This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+10 more
Affected surfaces
ReleasePort's take
Light signalThe release fixes inflated province totals in WAPC award summaries and tightens SQL input validation in Search to block dangerous keywords.
Why it matters: Fixes incorrect QSO counts for provinces spanning multiple DXCC entities; blocks malicious SQL injection attempts by validating against the logbook schema (severity 60).
Summary
AI summaryRenamed dashboard stat labels to clarify QSO counts by year, month, and today.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Tightens input validation in Search, blocking dangerous SQL keywords and validating against the logbook schema. Tightens input validation in Search, blocking dangerous SQL keywords and validating against the logbook schema. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Adds cron lock to rate limit the cron endpoint. Adds cron lock to rate limit the cron endpoint. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Adds CORS support to API controller. Adds CORS support to API controller. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Adds dashboard cards for active DXpeditions and contests. Adds dashboard cards for active DXpeditions and contests. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Redesigns Global Options pages for a unified look. Redesigns Global Options pages for a unified look. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Feature | Low |
Clarifies dashboard stat labels by renaming "Year / Month / Today" cards to "QSOs this year / this month / today". Clarifies dashboard stat labels by renaming "Year / Month / Today" cards to "QSOs this year / this month / today". Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Performance | Low |
Improves login and session update performance by refactoring session data updates. Improves login and session update performance by refactoring session data updates. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Medium |
Fixes inflated province totals in WAPC award summary when a province spans multiple DXCC entities. Fixes inflated province totals in WAPC award summary when a province spans multiple DXCC entities. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Low |
Verifies QSL card images exist before attempting deletion. Verifies QSL card images exist before attempting deletion. Source: llm_adapter@2026-06-14 Confidence: high |
— |
| Bugfix | Low |
Checks for free disk space before uploading images. Checks for free disk space before uploading images. Source: llm_adapter@2026-06-14 Confidence: high |
— |
Full changelog
Version 2.5.1
With this release we added some performance and security tweaks as well as a redesign of the Dashboard. Making Look'n'feel of Wavelog more unified.
Don't forget to update your WavelogGate, too. It supports now Transverters, when - e.g. - working QO100.
- Fixed the WAPC award summary — province totals were inflated when a province spans multiple DXCC entities (e.g. Taiwan across BV/BV9); now each province counts once (by @cebarobot)
- Refactored session data update during usage to improve login and session update performance (by @HB9HIL)
- Added cron lock to rate limit the cron endpoint (by @HB9HIL)
- Updated Readme (by @HB9HIL)
- Refactored Dockerimage to allow $users to set custom UID/GID in the docker compose (by @HB9HIL and @int2001)
- Refactored Path Library and userdata path handling to have a single endpoint for userdata (by @HB9HIL)
- Added CORS support to API controller (by @int2001)
- Tightened input validation in Search (by @int2001)
- Verify QSL card images exist before delete (by @int2001)
- Check for free diskspace b4 uploading Images (by @int2001)
- Added dashboard cards for active DXpeditions & contests (by @AndreasK79)
- Redesigned the Global Options pages (by @AndreasK79)
- Made dashboard stat labels clearer — renamed the "Year / Month / Today" cards to "QSOs this year / this month / today" so they're unambiguous (by @AndreasK79)
- Hardened the advanced search against SQL injection — blocked additional dangerous SQL keywords, and now validates every search field against the real logbook table schema (by @AndreasK79)
Security Fixes
- Hardened advanced search against SQL injection by blocking dangerous keywords and validating fields against the logbook schema
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Wavelog
Webbased Logging Software for Radio Amateurs. Enhanced QSO logging, statistics and maps for your browser.
Beta — feedback welcome: [email protected]