Cloudron Forum

[1.13.8] Update jellyfin to 10.11.11 Full Changelog Add lockhelper for UserManager MR #16944, by @JPVenson

[1.62.0] Update languagetool to fc5fd4f

[6.7.0] Update surfer to 6.7.0 Rework the filemanager to provide more basic actions like copy/cut/paste/extract Enable drag'n'drop Various layout fixes Use new icon set Move settings from a dialog to a separate view

[1.14.6] Update leantime to 3.9.8 Full Changelog Milestones - Fixed reports showing 0% completion and the timeline "Show Tasks" view displaying nothing (#3624, #3625, #3628) Milestone Modal - Resolved focus loss, restored save-and-close, and fixed a 500 error when saving goals (#3605) To-Dos - Kept To-Dos from closed projects browsable once the project is reopened (#3626, #3627) Post-3.9.7 Regressions - Fixed a file browser out-of-memory issue, strategy grouping, and 403 errors for legacy roles (#3621) MCP Endpoint - The /mcp endpoint now accepts Leantime API keys, and a shim for the removed php-mcp provider lets in-place upgrades boot (#3601, #3602, #3607) Program Board - Moved the card status dropdown below the field row (#3599) Sessions - Isolated sessions into their own Redis database to avoid clashes with other cached data (#3604) Bumped the McpServer submodule to include the bulkAddTasks fix (#3620, #3622) Synced composer.lock content hash with composer.json (#3603)

[1.27.0] Update typebot.io to 3.19.0 Full Changelog If you use Webhook blocks, you must now set WEBHOOK_RELAY_SECRET to the same secret in builder, viewer and your PartyKit server. This also applies to Webhook blocks used in previews and WhatsApp flows. Missing or mismatched secrets prevent Webhook responses from resuming conversations. The first URL in NEXT_PUBLIC_VIEWER_URL must use a different hostname from NEXTAUTH_URL. Different ports on the same hostname are insufficient. Configure a separate viewer hostname before upgrading so builder previews remain available. SMTP configuration tests now validate destinations and pin the connection to a validated IP address. Private SMTP servers require an exact hostname entry in SSRF_ALLOWED_HOSTS; this instance-wide allowlist permits RFC1918 addresses only. Loopback, link-local and metadata endpoints remain blocked. Resolve variables in Forge option arrays. Strengthen preview isolation, linked draft permissions and preview session creation. Restrict WhatsApp sessions to internal runtime access. Authenticate webhook responses and relay subscriptions, and enforce webhook ownership and write access. Protect SMTP configuration tests and special-use IP ranges against SSRF. Block external sign-in redirects and serialize concurrent email verification attempts. Restrict guest workspace access and prevent writes during read-only typebot migrations.

[1.30.0] Update Wallos to 5.8.1 Full Changelog buttons position for push notifications (#1226) (9e2ad14) add push notifications (ece43eb) admin: let the deployment own the instance SMTP settings and the server URL (1ea12e6) currency: add frankfurter.dev as a provider that needs no account (dd7cf87) admin: let the SMTP test button see a managed password (cbd4ec1) categories: recognise the no-category placeholder by language (1f27e7a) i18n: a new account's categories are in the language it was created with (9dd66f4) i18n: an account an identity provider creates is in the language it named (5b3f445) notifications: ask the SSRF check about the account, not the last payer (4d24ccc) push: stop reloading the page to subscribe or remove a device (b308da0)

[1.31.0] Update navidrome to 0.64.0 Full Changelog All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824) Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce) Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d) Configuration durations are now validated. Negative values are rejected at startup. (#6002) Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730 by @deluan) Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078 by @deluan) Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805 by @deluan) Add Catppuccin Mocha and Frapp themes, and update Macchiato to match the official palette. (#5835 by @cmyksoda) Fix logins sometimes showing the wrong user. (#5882 by @deluan, #5767 by @apkatsikas) Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105 by @deluan)

[1.23.3] Update linkwarden to 2.16.3 Full Changelog Significantly improved the performance of link, search, tag, collection, and dashboard queries at scale.

[1.19.3] Update penpot to 2.17.2 Full Changelog Fix linear gradients in SVG text exports being emitted as radial gradients #5972 (MR: #11272) Fix typography token becoming detached when editing text content #11362 (MR: #11366) Fix command injection in SVG exporter via legacy fill-color (https://github.com/penpot/penpot/security/advisories/GHSA-4f36-m4hj-cv86)

[2.29.0] Update VueTorrent to 2.35.0 Full Changelog show raw data values on hover (#2867) (e92249f) capitalize language names in locale switcher (#2903) (f47c1d2) Improve network sync reliability (559919e) Repair broken desktop layout (9e2b435) Settings: API key copy not working in insecure contexts (#2880) (ec39bbd) Improve chunking for better app load time (#2881) (b0eff6c) links: Add mouse middle click support to open in new tab (#2902) (38ca598) Pause network requests on tab change (6a42b7b)

[2.6.1] Update joplin to 3.7.2 Full Changelog The Release Notes section contains no breaking changes, features, or bug fixes it is empty (only a compare link is present with no changelog entries).