Shelf

Security release

This release contains a security fix for GHSA-69xv-wmgg-3qp3.
Affected versions: 1.12 through 1.20.0. Versions 1.11.5 and earlier are not affected.

All self-hosted operators on 1.12+ should upgrade immediately.

Upgrade

docker pull ghcr.io/shelf-nu/shelf.nu:1.20.1
# or, if you track :latest
docker pull ghcr.io/shelf-nu/shelf.nu:latest

Then restart your container. No database migration is required.

Reported by https://github.com/KennethWussmann — thank you.

What's Changed

• chore(deps): bump cookie from 0.4.2 to 0.7.2 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2362
• fix: remove unused swiper package by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2363
• feat: add structured feedback modal with email notifications by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2357
• fix: eslint setup and validate script after Turborepo migration by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2364
• fix: add .eslintignore to lint task inputs in turbo.json by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2365
• fix: wrong user role shown on team member profile pages by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2366
• fix: resolve React 19 hydration error #418 in production by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2371
• fix: prevent client-side crash on user assets list page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2373
• feat: add audit toggle to admin dashboard organization page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2375
• fix: skip onboarding questions for invited users by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2370
• fix: onboarding name fields not taking equal width by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2374
• feat: add audit toggle to admin dashboard organization page by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2377
• feat: add client-side Sentry error capturing by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2372
• fix(docs): image path and update documentation link by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2378
• fix: resolve missing custodian error for checked-out kits by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2379
• chore: migrate from husky to lefthook for faster commit hooks by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2380
• fix: retry 5xx StorageApiError in createSignedUrl() by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2381
• fix: inventory value text wrap + newest assets tablet overflow by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2358
• fix: disable location hierarchy popover for base and self-service users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2382
• fix: resolve workspace name display for addon subscriptions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2383
• fix: lift FeedbackModal to layout level to fix mobile click-through bug by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2384
• fix: split full name into firstName/lastName when accepting invite by @iuryeng in https://github.com/Shelf-nu/shelf.nu/pull/2369
• fix: clear stale husky hooksPath in prepare script by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2387
• Fix: make prepare script self healing by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2388
• fix: address multiple Sentry issues from client-side tracking by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2386
• fix: address bulk Sentry issues from production tracking by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2392
• fix: mobile Check-in button triggers form save instead of opening dropdown by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2391
• fix: prevent duplicate team trial welcome email by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2393
• fix: manage subscriptions button type by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2394
• feat: transfer workspace ownership with optional subscription transfer by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2395
• feat: improve ICS calendar export for bookings by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2389
• fix: add type="submit" to all bulk action dialog confirm buttons by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2396
• docs: rewrite README with accurate tech stack and setup by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2398
• chore(deps): bump all packages to latest minor/patch versions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2400
• fix: downgrade missing custodian log from error to warn by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2401
• feat: require explicit type prop on all Button components by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2397
• fix: prevent emails from being sent to soft-deleted users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2404
• chore(deps): bump hono from 4.12.5 to 4.12.7 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2409
• feat: show asset location in audit scan list on mobile by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2407
• Fix booking deduplication to use composite kit-booking key by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2408
• fix: add explicit form association to checkout dialog buttons by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2403
• fix: batch refresh expired asset image URLs server-side by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2402
• fix: guard against malformed FormData in login and OTP routes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2413
• fix: filter non-actionable browser and extension errors in Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2415
• fix: propagate error context in audit session completion by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2418
• fix: suppress noisy validation errors from Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2414
• perf: batch username check and parallelize assets/new loader by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2416
• fix: resolve client-side React runtime errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2417
• feat: add purchasable barcodes addon with self-service trials by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2405
• fix: allow addon linking when both addons share one subscription by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2420
• fix: resolve new Sentry issues (1CN, 1CP, 1AY, 1B1, 1BA) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2421
• feat: add haptic feedback to QR/barcode scanner on detection by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2422
• feat: add auto-charge safety nets for addon and platform trial subscriptions by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2424
• feat: add display name field for SSO users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2426
• fix: client-side dropdown filter now searches nested fields like email by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2431
• feat: add TeamMemberNote model for admin notes on user profiles by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2429
• feat: hide personal workspaces for SSO users by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2432
• fix: ensure error boundary errors always reach Sentry by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2433
• fix: address P0-P2 Sentry issues from weekly error review by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2439
• chore(deps-dev): bump happy-dom from 20.5.0 to 20.8.9 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2440
• chore(deps): bump nodemailer from 7.0.13 to 8.0.4 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2437
• feat: granular booking email notifications by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2423
• fix: optimize checkout transaction and suppress expected errors by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2443
• feat: add Cloudflare Web Analytics support and document tracking scripts by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2468
• feat: make user-prefs cookie cross-domain for marketing site by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2442
• fix: scope toast notifications to originating browser tab by @iuryeng in https://github.com/Shelf-nu/shelf.nu/pull/2368
• feat(audit): add archive audit lifecycle by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2438
• feat: bulk update existing assets via CSV import by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2428
• fix: restore asset name column in CSV export by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2477
• chore(deps): bump hono from 4.12.7 to 4.12.12 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2476
• perf: skip custom field definitions in asset table query by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2472
• perf: parallelize entity query with asset query in advanced loader by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2473
• chore(deps-dev): bump vite from 7.3.1 to 7.3.2 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2475
• perf: parallelize layout loader, cache middleware regexes, skip empty queries by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2474
• chore(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2478
• perf: eliminate redundant renders and duplicate DB calls on asset index by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2471
• perf: optimize loaders for assets, bookings, and settings routes by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2483
• chore(deps): bump nodemailer from 8.0.4 to 8.0.5 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2482
• fix: use correct SEQUENCE value in iCal export by @pj-gridx in https://github.com/Shelf-nu/shelf.nu/pull/2485
• chore: update patch/minor deps and trivial major bumps by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2484
• fix: address weekly sentry issues (round 4) by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2487
• chore: batch 2 — moderate major package upgrades by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2488
• fix: show full yearly price instead of incorrect monthly conversion by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2489
• chore: delete PRD-granular-booking-notifications.md by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2490
• fix(security): scope booking notes to organization to prevent cross-tenant IDOR by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2492
• feat: bulk archive audits from index page by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2481
• chore(deps): bump hono from 4.12.12 to 4.12.14 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2491
• fix: reduce sidebar toggle lag on CMD+B by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2479
• fix(sentry): suppress 4xx-equivalent and aborted-request noise by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2496
• fix(sentry): suppress auth + not-found wrapper noise by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2497
• fix(sentry): finish weekly cleanup — wrap-aware not-found, hard-filte… by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2498
• feat(audit): permanently delete archived audits (single + bulk) by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2494
• fix(working-hours): compare override dates as absolute calendar days by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2500
• fix(location): enforce org scope on asset and kit relational mutations by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2501
• chore(asset): tighten sort parameter parsing and validation by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2502

New Contributors

• @iuryeng made their first contribution in https://github.com/Shelf-nu/shelf.nu/pull/2369

Full Changelog: https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.20.1

🏗 Monorepo Migration (Major Change)

Shelf has moved from a single-app repository to a pnpm + Turborepo monorepo.

This improves dependency management, build performance, and long-term scalability.
If you're self-hosting or customizing Shelf, this section matters.

What Changed

• Package manager: npm → pnpm (v9.15.4)
• Commands renamed (see mapping below)
• Database schema moved
  • From: app/database/schema.prisma
  • To: packages/database/prisma/schema.prisma
• Project structure updated
  • The Remix app now lives in apps/webapp/ instead of the root

🔄 Upgrading

1️⃣ Install pnpm

corepack enable
corepack prepare [email protected] --activate

Or install globally:

npm install -g [email protected]

2️⃣ Install dependencies

pnpm install

You can safely delete:

• node_modules
• package-lock.json

The monorepo now uses pnpm-lock.yaml.

3️⃣ Start developing

pnpm webapp:dev

🔁 Command Changes

| Before (npm) | After (pnpm) |
|--------------------------------|-----------------------------|
| npm run dev | pnpm webapp:dev |
| npm run build | pnpm webapp:build |
| npm run start | pnpm webapp:start |
| npm run test -- --run | pnpm webapp:test -- --run |
| npm run validate | pnpm webapp:validate |
| npm run lint | pnpm turbo lint |
| npm run typecheck | pnpm turbo typecheck |
| npm run db:generate-type | pnpm db:generate |
| npm run db:prepare-migration | pnpm db:prepare-migration |
| npm run setup | pnpm webapp:setup |

📁 New Project Structure

shelf/
├── apps/
│   └── webapp/          ← Remix app (was at root before)
├── packages/
│   └── database/        ← Prisma schema, migrations, and client
├── tooling/
│   └── typescript/      ← Shared tsconfig
├── turbo.json
├── pnpm-workspace.yaml
└── .env                 ← Still at the root

🌱 Environment Variables

No changes required.
The .env file remains at the monorepo root.

🐳 Docker

Official Docker images continue to work.

If you use a custom Dockerfile:

• App entrypoint is now:

  apps/webapp/start.sh
  

• It runs:

  node ./build/server/index.js
  

• Builds now rely on turbo prune for efficiency.

🧩 Custom Prisma Schema Changes

If you modified the Prisma schema, move it from:

app/database/schema.prisma

to:

packages/database/prisma/schema.prisma

Migrations now live in:

packages/database/prisma/migrations/

✨ Features

• feat: redesign Dashboard → Home with Stripe-inspired widget grid by @carlosvirreira in https://github.com/Shelf-nu/shelf.nu/pull/2350
• feat: migrate to pnpm + Turborepo monorepo by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2351

🐛 Fixes

• fix: prevent "Create new audit" link from treating "new" as audit ID by @DonKoko in https://github.com/Shelf-nu/shelf.nu/pull/2360

🧹 Chores

• chore(deps-dev): bump minimatch from 3.1.2 to 3.1.4 by @dependabot[bot] in https://github.com/Shelf-nu/shelf.nu/pull/2359

Full Changelog:
https://github.com/Shelf-nu/shelf.nu/compare/[email protected]@1.20.0