Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content

Packages

6.1k Topics 59.3k Posts

Questions about packages in the App Store

Everything related to the PHP CVE and eMudhra Cert Please read our Security issue thread - PHP and eMudhra cert compromise.

Subcategories


  • 9 78
    9 Topics
    78 Posts
    Package UpdatesP
    [1.22.0] Update 2FAuth to 9.0.0 Full Changelog Brand new Table layout for desktop resolution and higher. Favorite system: Frequently used 2FA accounts can be marked as favorite, regardless of whether they belong to a group. You can easily find your favorites again thanks to a brand new toggle in the filter bar. New quick-select buttons when managing 2FA accounts to make it easier to select accounts that are likely to be targeted by the action buttons (Move, Unshared, Delete, Export) Support of Ente Auth export format issue #571 Docker image: large API responses truncated (Network Error) when container runs as non-root user - fastcgi_temp_path not writable issue #575 Composer advisory block (enshrined/svg-sanitize) causes setup failure
  • 10 89
    10 Topics
    89 Posts
    Package UpdatesP
    [1.10.1] Update Ackee to 3.7.1 Full Changelog
  • 7 64
    7 Topics
    64 Posts
    Package UpdatesP
    [1.31.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 41 438
    41 Topics
    438 Posts
    Package UpdatesP
    [1.15.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 12 115
    12 Topics
    115 Posts
    S
    This look like a good replacement for Alltube (which we were using) https://github.com/alexta69/metube
  • 4 10
    4 Topics
    10 Posts
    Package UpdatesP
    [0.5.0] Update affine | stage to 0.27.4
  • 16 198
    16 Topics
    198 Posts
    Package UpdatesP
    [1.33.1] Remove the ldap addon, login is via OIDC only
  • 7 Topics
    70 Posts
    Package UpdatesP
    [1.8.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 6 28
    6 Topics
    28 Posts
    K
    @girish I understand. Thanks!
  • 4 25
    4 Topics
    25 Posts
    jamesJ
    Hello @andreasdueren Thanks for the report. Fixing it right now.
  • 8 Topics
    126 Posts
    Package UpdatesP
    [1.102.1] Update audiobookshelf to 2.37.2 Full Changelog File copy and move fails with EPERM on some systems (e.g. TrueNAS) #5637 by @nichwall in #5668 RSS feed cover images not updating after cover change #5306 by @SharonZhu0122 in #5418 Audible search when API returns null products #5176 by @boqiaok in #5430 Upload crash when multipart form repeats file fields by @rtainaan in #5437 Debian package ships audiobookshelf.service with executable bit causing systemd warnings on install/upgrade #5629 ROUTER_BASE_PATH env variable normalized (leading slash, no trailing slash)
  • 10 35
    10 Topics
    35 Posts
    girishG
    Thanks for reporting here @gardinermichael . We have in fact hidden the app package because there were many issues with it and we couldn't manage to get it to be stable . Maybe we should revisit this.
  • 40 414
    40 Topics
    414 Posts
    Package UpdatesP
    [1.40.2] Update base | stage to 6.0.1 security: fix eMudhra cert compromise
  • 5 70
    5 Topics
    70 Posts
    Package UpdatesP
    [1.9.2] Update beszel to 0.21.1 Full Changelog Add TLS certificate expiry alert for network monitors (#2627) Add opt-in cgroup CPU and memory accounting (#2505) Add pagination with a shared rows-per-page setting to data tables (#2444) Add IRQ, SoftIRQ and Nice to the CPU usage breakdown (#2647) Add OAUTH_DEFAULT_USER_ROLE environment variable to set the role of new OAuth users (#2516) Fix users being able to reassign record ownership through updates (#2632) Fix dashboard universal tokens appearing in request URLs (#2630) Fix fan sensor reads blocking collection indefinitely (#2638, #2639) Fix HTTPS monitor certificates not being re-checked (now hourly) (#2673) Fix scheduled monitor probes running while the hub isn't requesting stats
  • 13 264
    13 Topics
    264 Posts
    Package UpdatesP
    [2.3.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 1 13
    1 Topics
    13 Posts
    Package UpdatesP
    [1.2.0] Update python-base | final to 3.14-20261023 security: fix eMudhra cert compromise
  • 11 130
    11 Topics
    130 Posts
    Package UpdatesP
    [2.10.3] fix: update doc links from /apps/ to /packages/
  • 58 716
    58 Topics
    716 Posts
    J
    @marylou unfortunately, upstream calcom has stopped development and it is not an opensource project anymore. Might be best to migrate away to another app like Tymeslot or our Calendar app (which has booking pages).
  • 23 124
    23 Topics
    124 Posts
    luisakakpoL
    Indeed, it's understandable, it could add complexity rather fast.. Thank you for the reference, did not know about tymeslot. I'll check it out.
  • 35 338
    35 Topics
    338 Posts
    Package UpdatesP
    [1.45.0] Update python-base | final to 3.13-20261023 security: fix eMudhra cert compromise
  • 18 158
    18 Topics
    158 Posts
    Package UpdatesP
    [2.14.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 28 Topics
    392 Posts
    Package UpdatesP
    [1.36.1] Update changedetection.io to 0.60.10 Full Changelog LLM restock: fix locale-formatted string prices (1.299,95 read as 1.29995) by @dgtlmoon in #4544 Puppeteer fetcher - PDF improvements, Handle PDF fetching by Puppeteer directly, cleanup supports by @dgtlmoon in #4547 PDF - Keep the original PDF of the newest two versions by @dgtlmoon in #4549 UI - Fixing notification settings still trying to access main settings form that caused a crash on save by @dgtlmoon in #4561 UI - Follow the device's light/dark setting by default by @cookieguru in #4507 Notifications - Fix |regex_replace doing nothing when rendered outside the main thread by @Enesuygurs in #4577 feat(api): expand SystemInfo endpoint with queue metrics, config flags, and tag_count by @Subere in #4574 Fix IndexError on empty/whitespace-only JSON content by @Yi-111-a in #4534 Fix Jinja2 false-positive when URL contains {% by @skkzsh in #4208 API - Recheck only watches with errors, never recheck paused watches (#4506) by @dgtlmoon in #4601
  • 1 3
    1 Topics
    3 Posts
    Package UpdatesP
    [1.0.1] Update chat to 1.0.1 Improve composer layout and support compact and full version
  • 62 463
    62 Topics
    463 Posts
    Package UpdatesP
    [1.57.2] Update chatwoot to 4.19.1 Full Changelog Updated Node.js to the 24.22.1 security release. Hardened Twilio webhook verification and CSS sanitization. Added business hours and withheld caller ID support for Twilio calls. [Enterprise] Improved WhatsApp campaign recovery and duplicate-send protection. [Enterprise] Added SAML metadata URL support with certificate refresh. [Enterprise] Updated Captain AI and transcription models. [Enterprise] Added Stripe and auto-translation to paid Cloud plan entitlements. Fixed duplicate Help Center articles and conflicting inbox bots. Removed unnecessary session cookies from public pages. Thanks to @xamimran for the contributions.
  • 41 Topics
    528 Posts
    Package UpdatesP
    [1.63.0] Update code to 26.04.5.2.1 Full Changelog
  • 3 33
    3 Topics
    33 Posts
    Package UpdatesP
    [1.10.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 12 81
    12 Topics
    81 Posts
    girishG
    @gh0stface yup, they made a release yesterday it seems and it should have the PRs we made upstream. @vladimir-d is checking the package again.
  • 20 127
    20 Topics
    127 Posts
    U
    @girish Yep, exactly that. AnyType and Appflowy are growing in popularity. Would be nice to see them
  • 8 57
    8 Topics
    57 Posts
    Package UpdatesP
    [1.10.1] Update contacts to 6515ce1 security: fix eMudhra cert compromise
  • 2 Topics
    23 Posts
    Package UpdatesP
    [1.4.0] Update container-registry to 17adb1d security: fix eMudhra cert compromise
  • 4 Topics
    25 Posts
    girishG
    @atridad Thanks for the heads up, the app is gone from our library as well.
  • 17 117
    17 Topics
    117 Posts
    B
    That fixed it! Thank you!
  • 6 100
    6 Topics
    100 Posts
    Package UpdatesP
    [1.32.0] Update ctfreak to 1.42.0 Full Changelog SSH terminal: for SSH nodes, a new Terminal button opens an interactive shell in the browser (administrators only)
  • 60 471
    60 Topics
    471 Posts
    N
    After recent updates I am unable to generate share links anymore with the files I upload. t 29 17:27:58 cubby:routes:shares createShare: /other uploads/pictures/_DSC2635.JPG receiver:link +876ms Oct 29 17:27:58 cubby:shares create: uid-e20b0e31-8bb7-4c2a-a579-4860069b7733 /other uploads/pictures/_DSC2635.JPG receiver:link readonly:true expiresAt:none +876ms Oct 29 17:27:58 { Oct 29 17:27:58 path: '/api/v1/shares', Oct 29 17:27:58 status: 500, Oct 29 17:27:58 error: HttpError: NOT NULL constraint failed: shares.created_at Oct 29 17:27:58 at MainError.toHttpError (file:///app/code/backend/mainerror.js:75:16) Oct 29 17:27:58 at createShare (file:///app/code/backend/routes/shares.js:165:38) Oct 29 17:27:58 at process.processTicksAndRejections (node:internal/process/task_queues:104:5) { Oct 29 17:27:58 status: 500, Oct 29 17:27:58 internalError: MainError: NOT NULL constraint failed: shares.created_at Oct 29 17:27:58 at Object.query (file:///app/code/backend/database.js:74:15) Oct 29 17:27:58 at Object.create (file:///app/code/backend/shares.js:146:20) Oct 29 17:27:58 at createShare (file:///app/code/backend/routes/shares.js:164:48) Oct 29 17:27:58 at process.processTicksAndRejections (node:internal/process/task_queues:104:5) { Oct 29 17:27:58 reason: 'Database Error', Oct 29 17:27:58 details: { code: 'SQLITE_CONSTRAINT_NOTNULL' }, Oct 29 17:27:58 nestedError: SqliteError: NOT NULL constraint failed: shares.created_at Oct 29 17:27:58 at execute (file:///app/code/backend/database.js:41:30) Oct 29 17:27:58 at Object.query (file:///app/code/backend/database.js:72:16) Oct 29 17:27:58 at Object.create (file:///app/code/backend/shares.js:146:20) Oct 29 17:27:58 at createShare (file:///app/code/backend/routes/shares.js:164:48) Oct 29 17:27:58 at process.processTicksAndRejections (node:internal/process/task_queues:104:5) { Oct 29 17:27:58 code: 'SQLITE_CONSTRAINT_NOTNULL' Oct 29 17:27:58 }
  • 13 139
    13 Topics
    139 Posts
    Package UpdatesP
    [1.24.0] Update dawarich to 1.19.0 Full Changelog Back up your database before upgrading. The migration that keeps geofence events after their place is deleted cannot be rolled back. After the upgrade, background jobs recheck cell-tower points from the Android app and recount countries for past months. Archive and unarchive places from their editor or in bulk. Filter the Places list by Archived, and use Show archived places on the map to display them muted. Archiving keeps visit history and privacy masking while pausing new visits and geofencing. Search and filter Places by name, tags and confirmation status, and sort them by name, last visit or active visit count. The list shows tags, visit history, sources, geofences and privacy zones, with a shortcut to create a place on the map. Select places to add or remove tags, delete them with a summary of the consequences, or merge them into a chosen place. Possible duplicates groups places with overlapping visit radii for review; untick any place you want to keep before merging the rest. Geofence events stay in the log and API after their place is deleted, showing its last name. GPS noise filtering can hide inaccurate points again. Since 1.11.0 points with an accuracy of a few hundred metres stayed on the map, and phone tracking showed them as zig-zag lines across the route. Turn on "Hide inaccurate points" in the map settings under GPS Noise Filtering, choose a threshold between 50 and 1000 m, then press "Apply Settings" and after that "Re-evaluate past data" to hide such points in your history too. It is off by default, including for accounts that saved a threshold before 1.11.0, because Google Timeline imports report 14 km for points that still sit on the road. (#3300) Repeated cell-tower positions from the Android app no longer draw spikes on the map or inflate daily and monthly distance. Data recorded earlier is rechecked in the background after the upgrade. (#3417) Countries now count on Insights, Stats and yearly digests when reverse geocoding finds a country but no city for your points, for example in the countryside or at sea. Past months are updated gradually in the background after the upgrade. (#3598) Visit suggestions now run on instances without a configured geocoder. Visits without location details or a matching place display as "Unknown Location". (#3637) Tracks that cross the 180 meridian, such as trans-Pacific flights, are drawn across the date line again instead of as a line around the whole world. This applies to the Tracks layer, its speed colouring and trip routes. (#3921)
  • 66 658
    66 Topics
    658 Posts
    Package UpdatesP
    [3.7.0] Update directus to 12.6.0 Full Changelog Added recommended default AI allowed models that update with Directus releases and apply while the setting is unset (null). ... (#28344) Raised the minimum required Node.js version to 26. Node.js 22 is no longer supported. (#27737) Renamed the OpenAPI schema x-metadata to Metadata for consistency with other schema names (#28323) Updated the default TELEMETRY_URL and COMPLIANCE_URL to https://telemetry.directus.com (#28385) Added a Default Exports Folder project setting for exports saved to the File Library. The export drawer now warns about File Library visibility and only offers options the user has permission to use. (#28333) Added the richtext app extension type, which lets extensions add Tiptap nodes, marks and toolbar buttons to the WYSIWYG interface per field (#28384) Showed license warnings in the sidebar so admins see them outside Settings > License (#28394) Fixed markdown rendering getting slower over time by registering the sanitizer hook once instead of on every render (#28416) Fixed flows to send only changed fields on save (#28260) Fixed customEndpoint requests with FormData bodies incorrectly defaulting to the JSON content type (#28339)
  • 92 790
    92 Topics
    790 Posts
    Package UpdatesP
    [2.20.0] Update discourse to 2026.10.0 Full Changelog
  • 24 Topics
    266 Posts
    Package UpdatesP
    [2.7.2] Add timestamp argumens to registry-client script
  • 5 48
    5 Topics
    48 Posts
    Package UpdatesP
    [1.6.0] Update docmost to 0.97.0 Full Changelog
  • 13 131
    13 Topics
    131 Posts
    Package UpdatesP
    [1.34.1] Update documenso to 2.21.1 Full Changelog feat: persist signatures for authless embed signers by @Mythie in #3465 fix: don't remove passkeys on user disable by @Mythie in #3470
  • 12 64
    12 Topics
    64 Posts
    Package UpdatesP
    [1.12.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 17 284
    17 Topics
    284 Posts
    Package UpdatesP
    [1.21.1] Update docuseal to 3.3.4 Full Changelog This release includes updated trusted SSL/TLS CA certificates. This version contains a long-running DB migration that may take 12 minutes on a database with ~500,000 submissions. For apps with fewer than 10,000 submissions it takes a few seconds. Various bug fixes and performance improvements. We recommend all self-hosted users update to this version. We've made DocuSeal iOS app available for Cloud and self-hosted: https://apps.apple.com/us/app/docuseal-e-signature/id6823564236
  • 17 139
    17 Topics
    139 Posts
    Package UpdatesP
    [1.33.0] Update dokuwiki-plugin-oauth to 2026-10-20 security: fix RCEs CVE-2026-109618 / CVE-2026-109619 Full Changelog
  • 42 362
    42 Topics
    362 Posts
    Package UpdatesP
    [1.16.0] Update php-base | final to 8.4-20261021 security: fix eMudhra cert compromise
  • 13 Topics
    91 Posts
    Package UpdatesP
    [1.9.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 12 103
    12 Topics
    103 Posts
    Package UpdatesP
    [1.19.3] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 53 526
    53 Topics
    526 Posts
    Package UpdatesP
    [3.1.1] Update espocrm to 10.0.11 Full Changelog Kanban: Error message when changing status field value to a kanban-hidden status #3821
  • 31 296
    31 Topics
    296 Posts
    Package UpdatesP
    [4.11.3] Update etherpad-lite to 3.3.12 Full Changelog Timeslider "Return to pad" no longer follows a cross-origin referrer (GHSA-35rj-7vrx-29wq). The button navigated to document.referrer whenever the character before its last / was p, so a link from https://attacker/p/login to /p/<pad>/timeslider?embed=1 sent the user back to the attacker's site when they clicked it. The referrer is now only followed when it is a pad page on the same origin; otherwise the button returns to the pad. Reported by @sun1024. Export revision-bound .etherpad exports only include chat up to that revision. Exporting /p/<pad>/<rev>/export/etherpad shipped the pad's entire chat history, including messages posted after that revision. Reported by @temantih.
  • 5 Topics
    22 Posts
    Package UpdatesP
    [1.1.3] Update DocumentServer to 9.3.7 Full Changelog server: build: bump Node to 24 LTS (stable-9.3.7) by juliusknorr in server#66
  • 2 135
    2 Topics
    135 Posts
    Package UpdatesP
    [1.34.0] Update evcc to 0.318.1 Full Changelog Battery limits: expose plugin errors (BC) (#35289) Home Assistant: fix battery direction help (BC) (#34745) SofarSolar G3: write max charge/discharge power for battery modes (BC) (#35204) mDNS: stable instance name per installation (BC) (#34691) Add Frank Energie tariff (#34835) Add Tuya chargers (local protocol) (#34036) Config UI: add onboarding flow and setup checklist (#35126) Optimizer: add automatic mode (#32881) Config UI: fix enabling disabled temperature forecast (#34595) Optimizer: fix charge cycling when home battery feeds minimum charge (#34811)
  • 7 50
    7 Topics
    50 Posts
    Package UpdatesP
    [3.5.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 5 37
    5 Topics
    37 Posts
    Package UpdatesP
    [1.17.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 2 Topics
    17 Posts
    Package UpdatesP
    [1.4.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 24 289
    24 Topics
    289 Posts
    Package UpdatesP
    [3.14.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 8 135
    8 Topics
    135 Posts
    Package UpdatesP
    [3.1.0] Update node-base | final to 24-20261021 security: fix eMudhra certificate vulnerability
  • 6 39
    6 Topics
    39 Posts
    Package UpdatesP
    [1.4.2] Update forgejo to 17.0.1 Full Changelog
  • 78 858
    78 Topics
    858 Posts
    Package UpdatesP
    [1.17.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 22 174
    22 Topics
    174 Posts
    Package UpdatesP
    [1.30.1] Update FreshRSS to 1.30.4 Full Changelog Docker alternative image (Alpine 3.24) updated with PHP 8.5.12 and Apache 2.4.69 #9475 Improve Dutch #9479 Docker default image (Debian 13 Trixie) updated with PHP 8.4.27-1~deb13u1 and Apache 2.4.69 #9475 New hook: Minz_HookType::AutofillField for auth views #9362 Improve Brazilian Portuguese #9473 Translate non-English code comments and identifiers #9383
  • 2 21
    2 Topics
    21 Posts
    Package UpdatesP
    [1.2.0] Update python-base | final to 3.14-20261023 security: fix eMudhra cert compromise
  • 85 1k
    85 Topics
    1k Posts
    Package UpdatesP
    [4.206.0] Update ghost to 6.73.0 Full Changelog Fixed member imports slowing down on sites with many labels - Aileen Booker Fixed reordering gallery images removing them from other galleries (#31761) - Aubaid Fixed bulk-added tags being treated as the primary tag in filters (#32046) - Ujjawal Yadav Fixed {{encode}} outputting "[object Object]" for empty values (#32044) - Rup Sarmah Fixed paid members losing their tier when a complimentary end date passes (#31989) - Outpost Ryan Fixed fetch returning compressed bodies after jsdom loads (#31899) - Andreas Creten Fixed blocked checkout sign-in link redirecting to the homepage (#31674) - Lazizbek Ergashev Fixed additional Transistor cards not loading when a post has more than one - Aileen Booker Fixed Transistor embed showing random colours in privacy-hardened browsers - Aileen Booker Fixed email link checkers being counted as newsletter clicks (#32037) - Austin Burdine
  • 51 459
    51 Topics
    459 Posts
    Package UpdatesP
    [1.43.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 22 153
    22 Topics
    153 Posts
    Package UpdatesP
    [2.0.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise IMPORTANT: This is last release of GitHub Pages. This package is deprecated and there will be no further updates.
  • 69 699
    69 Topics
    699 Posts
    Package UpdatesP
    [1.122.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 3 24
    3 Topics
    24 Posts
    Package UpdatesP
    [1.3.1] Update glpi to 12.0.1 Full Changelog
  • 7 62
    7 Topics
    62 Posts
    Package UpdatesP
    [1.24.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 23 265
    23 Topics
    265 Posts
    Package UpdatesP
    [2.8.6] Update grafana to 13.2.5 Full Changelog Security: Fix CVE-2026-100105 Security: Fix CVE-2026-103506 Security: Fix CVE-2026-88858 Security: Fix CVE-2026-88967 Git Sync: Ignore hidden paths in repository scans and diffs #135028, @ferruvich Provisioning: Default save from a branch preview to the previewed branch #135174, @Clarity-89 Provisioning: Never replace the repository root folder during incremental sync #135463, @ferruvich Plugins: Don't report loaded plugins as not registered when a request times out #135665, @leventebalogh Provisioning: Fix MR dashboard previews when served from a sub-path #135559, @gustaff-weldon
  • 15 210
    15 Topics
    210 Posts
    Package UpdatesP
    [2.3.3] Update grav to 2.2.14 Full Changelog Disabled plugins are no longer loaded, so a disabled plugin with code that doesn't work on this version of Grav can't take the site down, and requests do less work. A disabled plugin is still listed with its settings, and its class still loads if another plugin asks for it. Thanks @NoNoNo #4374 CSS with a long quoted string or comment (such as an inlined data: URI) minifies again instead of failing with a PCRE error, and a very large data: URI no longer empties the whole stylesheet from the bundle. Thanks @NoNoNo #4372 Inline JavaScript added with loading: 'inline' no longer renders a stray inline attribute on its script tag, and an inline JS module keeps its code when the pipeline is off. Thanks @NoNoNo #4373
  • 19 169
    19 Topics
    169 Posts
    Package UpdatesP
    [1.13.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 10 69
    10 Topics
    69 Posts
    Package UpdatesP
    [1.3.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 55 320
    55 Topics
    320 Posts
    Package UpdatesP
    [2.5.4] Use the OpenID authorization code flow instead of the implicit flow
  • 4 23
    4 Topics
    23 Posts
    girishG
    App discontinued due to no upstream updates.
  • 18 148
    18 Topics
    148 Posts
    Package UpdatesP
    [1.24.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 13 Topics
    178 Posts
    Package UpdatesP
    [1.26.0] Update uv to 0.13.6
  • 28 264
    28 Topics
    264 Posts
    Package UpdatesP
    [1.11.2] Update humhub to 1.19.3 Full Changelog Fix #8646: Text of notifications in the top bar dropdown was invisible (top bar text color instead of the list text color, since 1.19.1) Fix #8648: Invite tokens (link and email) could end with - or _, which is often cut off when the link is auto-detected in texts Fix #8647: Text of notifications in the top bar dropdown was invisible (top bar text color instead of the list text color, since 1.19.1) Fix #8652: Concurrent requests with the same new or expired session ID (e.g. several AJAX requests after the session expired) failed with "Duplicate entry" in user_http_session Fix #8654: Activity types excluded from e-mail summaries reappeared after the update to 1.19 (renamed activity classes were not migrated in settings) Fix #8656: A failing daily or hourly cron handler caused the whole run to repeat on every cron tick (e.g. daily summary e-mail spam); run times are now stored before the handlers run; Exceptions of cron handlers are now logged (category cron) Fix #8657: A user gate page (e.g. /twofa/check) opened by a guest was stored as the return URL and caused an endless redirect loop after login Fix #8660: Update phpoffice/phpspreadsheet to 5.10.0 (GHSA-3x94-m842-937c), symfony/http-foundation and symfony/yaml to 7.4.21 (security fixes)
  • 78 752
    78 Topics
    752 Posts
    Package UpdatesP
    [1.103.11] Update uv to 0.13.6
  • 6 Topics
    47 Posts
    Package UpdatesP
    [1.3.1] Update ip2location to 1.4.0 Fix width and height of the map
  • 5 73
    5 Topics
    73 Posts
    Package UpdatesP
    [1.13.0] Update it-tools to 2026.10.25 Full Changelog json-viewer, yaml-viewer, currency-converter, geo-coordinates-converter: support intranet mirrors (3af8e4a) gitignore-generator, gitattributes-generator: fall back to a bundled template snapshot (81c1201) translator, remove-background, math-ocr, ocr-image, gif-to-mp4: ship runtimes with the app (d53e745) settings: add an offline mode that hides internet-only tools (4a80283) zpool-memo: add localized content and recategorize (f196182) dns-query, gitattributes-generator: hide dns-query offline, pin commands to the snapshot (788d4fd) explainshell, ocr-image: honour the configured mirrors (8ec5590) countdown, cron-alarm, time-alarm: resolve Beep.mp3 against the app base (94c0bbf) markdown-editor, unicode-formatter, pomodoro-timer: bundle editor extensions and fonts (b536f04) visualsubnetcalc, zpool-calc: escape user data before inserting HTML (de40fc7)
  • 4 43
    4 Topics
    43 Posts
    Package UpdatesP
    [1.2.2] Update infisical to v0.167.4 Full Changelog fix(cros-project-import): return on overview page by @adilsitos in #8901 fix(secret-syncs): stop showing cloudflare workers options on other connection forms by @DimitrisStaratzis in #8908 feat(ui): make batched secret changes always-on in Secrets Overview (SECRETS-804) by @andrewhuhh in #8692 improvement(ui): move the Overview quick-add row to the top of the table (SECRETS-804) by @andrewhuhh in #8730 fix(frontend): make machine identity table rows real links by @andrewhuhh in #8910 fix(frontend): make users, groups and roles table rows real links by @andrewhuhh in #8916 feat(api): add private v2 batch commit route for batched secret and folder changes (SECRETS-804) by @andrewhuhh in #8689 feat(agent-vault): member-provided credential fields with personal values and variables by @scott-ray-wilson in #8741 feat(secret-approvals): bulk review change requests by @andrewhuhh in #8657 feat(pam): auto approvals by @lb-vn in #8688
  • 18 197
    18 Topics
    197 Posts
    Package UpdatesP
    [1.12.9] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 71 Topics
    1k Posts
    Package UpdatesP
    [1.23.1] Update invoiceninja to 5.13.50 Full Changelog Fixes for scheduler request layer Updated dependencies Seven small API fixes found building the new apps by @hillelcoren in #13365 Improve scoping for purging a user to constrain DB lock contention by @turbo124 in #13367 Four API fixes found building the new apps: endless reminders and activity feed by @hillelcoren in #13368 Clean up available includes in company and account transformers by @turbo124 in #13370 v5.13.50 by @turbo124 in #13380 Full Changelog: https://github.com/invoiceninja/invoiceninja/compare/v5.13.49...v5.13.50
  • 44 356
    44 Topics
    356 Posts
    Package UpdatesP
    [1.16.0] Update jellyfin to 12.4 Full Changelog Update to .net 10.0.14 MR #18535, by @crobibero
  • 4 18
    4 Topics
    18 Posts
    girishG
    App discontinued due to no upstream updates.
  • 13 108
    13 Topics
    108 Posts
    Package UpdatesP
    [1.13.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 34 375
    34 Topics
    375 Posts
    jamesJ
    Hello @stoccafisso Not by default, no. You could build the jitsi app yourself and install it or maybe someone will make it a community app.
  • 12 119
    12 Topics
    119 Posts
    Package UpdatesP
    [2.7.1] Update joplin to 3.7.3 Full Changelog New: Add AI chat backend and plugin API (#15643) New: Add MCP server (#15699) New: Add note embeddings indexer (#15674) New: Added email autocomplete when sharing a notebook (#15241 by @Rygaa) New: Plugins: Add semantic search plugin API (joplin.ai.search) (#15686) Fixed: Fix XSS vulnerability in HTML notes (#15435) Fixed: Fix duplicate tag creation for special unicode characters (#15613) (#15608 by @mrjo118) Fixed: Fix fatal startup crash when sync target upgrade is required (#15348) (#15346) Fixed: Crash on deleting ca. 4000 notes (#15640) (#15575 by @Rygaa) Fixed: Prevent trashed notes from opening in edit mode (#15248)
  • 12 155
    12 Topics
    155 Posts
    Package UpdatesP
    [1.65.3] Update Linux-x86_64.sh to py313_26.9.4-0
  • 8 77
    8 Topics
    77 Posts
    Package UpdatesP
    [1.18.1] Update kanboard to 1.2.56 Full Changelog fix(session): scope the session cookie to the directory without a trailing slash fix(security): validate and escape color IDs fix(security): select client IP from the rightmost untrusted hop fix(security): restrict dashboard tasks to authorized projects fix(security): project authorization bypass fix(security): preserve unscoped dashboard pagination fix(security): escape the project name in the analytic modal title fix(ldap): enable notifications for auto-created LDAP users fix(ical): only accept known columns as the calendar start date fix(api): return a full batch response when one request is forbidden
  • 8 59
    8 Topics
    59 Posts
    Package UpdatesP
    [1.14.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 8 116
    8 Topics
    116 Posts
    Package UpdatesP
    [1.8.2] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 5 38
    5 Topics
    38 Posts
    Package UpdatesP
    [1.3.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 16 267
    16 Topics
    267 Posts
    Package UpdatesP
    [2.64.0] Update kimai to 2.71.0 Full Changelog Remove API password from user profile screen (#6277) Deactivate API passwords (#6267) - thanks @haxxordan Check if API is allowed to set begin (#6275) - thanks @Deniiz23 Use edit permission to check if times can be set via API (#6276) - thanks @Deniiz23
  • 16 237
    16 Topics
    237 Posts
    Package UpdatesP
    [1.51.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 11 132
    11 Topics
    132 Posts
    girishG
    Running TURN server on port 443 only matters for setups where a Client is unable to contact the server on non-port 443. This is only common in some ultra locked down intranet setups.
  • 5 73
    5 Topics
    73 Posts
    Package UpdatesP
    [1.11.3] Update komga to 1.29.2 Full Changelog uncorrect page count returned in some cases (2487e05), closes #2525 incorrect koreader hash in some cases (a5462b0), closes #2484 replace deprecated method call (dee9f19)
  • 25 198
    25 Topics
    198 Posts
    Package UpdatesP
    [2.6.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 145 1k
    145 Topics
    1k Posts
    Package UpdatesP
    [5.3.1] Update php-src to 8.5.12 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 18 200
    18 Topics
    200 Posts
    Package UpdatesP
    [1.69.1] Update languagetool to bc7e597
  • 23 248
    23 Topics
    248 Posts
    Package UpdatesP
    [1.18.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 19 174
    19 Topics
    174 Posts
    Package UpdatesP
    [1.4.6] Update uv to 0.13.6
  • 19 457
    19 Topics
    457 Posts
    Package UpdatesP
    [1.65.0] Update LimeSurvey to 7.7.0+261020 Full Changelog
  • 16 140
    16 Topics
    140 Posts
    Package UpdatesP
    [1.29.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 15 185
    15 Topics
    185 Posts
    Package UpdatesP
    [1.26.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 32 237
    32 Topics
    237 Posts
    Package UpdatesP
    [1.17.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 8 156
    8 Topics
    156 Posts
    Package UpdatesP
    [1.29.1] Update loomio to 3.13.2 Full Changelog Fix: Tag migrations could block live traffic during search and summary rebuilds. These rebuilds now run in small background batches, scheduled ten minutes after migration Fix: Incoming emails could remain stuck after temporary processing errors. Routing now retries up to five times with increasing delays Fix: Members allowed to edit thread context were limited to tagging opening posts. They can now tag replies, polls, and outcomes too Upgrade web and worker processes before the scheduled backfill starts. An existing active backfill continues without queuing another pass. See the Upgrading Loomio guide. See the full changelog.
  • 19 242
    19 Topics
    242 Posts
    Package UpdatesP
    [2.53.0] Update Lychee to 7.12.0 Full Changelog Ensure that config always have translation keys by @ildyria in #4872 Add support for email login by @ildyria in #4871 Worktree moderation history by @ildyria in #4881 Bucketing refactor by @ildyria in #4883 Support Vite+ by @ildyria in #4891 open-new-tab by @ildyria in #4896 Add tag-person album section by @ildyria in #4895 Google Motion Photos: Android 11+ format and grid hover playback by @mlapaglia in #4900 Jxl support by @ildyria in #4899 speed up thumb loading by @ildyria in #4912
  • 40 144
    40 Topics
    144 Posts
    humptyH
    I'd like to propose a new feature. A verified badge like you see on social media nowadays next to a sender's name/email. I know it's easy to spoof the FROM address, so this feature would require some additional background work. We could have multiple badges/tags: Known Contact SPF, DKIM, and DMARC (if it aligns or not) Authenticated identity (OpenPGP or S/MIME and cert verification) Warning icon for bad actors A single "checkmark" could be added to the email list if it all passes. Detailed tags can be displayed once the email is opened. Is this feasible?
  • 10 61
    10 Topics
    61 Posts
    marcusquinnM
    @girish That is a super handy feature!
  • 151 1k
    151 Topics
    1k Posts
    Package UpdatesP
    [1.20.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 53 450
    53 Topics
    450 Posts
    Package UpdatesP
    [1.62.1] Update matomo to 5.14.2 Full Changelog
  • 135 Topics
    1k Posts
    Package UpdatesP
    [1.147.1] Update synapse to 1.164.1 Full Changelog Fix clearing user status for clients that send a null profile field value. When include_profile_updates_in_sync is enabled, Synapse will continue to accept null custom profile field values until clients have had a sufficient time to change their behaviour. This special casing is tracked in this issue. (#20422) Bump msgpack from 1.2.1 to 1.2.4 to address GHSA-j586-36cw-2gc2 which can cause memory exhaustion problems when malformed tokens are used with the public room list API's. (#20421)
  • 60 662
    60 Topics
    662 Posts
    Package UpdatesP
    [1.34.1] Update mattermost to 12.0.1 Full Changelog Mattermost Platform Release 12.0.1 contains Medium severity level security fixes.
  • 66 519
    66 Topics
    519 Posts
    Package UpdatesP
    [6.3.1] Update mautic to 7.2.2 Full Changelog CVE-2026-115188: Remote Code Execution in Campaign Import - Advisory: GHSA-mxjf-pghx-h299 CVE-2026-115189: Twig Sandbox Escape in Theme Templates - Advisory: GHSA-h7pm-79gc-8867 CVE-2026-115191: SQL Injection in Contact Lookup AJAX Endpoint - Advisory: GHSA-fj8v-c9c3-7q26 CVE-2026-115192: SQL Injection in Dashboard Widget API - Advisory: GHSA-qpmx-7pq3-5q2v CVE-2026-115193: Stored Cross-Site Scripting (XSS) in HTML-type Custom Contact Field on Contact Detail View - Advisory: GHSA-3295-vq3p-93rw CVE-2026-115194: Arbitrary File Read via Path Traversal in Asset API - Advisory: GHSA-wfhm-289v-79vp CVE-2026-115195: Broken Access Control in Stats API - Advisory: GHSA-7j28-9rg4-wg63 CVE-2026-115196: Open Redirect in Form Submission - Advisory: GHSA-5mm3-3g7p-9868 Downloaded assets now keep their original filename instead of an internal ID by @patrykgruszka in #17526 Discarding an email draft no longer clears fields of the saved email by @gcomneno in #17653
  • 9 118
    9 Topics
    118 Posts
    Package UpdatesP
    [1.52.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 9 97
    9 Topics
    97 Posts
    Package UpdatesP
    [3.8.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619 security: fix eMudhra cert compromise
  • 14 105
    14 Topics
    105 Posts
    Package UpdatesP
    [1.26.0] Update meemo to 1.26.0 Update base image
  • 6 52
    6 Topics
    52 Posts
    Package UpdatesP
    [2.3.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 22 766
    22 Topics
    766 Posts
    Package UpdatesP
    [3.31.0] Update metabase to 0.64.4.1 Full Changelog
  • 2 8
    2 Topics
    8 Posts
    Package UpdatesP
    [1.0.0] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 52 528
    52 Topics
    528 Posts
    Package UpdatesP
    [2.39.1] Update bedrock to 1.26.60.6 Full Changelog
  • 11 102
    11 Topics
    102 Posts
    Package UpdatesP
    [1.7.5] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 55 706
    55 Topics
    706 Posts
    Package UpdatesP
    [6.0.0] Update base | final to 6.0.1 IMPORTANT: This is last release of MinIO. This package is deprecated and there will be no further updates. See https://forum.cloudron.io/topic/16181/minio-unlisted-from-app-store for more information
  • 49 2k
    49 Topics
    2k Posts
    Package UpdatesP
    [1.24.3] Update mirotalkp2p to 2.2.36
  • 16 104
    16 Topics
    104 Posts
    Package UpdatesP
    [1.40.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 43 353
    43 Topics
    353 Posts
    Package UpdatesP
    [4.4.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 163 2k
    163 Topics
    2k Posts
    Package UpdatesP
    [4.50.1] Update n8n to 2.45.5 Full Changelog core: Keep the ExpressionError name in minified builds (#42309) (b3192c6) core: Keep undefined values in QuickJS expression results (#42264) (532f645) editor: Align carets within split buttons (#42203) (61cbfea) editor: Improve first load speed (#41987) (8b6bdbb) editor: Match Evals Run Test button colors (#42200) (f594853) editor: Remove underlines from breadcrumb links (#42201) (127d65a) editor: Remove underlines from Data Table links (#42189) (619271c) editor: Stop Safari from opening its own context menu on the canvas (#42175) (28f9c9e) core: Make custom OTel attribute key prefixes configurable (#42193) (6071b12)
  • 21 186
    21 Topics
    186 Posts
    Package UpdatesP
    [1.31.4] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 414 3k
    414 Topics
    3k Posts
    G
    @james that's fantastic! Thanks for clarifying it!
  • 31 312
    31 Topics
    312 Posts
    Package UpdatesP
    [1.52.0] Update nocodb | stage to 2026.10.0 Full Changelog
  • 67 580
    67 Topics
    580 Posts
    Package UpdatesP
    [2.33.6] Update NodeBB to 4.16.5 Full Changelog add missing ip-locked lang key, closes #15053 (e00506c) closes #15052, allow socket.emits from exempt groups (be7580a) add hint to force usage of zset indexes (687e1a5) catch all exceptions in localLogin, closes #15054 (ce62dcd) don't modify passed in data to renderAsync (897c15e)
  • 15 132
    15 Topics
    132 Posts
    Package UpdatesP
    [1.38.0] Update ntfy to 2.34.0 Full Changelog Allow several comma-separated addresses in listen-http, so a load balancer can hold more than ~63k connections to one ntfy node Cluster nodes drain on shutdown: an active node withdraws (stops being ready), then turns read-only and closes its subscriber connections gradually (experimental-cluster-drain-delay, experimental-cluster-drain-duration), so its clients move to the other nodes without a reconnect storm (experimental, see draining on shutdown) End all of a user's subscriptions when their access to a topic is reset or the user is deleted: only the first one was ended, so the others kept receiving the topic's messages (#1845, thanks to @gigioneggiando for reporting) In an experimental cluster, tell the other nodes when access changes (e.g. a reservation or a revoked permission), so they reload their access cache and disconnect subscribers who lost access; the access cache reload also catches changes made elsewhere, e.g. by the ntfy access CLI, and now runs every 67 seconds instead of 87 Fix a deadlock when ending subscriptions (reserving a topic with live subscribers, revoking access, deleting a user) while debug logging or log-level-overrides is on: the subscriptions' topic stayed locked for good Fix a data race when log-level-overrides changes (e.g. on a config reload with SIGHUP) while the server logs
  • 6 131
    6 Topics
    131 Posts
    Package UpdatesP
    [1.19.12] Update ollama to 0.40.13 Full Changelog Liquid AI's LFM3 models, including text-to-speech in lfm3-audio and lfm3-omni, now run on Linux and Windows as well as Apple silicon.
  • 5 47
    5 Topics
    47 Posts
    Package UpdatesP
    [1.6.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 52 438
    52 Topics
    438 Posts
    Package UpdatesP
    [1.28.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 6 42
    6 Topics
    42 Posts
    Package UpdatesP
    [0.9.0] Update opencloud to 6.1.0 Full Changelog Add a flag to the reindex command to force a full reindex [#2606] proxy: Allow mapping from an external tenant id to the internal id [#2569] feat: enable EnableInsertRemoteFile WOPI flag for Collabora [#2555] feat(multi-tenancy): verify tenant via OIDC claim [#2559] Fix race conditions in the hybrid metadata backend [#594] fix: error handling in upload session cleanup [#582] experimental: add darwin watchfs support [#471] Tracing [#596] fix: favorites list, undo delte doesn't return item to the favorites [#2382] feat: handle UI_InsertFile postMessage from Collabora [#2270]
  • 4 55
    4 Topics
    55 Posts
    Package UpdatesP
    [1.9.4] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 24 297
    24 Topics
    297 Posts
    Package UpdatesP
    [3.53.2] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 4 Topics
    35 Posts
    Package UpdatesP
    [1.14.0] Update python-base | final to 3.14-20261023 security: fix eMudhra cert compromise
  • 80 758
    80 Topics
    758 Posts
    Package UpdatesP
    [3.7.8] Update uv to 0.13.6
  • 3 16
    3 Topics
    16 Posts
    Package UpdatesP
    [1.3.0] Update php-base | final to 8.4-20261021 Fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 15 95
    15 Topics
    95 Posts
    Package UpdatesP
    [2.5.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 30 207
    30 Topics
    207 Posts
    Package UpdatesP
    [1.28.0] Update outline to 1.12.0 Full Changelog Every user now has a personal section for private documents in the sidebar in #14062 #14187 (Admins can disable in settings) Mermaid diagrams are now faster, much prettier, and responsive as they are rendered with Pele in #14126 Passkey login is now possible inside the desktop app (Make sure you're running the latest version) in #14180 #14241 #14242 OAuth Client ID Metadata Documents are now supported for MCP clients in #14015 The MCP SDK has been upgraded to v2 with support for the 2026-07-28 protocol in #14244 Tables can now be placed inside notices in #14175 Emails now support one-click unsubscribe (RFC 8058) in #14148 Moving a document drops permissions its children inherit from it by @misha-sunborn in #13879 Missing rate limit on documents.update in #14189 Node.js has been updated to 26.12.1 in #14228
  • 17 107
    17 Topics
    107 Posts
    Package UpdatesP
    [1.7.2] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 3 17
    3 Topics
    17 Posts
    Package UpdatesP
    [1.4.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 71 601
    71 Topics
    601 Posts
    Package UpdatesP
    [1.68.0] Update gotenberg to 8.39.0 Full Changelog Reject ExifTool's j option alias and stop loading ExifTool config files
  • 2 11
    2 Topics
    11 Posts
    girishG
    You can still install it like this https://my.<cloudron>/#/appstore/rocks.paperwork.cloudronapp . But note that it was last updated 3 years ago. I tried to build a new version with latest with PHP a year ago and the app was not even building anymore. They have been re-writing a new version for a couple of years now.
  • 107 930
    107 Topics
    930 Posts
    Package UpdatesP
    [4.10.1] Update PeerTube to 8.3.2 Full Changelog critical Upgrade vulnerable sharp (image processing dependency) that can lead to a RCE with a special crafted SVG file GHSA-wq5f-xc86-pv6w high Fix federation vulnerability where a remote attacker could exploit the redirection of cached remote objects to impersonate actors of another instance and modify its videos federated on an instance GHSA-5j4v-77rx-h5qg Update whisper-ctranslate2 package to fix installation on Python 3.12+ Fix channel deletion cancel showing success message #7837 Fix podcast feed podcast:medium value with audio enclosure preference Fix audio download with a webp thumbnail #7833 Fix crash when remote video has no likes/dislikes collections #7836 Limit resource usage when generating thumbnails
  • 22 206
    22 Topics
    206 Posts
    Package UpdatesP
    [1.21.2] Update penpot to 2.18.5 Full Changelog
  • 6 Topics
    24 Posts
    girishG
    App discontinued due to no upstream updates.
  • 4 Topics
    12 Posts
    girishG
    The upstream project has not released in almost 3 years now. We had to build from develop to get some PHP 8 support going, but there are bugs like https://github.com/phpservermon/phpservermon/issues/1196 , https://github.com/phpservermon/phpservermon/issues/1232 . There's also a bunch of basic issues: Normal user cannot login after admin user logs in. Some issue related to service worker. LDAP functionality is incomplete
  • 5 64
    5 Topics
    64 Posts
    Package UpdatesP
    [3.5.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 81 688
    81 Topics
    688 Posts
    Package UpdatesP
    [1.26.1] Update pixelfed to 0.15.2 Full Changelog Our primary docker image was updated to 5.0.2 - https://github.com/serversideup/docker-php/releases/tag/v5.0.2 (this includes the PHP security patching for 2 CVEs). Details here: https://www.php.net/archive/2026.php#2026-10-21-5 Rebuilt release images with updated CAs Details here: https://emudhra.we-have-a-problem.com/ Major refactoring will continue as we work towards the new Nuxt based WebUI. Please continue to submit issues and bugs to us, and make noise for any regressions! Remove EXP_CPT & EXP_CHT, and enabled cached timelines by default by @shleeable in https://github.com/pixelfed/pixelfed/pull/7728 A bunch of timeline related bug fixes and improvements A bunch of non-timeline related bug fixes and improvements Update Helpers, improve webfinger handling by @dansup in https://github.com/pixelfed/pixelfed/pull/7792
  • 4 20
    4 Topics
    20 Posts
    Package UpdatesP
    [2.1.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 9 168
    9 Topics
    168 Posts
    Package UpdatesP
    [1.18.7] Update pocketbase to 0.40.6 Full Changelog Replaced the GitHub update command with update from the new host in relation to #7841. Additional fileblob bucket escape checks for just in case if the filesystem abstraction is used as standalone without the PocketBase validations. Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage. The default limit is pretty generous and currently set to max 250<<20 (262144000) pixels and can be changed with the env PB_THUMBS_MAX_SOURCE_PIXELS. The workaround is not bulletproof and thumbs generation remains one of the main culprit for potential OOMs in PocketBase, so better solutions will have to be investigated in the future, including eventually switching to libvips or other similar library once there is better CGO portability (if you have better suggestions, please open a discussion). Bumped the min Go GitHub action version to 1.27.3 as it includes a security fix related to the recent eMudhra CA compromise. Bumped golang.org/x/ dependencies (#7865). Bumped goja and its related dependencies (string allocations optimization, Date.getYear/setYear support and other minor correctness fixes). Minor UI fixes - superuser IPs description grammar fix, rotating btn loader icon alignment fix, slight dark background correction in attempt to minimize the color profile differences between Chrome and Firefox, etc.
  • 22 223
    22 Topics
    223 Posts
    micmcM
    It's too bad this app has been abandoned. Yet, there's a full docker install and I might have missed it or upstream might have changed their but I haven't seen a trace of a mention about the use of a "temporal server" as a requirement to run this. Anyway, on the other hand, there's a cool work around for anyone running Hermes can run the Postiz Skill within one's Hermes instance. https://postiz.com/hermes There also is the option to run it from a N8N Node https://www.npmjs.com/package/n8n-nodes-postiz Enjoy!
  • 9 86
    9 Topics
    86 Posts
    Package UpdatesP
    [1.12.1] Update pretix to 2026.8.1 Full Changelog
  • 9 68
    9 Topics
    68 Posts
    SansGuidonS
    Thank you @girish
  • 20 238
    20 Topics
    238 Posts
    Package UpdatesP
    [2.15.2] Update prometheus to 3.15.1 Full Changelog [SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys. [SECURITY] Build with Go 1.27.3 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template. [SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
  • 6 110
    6 Topics
    110 Posts
    Package UpdatesP
    [2.30.2] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 15 169
    15 Topics
    169 Posts
    Package UpdatesP
    [2.18.0] chore(deps): update dependency radicale to v3.9.0
  • 16 213
    16 Topics
    213 Posts
    Package UpdatesP
    [2.17.3] Update rallly to 4.16.3 Full Changelog Poll times saved an hour off around daylight saving changes In the week view, the hour skipped when clocks go forward is shown as a hatched "Clocks go forward" band, and a slot can't start inside it. In the month view, the start time dropdown lists exactly the times that exist in the poll's time zone. Options you already saved are not changed. If you created a poll with times close to a daylight saving change, check its options.
  • 9 75
    9 Topics
    75 Posts
    girishG
    App discontinued due to no upstream updates.
  • 14 121
    14 Topics
    121 Posts
    Package UpdatesP
    [5.5.14] Update uv to 0.13.6
  • 18 178
    18 Topics
    178 Posts
    Package UpdatesP
    [3.20.6] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 19 127
    19 Topics
    127 Posts
    Package UpdatesP
    [1.15.0] Update releasebell to 1.15.0 Replace PrimeVue with published @cloudron/pankow.
  • 71 792
    71 Topics
    792 Posts
    Package UpdatesP
    [3.8.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 55 382
    55 Topics
    382 Posts
    Package UpdatesP
    [2.11.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 9 63
    9 Topics
    63 Posts
    Package UpdatesP
    [1.17.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 2 50
    2 Topics
    50 Posts
    Package UpdatesP
    [1.0.3] Update rustfs to 1.0.4 Full Changelog fix(test): backport scanner wait correction for 1.0.4 by @overtrue in #8930
  • 4 15
    4 Topics
    15 Posts
    girishG
    Given that the upstream project is not maintained anymore, we have hidden this in the appstore. I had also submitted a PR upstream for a basic issue which is ignored - https://github.com/aliasaria/scrumblr/pull/161
  • 18 271
    18 Topics
    271 Posts
    Package UpdatesP
    [2.119.0] Update searxng to 54ca1d9
  • 2 38
    2 Topics
    38 Posts
    Package UpdatesP
    [1.28.0] Update seaweedfs to 4.51 Full Changelog s3api: stop echoing stored tags and internal attributes on GET/HEAD by @chrislusf in #12053 admin: keep read-only sessions out of the filer /etc tree by @chrislusf in #12057 s3tables: scope the anonymous identity's grant on the table catalogs by @chrislusf in #12056 master: shorten the first-write hold after a fresh topology id by @chrislusf in #12059 filer, volume: ignore Range when If-Range no longer matches by @jayhemnani9910 in #12052 feat: send EC shards in parallel per destination disk by @CHEPURNOV-S-S in #12050 command: no extra localhost listener when -ip.bind is specified by @chrislusf in #12055 mini: lift the post-mint allocation hold on first inventory report by @chrislusf in #12061 filer: auto-enable per-path commit records when a peer has its own store by @chrislusf in #12062 s3: answer GET and HEAD of a delete marker as S3 does by @jayhemnani9910 in #12051
  • 5 36
    5 Topics
    36 Posts
    Package UpdatesP
    [1.5.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 15 97
    15 Topics
    97 Posts
    Package UpdatesP
    [1.5.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 5 53
    5 Topics
    53 Posts
    Package UpdatesP
    [2.19.1] Update Shaarli to 0.16.10 Full Changelog doc: plugins/playvideos: update Content-Security-Policy (CSP) documentation update vulnerable npm build dependencies rebuild Docker image against latest alpine:3.24.2 (PHP CVE-2026-109618, CVE-2026-109619) Full Changelog: https://github.com/shaarli/Shaarli/compare/v0.16.9...v0.16.10
  • 7 50
    7 Topics
    50 Posts
    jdaviescoatesJ
    @girish said in SickChill unlisted from app store: I hope they atleast bring back the issue tracker Out of interest, why does this matter for Cloudron? BTW, someone has replied to the thread I started on Discord informing me that the master releases are these https://pypi.org/project/sickchill/ Doesn't look like there has been a new one since March though.
  • 2 16
    2 Topics
    16 Posts
    Package UpdatesP
    [1.3.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 4 Topics
    41 Posts
    girishG
    The upstream project is archived - https://github.com/boypt/simple-torrent/ . There has been no changes in 2 years and modules are not updated.
  • 33 364
    33 Topics
    364 Posts
    Package UpdatesP
    [1.27.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619 security: fix eMudhra cert compromise
  • 24 238
    24 Topics
    238 Posts
    Package UpdatesP
    [1.24.1] Update snipe-it to 8.8.3 Full Changelog Fixed #19895 - remove PHP 8.4/8.5 deprecation notices by @sudarshanvashisht in #19896 Fixed #19870 and #19869 - small maintenance improvements by @snipe in #19871 Fixed #19595 - numbers in custom fields exporting inconsistently by @snipe in #19872 Fixed #19778 - allow bulk scanner auditing by 2D bardcode by @snipe in #19874 Fixed #19626 - respect lastname firstname order more thoroughly by @snipe in #19875 Fixed potentially missing rows in license seats api endpoint by @marcusmoore in #19883 Bulk Checkout: Fixes redirect option not persisting by @Godmartinz in #19881 Fixed #19887 - use alpine 3.24 to get newer php by @markof88 in #19889 Fixed #18508 Custom Fields: Allow cloning custom fieldsets by @marcusmoore in #19793
  • 61 435
    61 Topics
    435 Posts
    C
    Hi James, Yes... And that was my problem! I should have checked that, works as it should now, thank you.
  • 13 104
    13 Topics
    104 Posts
    girishG
    Just checked on this again but it seems statping-ng is not going forward much . https://github.com/statping-ng/statping-ng/tags says the release was almost a year ago.
  • 44 478
    44 Topics
    478 Posts
    Package UpdatesP
    [3.18.3] Update Stirling-PDF to 3.2.2 Full Changelog fix(i18n): expand Turkish translations by @alkank in #8123 fix(viewer): render non-embedded fonts with matching widths by @reecebrowne in #8629 feat(viewer): Fit to width and fit to page buttons in the viewer by @EthanHealy01 in #8485 feat(annotate): add Arrow and Polyline tools by @reecebrowne in #8578 feat(stamp): Add QR code stamp type by @EthanHealy01 in #8492 Bump version to 3.2.2, refresh translations, and backend reliability fixes by @jbrunton96 in #8617
  • 15 146
    15 Topics
    146 Posts
    Package UpdatesP
    [1.13.0] Update python-base | final to 3.11-20261023 security: fix eMudhra cert compromise
  • 111 849
    111 Topics
    849 Posts
    Package UpdatesP
    [7.4.0] Update surfer to 854d3b8 security: fix eMudhra cert compromise
  • 32 246
    32 Topics
    246 Posts
    Package UpdatesP
    [1.34.7] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 5 14
    5 Topics
    14 Posts
    jamesJ
    Hello @necrevistonnezr We are aware that there are currently no updates for the Tachyon app from us. Currently there are some issues with the app we are investigating.
  • 21 205
    21 Topics
    205 Posts
    Package UpdatesP
    [2.20.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 6 104
    6 Topics
    104 Posts
    Package UpdatesP
    [1.14.1] Update recipes to 2.7.2 Full Changelog improved hide "accept privacy" checkbox when no privacy url is given improved AI recipe import reliability #4829 fixed unauthorized error message on login page and recipe share page #4889 fixed missing LDAP dependency #4887 fixed missing CSRF token on SignUp page failing signup from invite link #4891 fixed InviteLinks not working on pages with disabled signup fixed permission for prometheus view #4888 fixed account redirects in sub path setups (thanks to sebastianlipponer #4885)
  • 10 70
    10 Topics
    70 Posts
    Package UpdatesP
    [1.6.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 9 79
    9 Topics
    79 Posts
    timconsidineT
    @timconsidine said in Teddit Subscriptions no longer working: Just FYI - my LibReddit - selfhosted as Docker on another VPS = is still working. But now it is down. Maybe they have caught up with me.
  • 5 53
    5 Topics
    53 Posts
    Package UpdatesP
    [1.24.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 10 67
    10 Topics
    67 Posts
    girishG
    @Sam_uk we have unlisted TLDraw by now. Please see https://forum.cloudron.io/topic/10806/no-more-updates-to-tldraw . The license and company direction has changed.
  • 22 245
    22 Topics
    245 Posts
    Package UpdatesP
    [1.29.1] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 10 104
    10 Topics
    104 Posts
    Package UpdatesP
    [2.8.0] Update python-base | final to 3.12-20261023 security: fix eMudhra cert compromise
  • 12 83
    12 Topics
    83 Posts
    Package UpdatesP
    [2.5.5] Update transmission to 4.1.4 Full Changelog Fixed a Transmission 4.1.0 regression that could cause torrents with zero-byte files to be handled incorrectly, sometimes losing downloaded progress (#9165) Hardened the torrent-add RPC method against malformed requests. (#9158) Fixed a rare bug that could prevent downloading webseeds from finishing. (#9146) Fixed per-torrent session speed-limit overrides so they apply to both downloads and uploads. (#9154) Fixed a potential RCE vulnerability in the macOS client. It requires local write access to the user's preferences, so it is not remotely exploitable. (GHSA-v7mp-fpv3-jf5r) Minimum supported version increased to macOS 12 (#9166) Improved UI code to use less CPU. (#9161) The torrent list now re-sorts and re-applies its filter when the torrent's top folder's name changes, eg after a rename or after a magnet link's metadata arrives. (#9159) Fixed a display bug that sometimes listed torrent names as 'Unknown'. (#9135) Fixed a 4.0.0 bug that broke transmission-remote --list-groups. (#9157)
  • 13 165
    13 Topics
    165 Posts
    Package UpdatesP
    [1.33.1] Update Trilium to 0.106.1 Full Changelog Updated Node.js in the Docker images to 24.22.1 (22.23.4 for the legacy image), taking in the Node.js security releases of 21 October 2026: Brotli decoder out-of-bounds write (CVE-2026-111497). Trilium decompresses Brotli-encoded request bodies before authentication, so on earlier versions any client that could reach the server could send a malicious request. Outbound requests (link previews, image downloads, web search) were also affected through the responses they receive. Revoked eMudhra/emSign certificate authorities. The certificate store bundled with Node.js trusted certificate authorities whose keys were compromised. This allowed a man-in-the-middle with the right network access to impersonate HTTPS servers that Trilium connects to (sync with another instance, link previews, LLM providers). Other fixes to TLS, HTTP and DNS handling from the same Node.js release.
  • 37 429
    37 Topics
    429 Posts
    Package UpdatesP
    [2.107.0] Update tt-rss to c02520f
  • 11 104
    11 Topics
    104 Posts
    Package UpdatesP
    [1.24.0] Update tymeslot to 1.33.0 Full Changelog booking: Tell organisers when a refused calendar hides their times calendar: Stop asking an account pending deletion to reconnect i18n: Use the right plural form for durations in Czech onboarding: End onboarding by sharing the booking link themes: Show a paid meeting type's price and the paid confirmation availability: Let a schedule offer extra times on specific dates scheduling: Let a meeting type offer several lengths admin-alerts: Warn when alert emails share the contact inbox polls: Let the host invite people to a poll by email group-bookings: Let a group type offer the sessions its host planned
  • 14 118
    14 Topics
    118 Posts
    Package UpdatesP
    [1.26.0] Update twenty to 2.52.0 Full Changelog Let apps connect accounts through their own authorization flow (#28672) by @FelixMalfait Run upgrade:2-51:migrate-rich-text-to-tiptap after upgrading to convert existing rich text records to TipTap format. (#28486) by @neo773 The blocknote sub-field on rich text in the GraphQL and REST APIs is now deprecated; switch to markdown or tiptap before it is removed. (#28488) by @neo773 Billing plan configuration now lives in the BILLING_PLANS environment variable; update your server config. (#28552) by @etiennejouan Relabel the app permissions as Workspace Apps and User Apps and enforce User Apps on the server (#28083) by @ehconitin fix(front): pin record table columns with logical insets so they work in RTL (#28379) by @almoghazaz-cell fix(metadata-store): adopt new collection hash on replaceDraft when data is unchanged (#28412) by @ghazy2001 fix(record-form): block submission when field input has validation error (#28425) by @ghazy2001 fix(front): keep cached relation picker results clickable while Search refreshes (#28458) by @lineico fix(onboarding): add aria-labels to invite team email inputs (#28748) by @zacyungblut
  • 43 307
    43 Topics
    307 Posts
    Package UpdatesP
    [1.28.0] Update node-base | stage to 24-20261021 security: fix eMudhra cert compromise
  • 33 293
    33 Topics
    293 Posts
    Package UpdatesP
    [3.28.1] Update umami to 3.4.1 Full Changelog Upgraded Next.js to 16.4.2 (from 16.3.4 in v3.4.0). This fixes a critical RCE in next/og, SSRF in image optimization, cache poisoning, and an information disclosure issue. #4645 Upgraded React and React DOM to 19.3.1. Pinned the Docker base image to Node 22.23.4-alpine, which includes the October 2026 Node.js security fixes. Rebuild or re-pull your images to pick this up. #4657 Upgraded @modelcontextprotocol/server to 2.3.1 and @modelcontextprotocol/client to ^2.3.1. This fixes an OAuth credential leak (GHSA-6qxp-vccf-f47h) along with other advisories. #4645 #4661 Raised the security floors for vulnerable transitive dependencies: vite, undici, sharp, shell-quote, brace-expansion, fast-uri, postcss-selector-parser, and source-map-js. #4645 #4661
  • 39 371
    39 Topics
    371 Posts
    Package UpdatesP
    [2.9.5] Update uptime-kuma to 2.5.8 Full Changelog #8049 fix: Docker verification check sometimes not catching invalid responses (2.5.X backport) (Thanks @Abestanis) #8038 fix: add next-slim-rootless docker tag #8028 fix: drop TLS support for the TCP Port monitor (It never worked as expected and very buggy, all existing monitors will become normal TCP monitors) GHSA-v2p3-6f5h-6hhf [Admin Only] RCE (Thanks @Sami111-Afk) (Open a help issue to ask to reveal it after 7 days, in case i forget to) #8037 revert: hide/show password toggle in login page (#7672) (Because the height is inconsistent)
  • 20 131
    20 Topics
    131 Posts
    Package UpdatesP
    [1.6.2] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 4 125
    4 Topics
    125 Posts
    Package UpdatesP
    [1.85.2] Update vault to 2.2.1 Full Changelog
  • 99 856
    99 Topics
    856 Posts
    Package UpdatesP
    [1.26.5] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 1 1
    1 Topics
    1 Posts
    Package UpdatesP
    You can use this thread to track updates to the Versitygw package. Please open issues in a separate topic instead of replying here.
  • 9 183
    9 Topics
    183 Posts
    Package UpdatesP
    [1.87.1] Update verdaccio to 7.0.2 Full Changelog c017767: Remove the HEALTHCHECK from the Docker image.
  • 40 286
    40 Topics
    286 Posts
    Package UpdatesP
    [1.27.3] Update base | final to 6.0.1 security: fix eMudhra cert compromise
  • 73 557
    73 Topics
    557 Posts
    nebulonN
    So the listview got reworked now to be a bit more appealing I hope [image: image.jpeg] So for the grid view, we used to have more overlay icons also indicating single-sign-on status and such. This was reverted over time as it often is more confusing to users than not, then maybe it is only useful for admins.... so we try tro strike some balance UX wise here. But I agree the listview was treated poorly and thus probably not used much at all for people who care more about such details.
  • 20 171
    20 Topics
    171 Posts
    Package UpdatesP
    [2.5.8] Update wallabag to 2.6.15 Full Changelog Support PHP 8.4 while retaining compatibility with PHP 7.4 and the locked legacy dependencies. Deprecation notices may still be emitted. Backport documentation monorepo merge to 2.6 by @yguedidi in #8780 Introduce a REDIS_URL (backport) by @Kdecherf in #8868 (read the doc about that) Hide delete public link item if not necessary by @nicosomb in #8878 Update graby and php-readability dependencies by @Kdecherf in #8891 Backport #8585 Prefetch content ISO to fetch URL content to 2.6 by @Kdecherf in #8889 Escape dynamic data in the ePub export by @j0k3r in #8968 Fix content and fetchedContent merging by @Simounet in #8985 Backport translations from master by @j0k3r in #9113 Full Changelog: https://github.com/wallabag/wallabag/compare/2.6.14...2.6.15
  • 5 102
    5 Topics
    102 Posts
    Package UpdatesP
    [1.32.2] Update Wallos to 5.10.2 Full Changelog fall back to IPv4-only nginx when IPv6 is unavailable (#1287) (a41bae7)
  • 5 86
    5 Topics
    86 Posts
    Package UpdatesP
    [1.45.1] Update whitebophir to 2.18.26 Full Changelog
  • 8 163
    8 Topics
    163 Posts
    Package UpdatesP
    [1.53.0] Update python-base | final to 3.14-20261023 security: fix eMudhra cert compromise
  • 25 611
    25 Topics
    611 Posts
    Package UpdatesP
    [4.210.0] Update wekan to 12.67 Full Changelog The form closes after the card is added, unless Member Settings keeps it open. Thanks to brlin-tw and xet7. The container that installs their Node.js gets .tools/tmp as its /tmp again. Thanks to xet7. start-wekan.sh starts WeKan again where there is no /proc. Thanks to xet7. meteor-spk is assembled where the .spk is packed from, in .tools. Thanks to xet7. A copy of the source tree without .git gets its own .tools/tmp. Thanks to xet7. The smoke-test MongoDB starts on a 6.19+ kernel, and Chromium is found. Thanks to xet7. Its guard pins mongo:9.0.4, not the mongo:8 that stopped starting. Thanks to xet7. WeKan vs Trello vs Jira says when WeKan added each feature it listed as missing. Thanks to xet7.
  • 16 141
    16 Topics
    141 Posts
    Package UpdatesP
    [1.14.0] Update node-base | final to 24-20261021 security: fix eMudhra cert compromise
  • 5 78
    5 Topics
    78 Posts
    Package UpdatesP
    [2.22.0] Update woodpecker to 3.20.0 Full Changelog Remove agent token from process os environments [#7412] Make sure CLI self-update can target cli install dir only [#7400] Keep revoked env admins revoked until the server restarts [#7403] Add support for selecting workflow to run for manual pipelines [#7393] Add option to restrict organization and user to use its agents only [#7359] Make CLI lint prefer detected Woodpecker config [#6634] Fix server panic when saving workflows fails [#7401] Fix depends_on workflows running after failed dependency on queue reload [#7395] Resolve commit SHA for annotated tags for gitlab, gitea and forgejo [#7394] For kubernetes do not report unknown deleted pods as successful [#7357]
  • 116 Topics
    892 Posts
    Package UpdatesP
    [3.21.1] Update WordPress to 7.1.4 Full Changelog
  • 231 Topics
    2k Posts
    Package UpdatesP
    [3.17.1] Update WordPress to 7.1.4 Full Changelog
  • 14 72
    14 Topics
    72 Posts
    Package UpdatesP
    [1.5.0] Update php-base | final to 8.5-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 20 139
    20 Topics
    139 Posts
    Package UpdatesP
    [1.13.0] Update php-base | final to 8.4-20261021 security: fix RCEs CVE-2026-109618 / CVE-2026-109619
  • 2 Topics
    34 Posts
    Package UpdatesP
    [1.15.0] Update urlaubsverwaltung to 6.20.0 Full Changelog Apply for leave in the past through the overview calendar #6841 Make half-day absences clickable in the overview calendar #6837 Overview calendar: draw an absence of several days as one bar #6843 Urlaubssperre: Sperrtage/-zeitrume definieren, an denen kein Urlaub beantragt werden kann #6351 Use the bear head on lime from the app as favicon #6836 Absence overview: one diagonal across a temporarily allowed bar #6845 Bump Spring Boot from 4.1.1 to 4.1.2 #6847