Oikos

v1.27.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 9d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

docker family family-planner home-automation planner-app privacy-first

+4 more

progressive-web-app pwa self-hosted selfhosted-apps

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 9d

The release hardens SSRF protection to block additional private and special‑use IP ranges and replaces node-fetch with the built‑in HTTP client while keeping outbound behavior unchanged.

Why it matters: SSRF protection now blocks broader non‑public destinations (severity 90) and fixes an IPv4‑mapped IPv6 gap, reducing risk of internal network exposure; dependency update eliminates external node-fetch usage without altering behavior.

Summary

AI summary

SSRF protection hardened to block additional private and special‑use IP ranges.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Hardened SSRF protection blocks broader non-public destinations and fixes IPv4-mapped IPv6 gap. Hardened SSRF protection blocks broader non-public destinations and fixes IPv4-mapped IPv6 gap. Source: llm_adapter@2026-07-17 Confidence: high	—
Dependency	Medium	Replaced `node-fetch` with built-in HTTP client; outbound behavior unchanged. Replaced `node-fetch` with built-in HTTP client; outbound behavior unchanged. Source: llm_adapter@2026-07-17 Confidence: high	—

Full changelog

Changed

Replaced the node-fetch dependency with a small built-in HTTP client. Outbound requests (ICS calendar subscriptions, subscription logo lookup and WebDAV document storage) behave the same as before, including transparent gzip/deflate/br response decompression; no configuration change is required.

Security

Consolidated the SSRF (server-side request forgery) protection shared by ICS subscriptions, subscription logo lookup and WebDAV document storage into a single hardened check. It now blocks a broader set of non-public destinations (carrier-grade NAT, benchmarking and reserved ranges, and additional IPv6 special-use prefixes) and closes a gap where the logo lookup did not recognise IPv4-mapped IPv6 addresses.

Security Fixes

SSRF protection consolidated and hardened to block carrier‑grade NAT, benchmarking ranges, reserved IPv4/IPv6 addresses, and correctly handle IPv4‑mapped IPv6 addresses in logo lookup.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Oikos

Get notified when new releases ship.

About Oikos

Family planner for small households

All releases →

Related context

Related tools

Earlier breaking changes

v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
v0.66.0 Project renamed from Oikos to Yuvomi.
v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.