Oikos

v1.7.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 16d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

docker family family-planner home-automation planner-app privacy-first

+4 more

progressive-web-app pwa self-hosted selfhosted-apps

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 11d

ICS calendar subscriptions now validate destination IP at connection time, closing a DNS-rebinding vulnerability.

Why it matters: The update eliminates a high-severity (severity 90) DNS‑rebinding risk for ICS calendar feeds; operators should upgrade to v1.7.1 immediately.

Summary

AI summary

ICS calendar subscriptions now validate destination IP at connection time, closing a DNS-rebinding vulnerability.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Validates destination IP at connection time, closing DNS-rebinding vulnerability. Validates destination IP at connection time, closing DNS-rebinding vulnerability. Source: llm_adapter@2026-07-15 Confidence: high	—
Security	High	Rejects literal private IPs (IPv4/IPv6) in ICS sources. Rejects literal private IPs (IPv4/IPv6) in ICS sources. Source: granite4.1:30b@2026-07-15-audit Confidence: low	—
Dependency	Low	Bumped `tsdav` to 2.3.1 and pinned build-script permissions for several packages. Bumped `tsdav` to 2.3.1 and pinned build-script permissions for several packages. Source: llm_adapter@2026-07-15 Confidence: high	—

Full changelog

Security

ICS calendar subscriptions and one-off feed imports now validate the destination IP at the moment the connection is established, closing a DNS-rebinding hole where an attacker-controlled hostname could pass the pre-flight private-IP check but resolve to an internal address (e.g. cloud metadata) during the actual fetch. Literal private IPs — including IPv6 loopback and IPv4-mapped IPv6 in both decimal and hex form — are now rejected as well. The ICS_SUBSCRIPTION_ALLOW_PRIVATE_NETWORK opt-in continues to bypass both checks for trusted LAN feeds.

Changed

Bumped tsdav to 2.3.1 and pinned build-script permissions (allowScripts) for better-sqlite3, bcrypt and puppeteer.

Security Fixes

ICS_SUBSCRIPTION_ALLOW_PRIVATE_NETWORK bypass remains, but destination IP validation now closes DNS-rebinding hole; literal private IPs are rejected.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Oikos

Get notified when new releases ship.

About Oikos

Family planner for small households

All releases →

Related context

Related tools

Earlier breaking changes

v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
v0.66.0 Project renamed from Oikos to Yuvomi.
v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.