This release includes 3 security fixes for security teams reviewing exposed deployments.
Published 21d
Productivity & Wikis
✓ No known CVEs patched
This release patches 3 known CVEs
Topics
android
calorie-counter
capacitor
docker
fitbit
food-tracker
+12 more
garmin
health
health-connect
nutrition
nutrition-tracker
oidc
pwa
self-hosted
sso
svelte
wellness
withings
Affected surfaces
deps
Summary
AI summaryDependency security updates patch high-severity DoS and TLS bypass vulnerabilities.
Full changelog
Added
- Reorder + Hide Statistics Categories. You can now shape the Statistics page to your habits. Head to Settings → Statistics → Categories, drag any metric row to change the order it appears in the chip strip, or toggle it off if you never look at it. Works across nutrients, body stats, water, and wellness metrics in a single flat list. (#85, suggested by LoveHonorGirth)
- Bulk Delete on Foods, Meals, and Recipes. Long-press any item in your catalog and pick "Select Multiple" from the menu. Tap other items to add them to the selection, then hit delete for one confirmation instead of a dozen. Matches the multi-select UX the Diary already uses. Diary entries that reference deleted items keep their nutrition snapshot but lose the link to the source.
Fixed
- Sync Icon Rotation Direction. The sync buttons on the Wellness page (Fitbit, Garmin, Withings, Google Health) now rotate in the direction their arrows point. Previously the arrowheads and the rotation ran in opposite directions, which looked wrong every time. (#86, reported by LoveHonorGirth)
Security
- Dependency Security Updates. Bumped
multer1.4.5-lts.1 → 2.2.0 (patches three high-severity DoS CVEs on the LTS line),nodemailer8.0.7 → 9.0.3 (patches five CVEs including a TLS OAuth certificate-validation bypass and CRLF header injection), andvite6.4.1 → 6.4.3 (dev-only, patches aserver.fs.denybypass on Windows). Clears every actionable Dependabot alert. No user-facing changes; self-hosters running Docker just need to pull the new image.
Signed APK on the release page. Docker image is multi-arch (amd64 + arm64):
docker compose pull && docker compose up -d
Security Fixes
- dep: multer 1.4.5-lts.1 → 2.2.0 patches three high-severity DoS CVEs
- dep: nodemailer 8.0.7 → 9.0.3 patches five CVEs including TLS OAuth certificate‑validation bypass and CRLF header injection
- dep: vite 6.4.1 → 6.4.3 (dev‑only) patches a `server.fs.deny` bypass on Windows
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]