Oikos

v0.55.19 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

docker family family-planner home-automation planner-app privacy-first

+4 more

progressive-web-app pwa self-hosted selfhosted-apps

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 1d

The installer wizard is now fully localized into all 16 supported languages and includes an optional Advanced step for configuring reverse‑proxy/HTTPS, SSO (OIDC), and automatic backups.

Why it matters: Localization expands usability for global users; the Advanced step simplifies complex deployment setups. Hardened .env writing rejects newline values to prevent injection, with severity 90 indicating high risk.

Summary

AI summary

Installer wizard fully localized into all 16 languages, adds an optional Advanced step for reverse‑proxy/HTTPS, SSO, backups, and hardens .env writes.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Hardened installer `.env` writing: keys are allow‑listed against env schema and newline values are rejected to prevent injection. Hardened installer `.env` writing: keys are allow‑listed against env schema and newline values are rejected to prevent injection. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature
Feature	Low	Installer wizard fully localized into all 16 supported languages with automatic browser-language detection. Installer wizard fully localized into all 16 supported languages with automatic browser-language detection. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	Added optional "Advanced" installer step for reverse‑proxy/HTTPS, SSO (OIDC), and automatic backups configuration. Added optional "Advanced" installer step for reverse‑proxy/HTTPS, SSO (OIDC), and automatic backups configuration. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	Installer now verifies Docker prerequisites before starting the wizard and shows container errors in UI. Installer now verifies Docker prerequisites before starting the wizard and shows container errors in UI. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	`GET /api/preflight` reports presence of existing `.env` file and running `oikos` container. `GET /api/preflight` reports presence of existing `.env` file and running `oikos` container. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	Installer adopts app's design language: shared tokens, Plus Jakarta Sans with violet accent and automatic dark mode. Installer adopts app's design language: shared tokens, Plus Jakarta Sans with violet accent and automatic dark mode. Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	Installer wizard now meets WCAG 2.1 AA accessibility standards (keyboard navigation, ARIA attributes, focus management). Installer wizard now meets WCAG 2.1 AA accessibility standards (keyboard navigation, ARIA attributes, focus management). Source: llm_adapter@2026-06-02 Confidence: high	—
Feature	Low	`docker-compose.yml` maps host port from `${OIKOS_HTTP_PORT:-3000}` and derives `SESSION_SECURE` from `.env`, enabling reverse‑proxy setups without manual edits. `docker-compose.yml` maps host port from `${OIKOS_HTTP_PORT:-3000}` and derives `SESSION_SECURE` from `.env`, enabling reverse‑proxy setups without manual edits. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Installer now persists selected timezone (`TZ`) and HTTP port (`OIKOS_HTTP_PORT`) to `.env` so choices take effect. Installer now persists selected timezone (`TZ`) and HTTP port (`OIKOS_HTTP_PORT`) to `.env` so choices take effect. Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Installer backs up existing `.env` to `.env.bak-<ISO>` before overwriting, preventing loss on re‑run; `install.sh` does the same. Installer backs up existing `.env` to `.env.bak-<ISO>` before overwriting, preventing loss on re‑run; `install.sh` does the same. Source: llm_adapter@2026-06-02 Confidence: high	—

Full changelog

Added

Installer wizard is fully localized into all 16 supported languages with automatic browser-language detection, via its own tools/installer/locales/*.json and i18n-mini.js (mirrors the app's locale resolution; de is the reference, en the fallback).
New optional "Advanced" installer step covering reverse-proxy/HTTPS deployments (sets SESSION_SECURE/TRUST_PROXY), Single Sign-On (OIDC), and automatic backups — all configurable without hand-editing .env.
Installer verifies Docker prerequisites before the wizard starts and surfaces container start/spawn errors in the UI instead of failing silently.
GET /api/preflight reports whether an existing .env file and a running oikos container are present.

Changed

Installer adopts the app's design language: shared design tokens and Plus Jakarta Sans (violet accent, matching radii/shadows, automatic dark mode), served read-only from the repo.
Installer wizard now meets WCAG 2.1 AA — keyboard-operable accordion buttons (aria-expanded/aria-controls), role="alert" error banners, a live role="status" Docker-status region, focus moved to the active step heading on navigation, labelled password-visibility toggles, a step counter derived from the step list, and a unified error-banner style.
docker-compose.yml maps the chosen host port (${OIKOS_HTTP_PORT:-3000}:3000) and derives SESSION_SECURE from .env (${SESSION_SECURE:-false}), so reverse-proxy setups take effect without manual edits; default 3000/false behaviour is unchanged.

Fixed

Installer persists the user-selected timezone (TZ) and HTTP port (OIKOS_HTTP_PORT) to .env so the choices actually take effect; install.sh gains the same fields for CLI parity.
Installer backs up an existing .env to .env.bak-<ISO> before overwriting, so re-runs no longer destroy an existing configuration; install.sh does the same.

Security

Hardened installer .env writing against injection: keys are allowlisted against the shared env schema and values containing newlines are rejected.

Security Fixes

.env writing hardened against injection: keys allowlisted, newline values rejected

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Oikos

Get notified when new releases ship.

About Oikos

Family planner for small households

All releases →