe-manager
self-hosted
Affected surfaces
auth
deps
Summary
AI summaryBroad release touches ⬆️ Dependency updates, deps, 🧰 Maintenance, and 🐛 Bug fixes.
Full changelog
🍴🍴🍴🍴🍴🍴
This release contains several fixes and security updates, including a fix for the recipe parser which should hopefully make it more consistent on some less-trusted networks.
✨ New features
- feat: Enhanced PR Lint/Validation @Choromanski (#7329)
- feat: warn when deleting foods used in recipes @ZacharySchaffter (#7117)
- feat: Added version info to backup file @Choromanski (#7416)
🐛 Bug fixes
- fix: add missing dependencies in package.json @p0lycarpio (#7709)
- fix: support CSV/TXT upload and add validation for Plan to Eat import (#6360) @hay-kot (#7622)
- fix: harden recipe content against stored XSS (chips, instructions, asset media) @hay-kot (#7719)
- fix: default ingredient_references on RecipeInstruction init @alexander-wenzel-dev (#7732)
- fix: Upgrade pytest-asyncio @michael-genson (#7746)
- fix: refactor cookie settings for Home Assistant i-frame login @cheebreezee (#7741)
- fix: Various lint issues @michael-genson (#7766)
- fix: send default_headers with curl_cffi impersonation (fixes 403 on WAF sites) @xenoputtss (#7792)
🧰 Maintenance
11 changes- chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7713)
- chore: add 5-day dependency cooling period for supply-chain hardening @hay-kot (#7718)
- chore: drop unused python dependencies aniso8601 and appdirs @hay-kot (#7717)
- chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7734)
- chore(l10n): New Crowdin updates @hay-kot (#7747)
- chore(l10n): New Crowdin updates @hay-kot (#7749)
- chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7757)
- chore(l10n): New Crowdin updates @hay-kot (#7756)
- chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7784)
- chore(l10n): New Crowdin updates @hay-kot (#7765)
- chore(l10n): New Crowdin updates @hay-kot (#7791)
📚 Documentation
- docs: fix broken link to backend configuration in AI providers page @BuildmodeOne (#7793)
🔨 Internal development
- dev: Improve support for front end unit tests @miah120 (#7163)
⬆️ Dependency updates
30 changes- chore(deps): update dependency pytest-asyncio to v1.4.0 @renovate[bot] (#7694)
- chore(deps): update dependency vitest to v4 [security] @renovate[bot] (#7723)
- chore(deps): lock file maintenance @renovate[bot] (#7742)
- fix(deps): update dependency python-multipart to v0.0.32 @renovate[bot] (#7729)
- fix(deps): update dependency apprise to v1.11.0 @renovate[bot] (#7728)
- fix(deps): update dependency uvicorn to v0.49.0 @renovate[bot] (#7744)
- chore(deps): update dependency ruff to v0.15.16 @renovate[bot] (#7726)
- fix(deps): update dependency openai to v2.41.0 @renovate[bot] (#7733)
- chore(deps): update node.js to 9c1d881 @renovate[bot] (#7748)
- chore(deps): update node.js to 40ad9f3 @renovate[bot] (#7752)
- fix(deps): update dependency beautifulsoup4 to v4.15.0 @renovate[bot] (#7753)
- chore(deps): lock file maintenance @renovate[bot] (#7759)
- fix(deps): update dependency yt-dlp to v2026.6.9 @renovate[bot] (#7758)
- fix(deps): update dependency openai to v2.41.1 @renovate[bot] (#7761)
- fix(deps): update dependency pillow-heif to v1.4.0 @renovate[bot] (#7762)
- chore(deps): update dependency ruff to v0.15.17 @renovate[bot] (#7763)
- chore(deps): update dependency dompurify to v3.4.11 [security] @renovate[bot] (#7772)
- chore(deps): update node.js to 032e78d @renovate[bot] (#7773)
- chore(deps): update dependency pytest to v9.1.0 @renovate[bot] (#7776)
- chore(deps): update dependency pylint to v4.0.6 @renovate[bot] (#7777)
- fix(deps): update dependency fastapi to v0.137.1 @renovate[bot] (#7778)
- fix(deps): update dependency sqlalchemy to v2.0.51 @renovate[bot] (#7783)
- chore(deps): lock file maintenance @renovate[bot] (#7788)
- fix(deps): update dependency openai to v2.42.0 @renovate[bot] (#7787)
- fix(deps): update dependency openai to v2.43.0 @renovate[bot] (#7794)
- fix(deps): update dependency fastapi to v0.137.2 @renovate[bot] (#7796)
- chore(deps): update dependency ruff to v0.15.18 @renovate[bot] (#7797)
- chore(deps): update node.js to 012c19a @renovate[bot] (#7799)
- chore(deps): update node.js to 733e1c0 @renovate[bot] (#7800)
- chore(deps): update dependency pytest to v9.1.1 @renovate[bot] (#7801)
🙏 New Contributors
- @alexander-wenzel-dev made their first contribution in https://github.com/mealie-recipes/mealie/pull/7732
- @cheebreezee made their first contribution in https://github.com/mealie-recipes/mealie/pull/7741
- @xenoputtss made their first contribution in https://github.com/mealie-recipes/mealie/pull/7792
- @BuildmodeOne made their first contribution in https://github.com/mealie-recipes/mealie/pull/7793
🍴🍴🍴🍴🍴🍴
Security Fixes
- Harden recipe content against stored XSS (chips, instructions, asset media)
- Update dependency dompurify to v3.4.11 [security]
- Update dependency vitest to v4 [security]
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About mealie
Mealie is a self hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the url and mealie will automatically import the relevant data or add a family recipe with the UI editor
Related context
Related tools
Beta — feedback welcome: [email protected]