Skip to content

TaxHacker

v0.8.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 20d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

accounting ai-analysis currency-exchange expenses gemini invoices
+6 more
llm ocr-recognition ollama openai self-hosted taxes

Affected surfaces

rce_ssrf

Summary

AI summary

Updates ci, deps, and fix across a mixed release.

Full changelog

What's Changed

  • fix: prevent path traversal in deleteFile (SEC-75) by @ekkoitac in https://github.com/vas3k/TaxHacker/pull/86
  • feat: implement smart transaction deduplication and resolution workflow (#92) by @deepakdroi in https://github.com/vas3k/TaxHacker/pull/93
  • Email listener by @vas3k in https://github.com/vas3k/TaxHacker/pull/102
  • fix: repair GHCR Docker build (lockfile sync + email type deps) by @Freika in https://github.com/vas3k/TaxHacker/pull/103
  • ci: add Dependabot config for npm, actions, and docker by @TriplEight in https://github.com/vas3k/TaxHacker/pull/106
  • ci: add build verification workflow for PRs and pushes to main by @TriplEight in https://github.com/vas3k/TaxHacker/pull/107
  • ci: bump docker actions by @TriplEight in https://github.com/vas3k/TaxHacker/pull/108
  • ci: add pre-commit hooks and fix repo-wide lint errors by @TriplEight in https://github.com/vas3k/TaxHacker/pull/109
  • security(compose): add no-new-privileges and harden build/production compose files by @TriplEight in https://github.com/vas3k/TaxHacker/pull/110
  • build: bump Docker base image to node:26-slim by @TriplEight in https://github.com/vas3k/TaxHacker/pull/111
  • chore(deps): bump TypeScript to v6 by @TriplEight in https://github.com/vas3k/TaxHacker/pull/112
  • chore(deps): pin eslint to v9, bump linting toolchain by @TriplEight in https://github.com/vas3k/TaxHacker/pull/113
  • chore(deps): migrate to Prisma 7 by @TriplEight in https://github.com/vas3k/TaxHacker/pull/114
  • build(docker): fix Prisma client generation for multi-arch builds by @TriplEight in https://github.com/vas3k/TaxHacker/pull/115
  • perf(docker): improve build caching and image size, publish branch-tagged images by @TriplEight in https://github.com/vas3k/TaxHacker/pull/116
  • chore(deps): bump Next.js, React, and Tailwind CSS to their current majors by @TriplEight in https://github.com/vas3k/TaxHacker/pull/140
  • feat(ai): add vision capability test button in LLM provider settings by @TriplEight in https://github.com/vas3k/TaxHacker/pull/135

New Contributors

  • @ekkoitac made their first contribution in https://github.com/vas3k/TaxHacker/pull/86
  • @vas3k made their first contribution in https://github.com/vas3k/TaxHacker/pull/102
  • @TriplEight made their first contribution in https://github.com/vas3k/TaxHacker/pull/106

Full Changelog: https://github.com/vas3k/TaxHacker/compare/v0.7.0...v0.8.0

Security Fixes

  • CVE‑SEC-75 — Prevent path traversal vulnerability in deleteFile function
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track TaxHacker

Get notified when new releases ship.

Sign up free

About TaxHacker

Self-hosted AI accounting app. LLM analyzer for receipts, invoices, transactions with custom prompts and categories

All releases →

Related context

Beta — feedback welcome: [email protected]