This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
Affected surfaces
ReleasePort's take
Moderate signalThe release fixes several build and lockfile issues while introducing WEBUI enhancements; it also patches a critical SSRF vulnerability in HTTP handling.
Why it matters: Prevent server‑side request forgery (high severity, severity 95) affecting all installations; address build failures with latest zlib and stale lockfile problems.
Summary
AI summaryUpdates glassez, BUGFIX, and WEBUI across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Prevent SSRF via HTTP redirection Prevent SSRF via HTTP redirection Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Feature | Low |
Avoid search downloader for magnet links Avoid search downloader for magnet links Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Feature | Low |
Work around browser extension interfering with Add Torrent Dialog Work around browser extension interfering with Add Torrent Dialog Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Feature | Low |
Filter all children of content root in WEBUI Filter all children of content root in WEBUI Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Fix building with latest zlib Fix building with latest zlib Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Remove old-format lockfile on start Remove old-format lockfile on start Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Delete stale lockfile on machine‑id mismatch Delete stale lockfile on machine‑id mismatch Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Fix handling of 'Accept-Encoding' header Fix handling of 'Accept-Encoding' header Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Don't store API result between WEBAPI calls Don't store API result between WEBAPI calls Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Medium |
Fix RSS refresh loop when no feeds exist Fix RSS refresh loop when no feeds exist Source: llm_adapter@2026-05-27 Confidence: high |
— |
| Bugfix | Low |
Avoid proxy interfering with multiprocessing pool in SEARCH Avoid proxy interfering with multiprocessing pool in SEARCH Source: granite4.1:30b@2026-05-27-audit Confidence: low |
— |
Full changelog
- BUGFIX: Fix building with latest zlib (glassez) #24200
- BUGFIX: Remove old-format lockfile when starting (glassez) #24218
- BUGFIX: Prevent SSRF via HTTP redirection (AlexandrBlishun) #24270
- BUGFIX: Delete stale lockfile when machine-id mismatch (glassez) #24285
- BUGFIX: Fix handling of 'Accept-Encoding' header (glassez) #24286
- WEBUI: Avoid search downloader for magnet links (TurboTheTurtle) #24211
- WEBUI: Work around browser extension interfering with Add Torrent Dialog (vafada) #24240
- WEBUI: Filter all children of content root (vafada) #24243
- WEBAPI: Don't store API result between calls (beryxz) #24262
- RSS: Fix refresh is indefinitely called when there are no feeds (glassez) #24199
- SEARCH: Avoid proxy interfering with multiprocessing pool (Chocobo1) #24234
Security Fixes
- Prevent SSRF via HTTP redirection
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]