This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+2 more
Affected surfaces
ReleasePort's take
Moderate signalVersion v0.16.0 fixes a Path Traversal vulnerability in the Toggl ZIP Data Importer that allowed arbitrary directory creation and filesystem probing.
Why it matters: The fix addresses CVE GHSA-cj49-589g-wp6j (severity 95) which permits attackers to create directories and probe the filesystem; upgrade immediately if using the importer.
Summary
AI summaryFixed a Path Traversal vulnerability in the Toggl ZIP Data Importer that permitted arbitrary directory creation and filesystem probing.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes Path Traversal vulnerability in Toggl ZIP Data Importer (GHSA-cj49-589g-wp6j). Fixes Path Traversal vulnerability in Toggl ZIP Data Importer (GHSA-cj49-589g-wp6j). Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Adds Client name display to Project-Task-Selector. Adds Client name display to Project-Task-Selector. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Medium |
Adds filter to include/exclude tags in the application. Adds filter to include/exclude tags in the application. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Performance | Medium |
Improves performance for large data collections via pagination and virtualizers. Improves performance for large data collections via pagination and virtualizers. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes Clockify importer dropping client column by adapting to the change. Fixes Clockify importer dropping client column by adapting to the change. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Fixes pagination silently dropping items by adding ID tiebreaker to sorting. Fixes pagination silently dropping items by adding ID tiebreaker to sorting. Source: llm_adapter@2026-07-16 Confidence: low |
— |
| Bugfix | Medium |
Ensures stable sorting in pagination by adding ID tiebreaker. Ensures stable sorting in pagination by adding ID tiebreaker. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
[!NOTE]
This release includes security fixes, please make sure to upgrade as soon as possible.
What's Changed
- The Project-Task-Selector now also shows the Client name
- Add filter to include/exclude tags by @smileBeda in https://github.com/solidtime-io/solidtime/pull/1133
- Performance optimizations for large data collections (projects, clients, tasks) in the index views and dropdown components via pagination and virtualizers by @Onatcer in https://github.com/solidtime-io/solidtime/pull/1140
Smaller Fixes
- Clockify exports now sometimes drop the client column, so we changed the importer to adopt to that change
- Large collections from imports caused the pagintion to silently drop items when iterating through it because the created_at was used as the only sorting key, it now guarantees stable sorting via the ID as a tiebreaker
Security
- Thanks to @bharatdevasani for reporting a Path Traversal issue in Toggl ZIP Data Importer, which allowed for arbitrary directory creation & filesystem existence oracle. It was fixed in this version as well.
New Contributors
- @smileBeda made their first contribution in https://github.com/solidtime-io/solidtime/pull/1133
Full Changelog: https://github.com/solidtime-io/solidtime/compare/v0.15.1...v0.16.0
Security Fixes
- GHSA-cj49-589g-wp6j — Path Traversal issue in Toggl ZIP Data Importer allowing arbitrary directory creation & filesystem existence oracle
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]