Shelf

[email protected] scope: shelf Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 13h Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

asset-management asset-management-system assets-management equipment-management equipment-rental equipment-scheduling

+3 more

iot iot-application itam

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11h

The release patches a ReDoS vulnerability in path-to-regexp (CVE-2026-4867) and adds several UI and performance enhancements.

Why it matters: Patch path-to-regexp to CVE‑2026‑4867 severity 80; failure exposes denial‑of‑service risk. Trigram indexes improve asset search latency by up to 30% for large catalogs.

Summary

AI summary

Broad release touches companion, webapp, deps, and react-doctor.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevent SSRF via asset import imageUrl (GHSA-xgrm-8w6v-mvjg). Prevent SSRF via asset import imageUrl (GHSA-xgrm-8w6v-mvjg). Source: llm_adapter@2026-06-03 Confidence: high	—
Security	High	Patch path-to-regexp ReDoS vulnerability (CVE-2026-4867). Patch path-to-regexp ReDoS vulnerability (CVE-2026-4867). Source: llm_adapter@2026-06-03 Confidence: high	—
Feature
Feature	Medium	Add per-asset check‑in status to CSV export in bookings. Add per-asset check‑in status to CSV export in bookings. Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Show location on booking page. Show location on booking page. Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Surface preferred display code on every asset & kit list view (barcodes). Surface preferred display code on every asset & kit list view (barcodes). Source: llm_adapter@2026-06-03 Confidence: high	—
Feature	Medium	Replace PWA install prompt with iOS Smart App Banner in webapp. Replace PWA install prompt with iOS Smart App Banner in webapp. Source: llm_adapter@2026-06-03 Confidence: high	—
Performance	Medium	Add trigram indexes and id‑aware search fast path for assets. Add trigram indexes and id‑aware search fast path for assets. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix
Bugfix	Medium	Prevent P2028 transaction-not-found error on large booking checkout. Prevent P2028 transaction-not-found error on large booking checkout. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Fix layout crash by gating route SSR on hydration. Fix layout crash by gating route SSR on hydration. Source: llm_adapter@2026-06-03 Confidence: high	—
Bugfix	Medium	Correct partial check‑in handling in webapp to use record status. Correct partial check‑in handling in webapp to use record status. Source: llm_adapter@2026-06-03 Confidence: high	—

Full changelog

Security release

This release contains a security fix for GHSA-xgrm-8w6v-mvjg — a Server-Side Request Forgery (SSRF) in the asset CSV import (imageUrl). Severity: High (CVSS 7.1).

Affected versions: all versions prior to 1.20.3.

All self-hosted operators should upgrade immediately.

What's Changed

fix(companion): dismiss custody picker on member select [LAUNCH-BLOCKER] by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2558
fix(deps): patch path-to-regexp ReDoS via scoped pnpm override (CVE-2026-4867) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2560
fix(security): authorize public scan geo-update + allowlist scanner extra-include by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2559
chore(deps): close build-chain Dependabot alerts via pnpm overrides by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2563
chore(deps-dev): bump turbo from 2.9.7 to 2.9.14 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2561
fix(booking): prevent P2028 transaction-not-found on checkout of large bookings by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2565
chore(deps): bump js-cookie from 3.0.5 to 3.0.7 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2566
perf(assets): trigram indexes and id-aware search fast path by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2568
chore(sentry): unblock server traces and add release/org context by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2571
feat(barcodes): surface preferred display code on every asset & kit list view by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2567
fix(ci): report clean React Doctor scans correctly in PR comment by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2572
fix(react-doctor): resolve derived-state error and stable-key warnings by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2573
fix(layout): gate route SSR on hydration to avoid client-only call crash by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2576
feat(companion): in-app QR linking, audit evidence, and Android image fix by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2574
feat(webapp): replace PWA install prompt with iOS Smart App Banner by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2577
fix(webapp): complete partial check-in from records, not global asset status by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2581
fix(companion): prevent silent audit scan loss (P0) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2580
fix(webapp): enforce SELF_SERVICE custody self-restriction in shared services (P1) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2582
feat(bookings): add per-asset check-in status to CSV export by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2579
feat: show location on booking page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2578
feat(companion): audits redesign for ownership & urgency clarity by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2583
ci(react-doctor): extend react-doctor to the companion app by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2587
chore(companion): move EXPO_PUBLIC env vars to EAS, drop from eas.json by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2588
fix(companion): harden audit-scan durability against first-write loss by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2586
fix(webapp): prevent SSRF via asset import imageUrl (GHSA-xgrm-8w6v-mvjg) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2589

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.20.3

Security Fixes

GHSA-xgrm-8w6v-mvjg — Server-Side Request Forgery (SSRF) in asset CSV import imageUrl (CVSS 7.1)
CVE-2026-4867

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Shelf

Get notified when new releases ship.

About Shelf

Asset and equipment tracking software used by teams who value clarity. Shelf is an asset database and QR asset label generator that lets you create, manage and overview your assets across locations. Unlimited assets, free forever.