Skip to content

NutriTrace

v1.0.0-rc.53 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 21d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

android calorie-counter capacitor docker fitbit food-tracker
+12 more
garmin health health-connect nutrition nutrition-tracker oidc pwa self-hosted sso svelte wellness withings

Affected surfaces

deps

Summary

AI summary

Dependency security updates patch high-severity DoS and TLS bypass vulnerabilities.

Full changelog

Added

  • Reorder + Hide Statistics Categories. You can now shape the Statistics page to your habits. Head to Settings → Statistics → Categories, drag any metric row to change the order it appears in the chip strip, or toggle it off if you never look at it. Works across nutrients, body stats, water, and wellness metrics in a single flat list. (#85, suggested by LoveHonorGirth)
  • Bulk Delete on Foods, Meals, and Recipes. Long-press any item in your catalog and pick "Select Multiple" from the menu. Tap other items to add them to the selection, then hit delete for one confirmation instead of a dozen. Matches the multi-select UX the Diary already uses. Diary entries that reference deleted items keep their nutrition snapshot but lose the link to the source.

Fixed

  • Sync Icon Rotation Direction. The sync buttons on the Wellness page (Fitbit, Garmin, Withings, Google Health) now rotate in the direction their arrows point. Previously the arrowheads and the rotation ran in opposite directions, which looked wrong every time. (#86, reported by LoveHonorGirth)

Security

  • Dependency Security Updates. Bumped multer 1.4.5-lts.1 → 2.2.0 (patches three high-severity DoS CVEs on the LTS line), nodemailer 8.0.7 → 9.0.3 (patches five CVEs including a TLS OAuth certificate-validation bypass and CRLF header injection), and vite 6.4.1 → 6.4.3 (dev-only, patches a server.fs.deny bypass on Windows). Clears every actionable Dependabot alert. No user-facing changes; self-hosters running Docker just need to pull the new image.

Signed APK on the release page. Docker image is multi-arch (amd64 + arm64):

docker compose pull && docker compose up -d

Security Fixes

  • dep: multer 1.4.5-lts.1 → 2.2.0 patches three high-severity DoS CVEs
  • dep: nodemailer 8.0.7 → 9.0.3 patches five CVEs including TLS OAuth certificate‑validation bypass and CRLF header injection
  • dep: vite 6.4.1 → 6.4.3 (dev‑only) patches a `server.fs.deny` bypass on Windows

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track NutriTrace

Get notified when new releases ship.

Sign up free

About NutriTrace

Personal nutrition tracker

All releases →

Related context

Earlier breaking changes

  • v1.0.0 Enforces strict semver: PATCH for bug fixes, MINOR for features, MAJOR for breaking changes in all future releases.
  • v1.0.0 Retires -rc.N release tags; future releases use strict semver only.

Beta — feedback welcome: [email protected]