Skip to content

receipt-wrangler

v7.1.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth rbac deps

Summary

AI summary

Broad release touches Highlights, reporting, api, and mobile.

Full changelog

Highlights

  • Reporting
  • Security Fixes

What's Changed

  • Reorder system settings tabs by permission hierarchy by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/613
  • fix(api): keep group_members.group_role nullable so upgrades can create groups by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/614
  • refactor(api): unify receipt read enforcement across REST and MCP by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/616
  • fix(api): enforce RBAC grants and paid-by visibility in MCP read tools by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/615
  • fix(api): stop CreateReceipt losing its transaction on read-back by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/618
  • feat(receipts): add a Group field to the receipt filter by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/619
  • feat(quick-scan): configurable quick-scan fields per group (api + desktop + mobile) by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/620
  • Reporting engine core by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/621
  • fix(roles): reconcile system-role permissions on boot (add-only) by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/622
  • feat(reporting): report data source by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/623
  • feat(pie-chart): show hidden categories/tags as a (Restricted) slice by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/624
  • feat(reporting): add flat CSV renderer for the ReportModel by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/625
  • feat(reporting): add faithful XLSX renderer for the ReportModel by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/626
  • feat(reporting): HTML renderer + shared faithful walk by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/627
  • feat(reporting): synchronous report generation endpoint + group.reports.read by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/628
  • feat(mobile): QR-scan the server URL on the Connect screen by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/629
  • feat(reporting): desktop Report Builder UI + preview endpoint by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/630
  • Report templates: save, delete, and version-stamp report configurations by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/631
  • Report templates: list, row actions, and open-in-builder hydration by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/632
  • Report templates: in-place update + dynamic "current viewer" paid-by filter by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/633
  • Report-template access control: group-scoping, per-template matrix, and -All bypass permissions by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/634
  • fix(reports): CSV formula-injection guard + honor -All perms in the builder by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/635
  • Reporting pre-merge hardening: arithmetic OOM guard + disabled-column persistence by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/636
  • Mobile reporting slice (list / preview / generate / delete) by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/639
  • feat(reporting): Report dashboard widget (view + gated download) by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/640
  • feat(reporting): mobile view-only Report dashboard widget + e2e by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/641
  • Add Claude Code sandbox setup playbooks for all components by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/642
  • Reporting: receipt reports — engine, renderers, Builder UI, saved templates, and access control by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/637
  • Add comprehensive test coverage for utility functions by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/643
  • Use ARM-native runner for Docker builds by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/644
  • Add comprehensive unit tests for models package by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/646
  • fix(mobile): recover iOS launch render freeze on 120Hz devices (#617) by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/645
  • Bump Go dependencies with known vulnerabilities by @Noah231515 in https://github.com/Receipt-Wrangler/receipt-wrangler/pull/649

Full Changelog: https://github.com/Receipt-Wrangler/receipt-wrangler/compare/v7.0.0...v7.1.0

Security Fixes

  • Bump Go dependencies to address known vulnerabilities

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track receipt-wrangler

Get notified when new releases ship.

Sign up free

About receipt-wrangler

Receipt Wrangler application

All releases →

Related context

Beta — feedback welcome: [email protected]