This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+10 more
ReleasePort's take
Moderate signalVersion 2.5 fixes a critical path‑handling security vulnerability and adds thread‑safety checks for internal URL usage.
Why it matters: The release resolves a high‑severity (90) path‑handling flaw; operators should upgrade immediately to mitigate risk.
Summary
AI summarySecurity issues were resolved, including a path‑handling vulnerability.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixed a security issue in path handling. Fixed a security issue in path handling. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Security | High |
Added security check for internal URL usage to improve thread safety. Added security check for internal URL usage to improve thread safety. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Security | Medium |
QSL-VIA field no longer accepts broken UTF-8 characters. QSL-VIA field no longer accepts broken UTF-8 characters. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Feature | Low |
Added progress information for band/mode/continent in the DXCC award. Added progress information for band/mode/continent in the DXCC award. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added pagination to the QSL Queue table. Added pagination to the QSL Queue table. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added information about received and sent QSL cards in the QSL queue. Added information about received and sent QSL cards in the QSL queue. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added option to show map on dashboard left column. Added option to show map on dashboard left column. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Added new AMSAT Rover Award section to track rover activity. Added new AMSAT Rover Award section to track rover activity. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Cluster display now uses personally configured colors. Cluster display now uses personally configured colors. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Feature | Low |
Station info in the API shows more detail. Station info in the API shows more detail. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Feature | Low |
Redesigned satellite pass page to improve usage. Redesigned satellite pass page to improve usage. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Feature | Low |
Updated dashboard design to a fresher look. Updated dashboard design to a fresher look. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Feature | Low |
Unified many analytics pages for consistent appearance. Unified many analytics pages for consistent appearance. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Performance | Low |
QSO editing now validates input to prevent corrupt data. QSO editing now validates input to prevent corrupt data. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Performance | Low |
Batch editing in Logbook Advanced validates data types to avoid text‑in‑number fields. Batch editing in Logbook Advanced validates data types to avoid text‑in‑number fields. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Medium |
Fixed delete bug in QSL queue that deleted items when cancel was clicked. Fixed delete bug in QSL queue that deleted items when cancel was clicked. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed 500 error in QSL gallery for a specific request. Fixed 500 error in QSL gallery for a specific request. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed SQL compatibility issues for servers with strict FULL_GROUP_BY mode. Fixed SQL compatibility issues for servers with strict FULL_GROUP_BY mode. Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Fixed undeclared variables and other minor bugs in Notes-Controller. Fixed undeclared variables and other minor bugs in Notes-Controller. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Missing propagation modes are now correctly shown again. Missing propagation modes are now correctly shown again. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Invalid OQRS page URLs are handled gracefully without warnings. Invalid OQRS page URLs are handled gracefully without warnings. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Bugfix | Low |
Propagation mode is properly reset when spotting from the cluster, avoiding stale values. Propagation mode is properly reset when spotting from the cluster, avoiding stale values. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
| Refactor | Low |
Updated help text in Advanced Logbook for better information. Updated help text in Advanced Logbook for better information. Source: granite4.1:30b@2026-06-06-audit Confidence: low |
— |
Full changelog
This release brings numerous UI improvements for a more consistent look and feel (dashboard, analytics, satellite pass page), new features such as the AMSAT Rover Award, enhanced QSL queue functionality and DXCC progress tracking, along with more robust input validation. Additionally, several security issues were resolved, SQL compatibility problems fixed and various minor bugs eliminated.
Since we fixed some security issues and vulnerabilities, it's highly recommended to update to this release.
- Added progress information for band/mode/continent in the DXCC award (by @AndreasK79)
- Fixed a delete bug in the QSL queue, where it would be deleted if you clicked cancel (by @AndreasK79)
- Added information about received and sent QSL cards in the QSL queue (by @AndreasK79)
- Added pagination to the table in the QSL Queue (by @AndreasK79)
- Updated the help text in the Advanced Logbook to be more informative (by @AndreasK79)
- Updated the dashboard look to a more fresh design (by @AndreasK79 and @int2001)
- Updated many pages in Wavelog to have a more similar look. Especially pages under analytics did have different designs (by @AndreasK79)
- Did a redesign of the satellite pass page, improving usage (by @AndreasK79)
- QSO editing now validates input to prevent corrupt data (by @int2001)
- Batch editing in Logbook Advanced validates data types (no more accidental text-in-number fields) (by @int2001)
- Missing propagation modes are now correctly shown again (by @int2001)
- QSL-VIA field no longer accepts broken UTF-8 characters (by @int2001)
- Invalid OQRS page URLs no longer show warnings — they handle gracefully (by @int2001)
- Cluster display now uses your personally configured colors (by @int2001)
- New AMSAT Rover Award section to track rover activity (by @int2001)
- Station info in the API now shows more detail (by @int2001)
- Propagation mode is now properly reset when spotting from the cluster (no stale values carried over) (by @int2001)
- Fixed SQL compatibility issues for servers with strict FULL_GROUP_BY mode (by @AndreasK79 and @int2001)
- Fixed some minor bugs (undeclared vars, etc.) at Notes-Controller (@int2001)
- Support for Tevel-2 sat fleet updated in amsat status posts (by @phl0)
- Added option to show map on dashboard in the left column (by @phl0)
- Fixed a security issue in path handling (by @HB9HIL)
- Fixed a bug in qsl gallery which led to a err 500 for one request (by @HB9HIL)
- Added security check for internal used url's to make them more threadsafe (by @HB9HIL)
- Extended the dockerignore file to get rid of files which are not needed in the image (by @HB9HIL)
- Redesigned the "404 Not Found" just to be a bit more pretty (by @HB9HIL)
- Removed unused config elements from the sample config (by @HB9HIL)
Breaking Changes
- Removed unused config elements from the sample config
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Wavelog
Webbased Logging Software for Radio Amateurs. Enhanced QSO logging, statistics and maps for your browser.
Beta — feedback welcome: [email protected]