This release includes 1 security fix for security teams reviewing exposed deployments.
Published 25d
Automation & Workflows
✓ No known CVEs patched
This release patches 1 known CVE
Topics
finance
finance-management
go
self-hosted
htmx
subscription
+2 more
tracking
vibecoding
Affected surfaces
auth
Summary
AI summaryAdds a Telegram notification channel with secure token handling.
Full changelog
What's New
Telegram Notifications (#81) — thanks @kochj23
- New Telegram notification channel alongside email, Pushover, and webhooks
- Renewal reminders, cancellation reminders, and high-cost alerts can now be delivered via a Telegram bot
- Settings page card to configure bot token and chat ID, with a test-connection button
- Automatic retry with exponential backoff on transient Telegram API errors
Wallos Import (#65) — thanks @kochj23
- Import subscriptions from a Wallos "Export to JSON" file
- Merge and replace import modes; categories are created automatically
- Handles Wallos payment cycles, currency symbols, and active/cancelled status
Localized API Documentation (#116) — thanks @kochj23
- The API Documentation section of Settings is now fully translated in English, German, Spanish, and Dutch
Technical Changes
- Redact the Telegram bot token from transport error messages so it can never leak into server logs or test-connection responses
- Fix cross-PR test incompatibility between the Telegram and Wallos changes
- New i18n keys for Telegram, Wallos import, and API documentation across all four locales
Security Fixes
- Redacts Telegram bot token from transport error messages preventing log leakage
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]