OliveTin

Changelog

Security

• 904616b1b1ef995ab868431b0835cb3fc368be7b security: GHSA-jm28-2wcr-qf3h (LOW) enforce logs ACL on sync execution endpoints
• 4ef86abee7aac4e4ec4a3200c7ca491ca3501065 security: GHSA-vc6p-m6vx-6cwq (HIGH) harden shellAfterCompleted execution
• 0e45f3b0e3c9e81685bc85b7c4f21187bb0df085 security: GHSA-xc5w-4v5w-7x65 (HIGH) harden shell argument type safety
• 422044317ccd530d1f392039fe432c5512a1603e security: GHSA-xpxj-f2fm-rqch (HIGH) bound OAuth2 state map growth

Features

• e24ae6265b7440a06062f990827974de1dae538a feat: Checklist support (#922)
• a856d463243f8fa7f4b4fd4bb260f550ec5c4b3a feat: Checklist support (#922) (#1066)
• 0c4d25e525206dbae5f6bf23fab43c00cff12e42 feat: add entity UI with list filtering and prefilled action arguments
• 6ce93629e7c6751ee7108ac8ce08c733a5b501b7 feat: add entity UI with list filtering and prefilled action arguments (#1069)
• afd9f9033accdf691e0722b9a0d9e1d78fd4e075 feat: expand entity list and detail APIs with properties and related actions
• 506ad4c883d44a63c9f2f67629e5e3456ffe4664 feat: expand entity list and detail APIs with properties and related … (#1068)

Bug fixes

• 42f2572616603854b2ef8da1de2489abfa398eb8 fix(config): reject ambiguous checklist comma format and propagate encode errors ParseChecklistValue now accepts JSON arrays or single bare values and rejects legacy comma-separated input. Empty JSON segments are validated consistently, and FormatChecklistValue returns marshal errors instead of an empty string
• 8eda67a39eb18434e8b34af50c698a4594cf2a68 fix(docs): correct shellAfterCompleted quoting for output and exitCode The after-completion example put {{ output }} and {{ exitCode }} inside single-quoted shell arguments, so and never expanded after substituteShellAfterCompletedEnvRefs runs. Update the apprise sample to use printf-based quoting that allows env substitution, document the single-quote pitfall, and extend TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is substituted as well as injection being blocked.
• 1396184777bee36eeea9c5a646744bd3e0f9d4e9 fix(executor): always anchor custom regex patterns and harden shellAfterCompleted Wrap regex: patterns in a non-capturing group before applying ^...$ so alternation cannot bypass full-string matching. Return template parse errors from buildShellAfterCommand, and guard nil binding/action before building shellAfterCompleted commands.
• b18518ebea48a4bcce861046331375bfff6d115b fix: add support for entities in checklists
• 58dc804e784f7a18f2784a620b74ae9da2dc99fa fix: coderabbit suggestions on the justification
• 09212dafeb2c8c56041b87ed468c9788ef738a3d fix: default choices causing the filter values to be hidden (#1065)
• 9dc51df01dddf09b917d314fbf7c351361c7b307 fix: harden checklist JSON wire format, entity pagination, and review findings across API and UI

Others

• ec114e95d297b806c3ca0c37bc139b3c9c517b3f Merge commit from fork
• e421780c9885aa5024d2f47b4ed4898f2f18eb90 Merge commit from fork
• 995ff79736f2bccc364448a3ece84087b550b232 Merge commit from fork
• d0075a7a8d44028793ea3384b34062b940841f24 Next (#1070)

Container images (from GitHub)

• docker pull ghcr.io/olivetin/olivetin:3000.17.0

Container images (on Docker Hub)

• docker pull docker.io/jamesread/olivetin:3000.17.0

Upgrade warnings, or breaking changes

• No such issues between the last release and this version.

Useful links

• Which download do I need?
• Ask for help and chat with others users in the Discord community

Thanks for your interest in OliveTin!