Skip to content

ryot

v10.3.18 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 15d Dashboards & Home Pages
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

exercise-tracker fitness-tracker integrations media-tracking tracker

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 12d

The release fixes several import bugs, adds new Jellyfin features, updates dependencies, and switches from Moon to Turbo build system.

Why it matters: Removal of httpOnly and secure flags from twoFactorSessionStorage (severity 80) directly reduces authentication security. Migration from Moon to Turbo (severity 70) is required before the next build cycle for all pipelines.

Summary

AI summary

Broad release touches http://github.com/IgnisDa/ryot/commit/3eee8af397a77a2c886a3fb6784fe3ec24ec6a50, ci, http://github.com/IgnisDa/ryot/commit/4a6c278ceec60ab8a8b9ce966237855e650ff1e4, and http://github.com/IgnisDa/ryot/commit/51d9484aa4f7455e92d22593c36a0bab793840aa.

Changes in this release

Security High

Removes httpOnly and secure flags from twoFactorSessionStorage cookie.

Removes httpOnly and secure flags from twoFactorSessionStorage cookie.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Breaking High

Removes Moon build system and migrates to Turbo.

Removes Moon build system and migrates to Turbo.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Feature Medium

Adds Jellyfin sink support for TVDB integration.

Adds Jellyfin sink support for TVDB integration.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds username filtering for Jellyfin sink integration.

Adds username filtering for Jellyfin sink integration.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Medium

Adds dynamic web search hyperlink for media items.

Adds dynamic web search hyperlink for media items.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Dependency Medium

Removes apalis-codec and apalis-file-storage dependencies from Cargo.toml.

Removes apalis-codec and apalis-file-storage dependencies from Cargo.toml.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Dependency Medium

Replaces apalis-sqlite with apalis-file-storage for job storage.

Replaces apalis-sqlite with apalis-file-storage for job storage.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes Hevy CSV import silently dying on unparseable workout dates.

Fixes Hevy CSV import silently dying on unparseable workout dates.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes Trakt import aborting on a collection item with all-null ids.

Fixes Trakt import aborting on a collection item with all-null ids.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes suggestion links never getting inserted.

Fixes suggestion links never getting inserted.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Bugfix Low

Ensures suggestion links are inserted correctly.

Ensures suggestion links are inserted correctly.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

What's Changed

  • 3eee8af39 - fix(ci): pin compatible Cross build images
  • 4a6c278ce - Fix Hevy CSV import silently dying on unparseable workout dates
  • 51d9484aa - Trakt import aborts on a collection item with all-null ids (#1785)
  • 957981ebe - Fix suggestion links never getting inserted (#1778)
  • 0ae7a792a - chore: delete metadata suggestions before committing them
  • 009b65468 - Make green glow only in calendar (#1772)
  • 963907764 - Fix non-shows watched glow in Calendar (#1770)
  • 961b40215 - refactor: remove httpOnly and secure flags from twoFactorSessionStorage cookie
  • ae9d02d29 - Get Jellyfin Sink working with TVDB (#1767)
  • 86e35975f - Quality: Sensitive data logging in production (#1765)
  • ef0d999ba - Allow Jellyfin sink plugin to work with TVDB (#1764)
  • bfb8c711b - Refactor API response handling in TvdbService (#1761)
  • 2a067a56b - Add dynamic web search hyperlink for media items (#1757)
  • 4468495de - refactor: update providersConsumedOn to filter out falsy values in editSeenItem schema (#1753)
  • 9f31ae41b - Upsert calendar events and propagate database errors in background jobs (#1751)
  • 366f730cc - Fix jemalloc support for RPI5 and unsupported system page size (#1748)
  • 3b01bfd44 - Fix OIDC authentication with internal CA and improve job storage type clarity (#1745)
  • 9594e54f7 - Decrease side padding and improve card responsiveness (#1742)
  • 28fab1bd9 - Make possible to edit workout template comments (#1731)
  • 7934f774c - Template and Workout names are too truncated in Desktop and Mobile Views (#1730)
  • 8a3450e1f - Glow watched items in calendar with green (#1729)
  • 5eb06679d - Add autofocus attribute to submit button (mark as seen) (#1726)
  • 27993dfad - Merge pull request #1722 from IgnisDa:IgnisDa/issue1717
  • 64cb81cc4 - fix: prevent kodi scrobbling when video duration is zero
  • fdd5d357b - ci: Run CI
  • c3af712bb - refactor: remove unused Extensions from imports and update make_memory_job_storage to return JobStorage
  • a8348596c - refactor: update make_memory_job_storage to return Arc<Mutex<Option<MemoryStorage>>>
  • 3a13243fa - ci: Run CI
  • 4c8c0108b - refactor: remove unused RandomId from imports and simplify memory job storage sender initialization
  • 69b482b2d - ci: Run CI
  • 81e62653b - refactor: remove apalis-codec and apalis-file-storage dependencies from Cargo.toml
  • 240b892e2 - refactor: remove nanoid dependency from fitness service
  • 192e217e6 - refactor: replace apalis-file-storage with apalis-core for job storage and update dependencies
  • 4718b7e21 - feat: replace apalis-sqlite with apalis-file-storage for job storage
  • e3bab4cdd - Revert "Implement single application job locking and sharding (#1709)"
  • 66cefc90d - Merge pull request #1720 from IgnisDa:IgnisDa/issue1719
  • 7c8bc82f2 - refactor: simplify workout template ID handling in upsert_workout_template
  • 75dad280b - refactor: rename create_or_update_user_workout_template to upsert_workout_template for consistency
  • a31607aa5 - feat: validate workout template existence before updating or creating
  • 7d5a39c3c - feat: enhance workout input mapping by including assets, comment, supersets, and template ID
  • 9b92e8bb1 - fix(import): restore generic JSON workout template round-tripping
  • aee3eded3 - feat: update user list retrieval to include user ID and adjust admin user handling
  • 2074b8e72 - feat: add user impersonation link generation functionality
  • ff3343503 - fix(docker): prune runtime workspace dependencies
  • 18531d55c - feat: specify exact turbo version in Dockerfiles and update build-plugin.sh
  • e289935df - Remove Moon and migrate to Turbo (#1710)
  • d35ff6244 - feat: update moonrepo CLI version to 1.39.2 in Dockerfiles and workflow
  • a8e532ab7 - Implement single application job locking and sharding (#1709)
  • d354d4c0a - feat(integration): add username filtering for Jellyfin sink

Breaking Changes

  • Removed httpOnly and secure flags from twoFactorSessionStorage cookie
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ryot

Get notified when new releases ship.

Sign up free

About ryot

Roll your own tracker!

All releases →

Related context

Beta — feedback welcome: [email protected]