Rallly - Package Updates

Package Updates

[1.29.0]

Package Updates

[2.0.0]

Update rallly to 4.0.2
Major package release as rallly introduced paid selfhosting plans. The full discussion can be found here
Full Changelog
This release addresses a key issue that prevented S3-backed file storage (e.g. for profile pictures and other upcoming storage features) from functioning correctly on self-hosted Rallly instances.
This is a patch release for Rallly v4 that addresses an issue with OpenID Connect (OIDC) authentication for self-hosted instances.
OIDC_ISSUER_URL Environment Variable Now Required
To support the continued development and sustainability of Rallly, we're introducing a licensing model for multi-user self-hosted instances.

Package Updates

[2.1.0]

Update rallly to 4.1.0
Full Changelog
v4.1.0 introduces a new Settings page in the Control Panel. The first available option is Disable User Registration, enabling this setting will hide the registration page and prevents new users from registering on your instance. (Note: If SSO is enabled, users from your identity provider can still log in.)
This marks the beginning of a more configurable Rallly, reducing reliance on environment variables and improving the admin experience. Expect additional settings in future releases.
Handle enterprise license with unlimited seats by @lukevella in https://github.com/lukevella/rallly/pull/1753
Fix issue where votes can be submitted even when paused by @lukevella in https://github.com/lukevella/rallly/pull/1757
Update button styles by @lukevella in https://github.com/lukevella/rallly/pull/1758

Package Updates

[2.1.1]

Package Updates

[2.1.2]

Package Updates

[2.2.0]

Update rallly to 4.2.0
Full Changelog
Fix issue where wrong start time is shown on event page by @lukevella in https://github.com/lukevella/rallly/pull/1791
Add option to cancel a scheduled event by @lukevella in https://github.com/lukevella/rallly/pull/1800

Package Updates

[2.3.0]

Update rallly to 4.3.1
Full Changelog
Fix missing PORT environment variable that caused healthcheck failures in Docker containers
Spaces allow you to organize your polls and events into different areas. You can also invite team members to share and collaborate within a space.
This release reintroduces ARM support for the official docker image.
Various stability improvements

Package Updates

[2.4.0]

Update rallly to 4.4.0
Full Changelog
Improved the formatting of the email that gets sent out when finalizing a poll so that it is recognized as a calendar invite by email clients
Added uid to the ICS file so that event details are synchronized across all attendees when changes are made
Added sequence so to keep track of changes to the event such as cancellation
Added EMAIL_LOGIN_ENABLED which can be set to false to limit login to SSO
Added REGISTRATION_ENABLED which can be set to false to disable the registration page
Improved the default configuration to reject unauthorized certifications when using TLS
Deprecated SMTP_TLS_ENABLED and introduced SMTP_REJECT_UNAUTHORIZED instead

Package Updates

[2.4.1]

Package Updates

[2.4.2]

Package Updates

[2.5.0]

Package Updates

[2.5.1]

Update rallly to 4.5.4
Use multistage build for smaller image
Full Changelog
This patch release delivers important security fixes and hardens permission checks across the app. We recommend upgrading as soon as possible.
Patched vulnerabilities affecting authorization checks and comment/participant operations.
CVE-2025-65020
CVE-2025-65021
CVE-2025-65028
CVE-2025-65029
CVE-2025-65030
CVE-2025-65031
CVE-2025-65032
CVE-2025-65033

Package Updates

[2.5.2]

Package Updates

[2.5.3]

Update rallly to 4.5.6
Full Changelog
Patched vulnerability where participant data is exposed through the API even when option to hide the participant list is enabled.

Package Updates

[2.5.4]

Update rallly to 4.5.7
Full Changelog
This is a critical security update that upgrades Next.js to address CVE-2025-66478. We strongly recommend all users upgrade to this version immediately.

Package Updates

[2.5.5]

Update rallly to 4.5.8
Full Changelog
This release includes updates to dependencies, adds missing translations and fixes a bug where emails for scheduled events are not delivered to a participant's email address.

Package Updates

[2.5.6]

Update rallly to 4.5.9
Full Changelog
This release fixes an issue where participants are not able to edit their response using the link they receive in their confirmation email when their session is expired or they are not logged in.

Package Updates

[2.5.7]

Update rallly to 4.5.10
Full Changelog
This release includes important security updates to address vulnerabilities in React Server Components (RSC) protocol.
We've updated Next.js and React to fix two additional vulnerabilities (CVE-2025-55183, CVE-2025-55184) that were discovered while security researchers examined the patches for React2Shell.
Important: Neither of these new issues allow for Remote Code Execution. The patch for React2Shell remains fully effective.
These vulnerabilities originate in the upstream React implementation. This release addresses the downstream impact on Next.js applications using the App Router.
For full details, see the React blog post.
All users are strongly encouraged to update to v4.5.10 as soon as possible to ensure they are protected against these vulnerabilities.

Package Updates

[2.5.8]

Package Updates

[2.5.9]

Update rallly to 4.5.12
Full Changelog
Fixed an issue where some Microsoft users couldn't log in after signing up with an older version of the app
Fixed an issue where users with invalid/expired sessions were not able to access the login screen
Update translations

Cloudron Forum