Wallos - Package Updates

Package Updates

[1.27.0]

Update Wallos to 5.5.0
Full Changelog
let admins allow standard users to use the Webhook Allowlist (closes #1153, closes #1138) (41494ef)
actually delete the login token on logout (#1184) (41494ef)
make the TOTP replay guard run (#1181) (41494ef)
close remaining gaps in login-token revocation from #1184's review (41494ef)
OIDC token exchange failing behind CDN/anycast proxies (closes #1145) (41494ef)
payment method in-use guard misses when 2+ subscriptions share it (closes #1179) (41494ef)
reflected XSS via unescaped theme cookies in inline scripts (41494ef)
reject deleting or disabling an in-use payment method on every path (41494ef)
undefined array key warnings for subscriptions with no seeded stats bucket (closes #1182) (41494ef)

Package Updates

[1.27.1]

Package Updates

[1.28.0]

Update Wallos to 5.6.0
Full Changelog
add Azerbaijani (az) localization (#1201) (6a740f8)
make the dashboard upcoming payment count configurable (#1191) (4fc9310), closes #1186
add missing language files to the service worker (b1ba0d3)
auth: disable 2FA atomically instead of reporting success on a partial write (#1193) (45eb0a2)
auth: do not report 2FA as enabled when the enrolment did not complete (#1194) (89c97df)
auth: do not report a password reset that did not happen (#1195) (6600c07)
auth: do not report an email as verified when the token was not consumed (#1196) (7a57ec1)
check the delete in delete-before-replace save pairs (#1197) (c0a2cb7)
cleanup unused logos when deleting or editing subscriptions (20d23db)
currency: skip an exchange rate refresh that already happened today (#1199) (54f822b)

Package Updates

[1.29.0]

Package Updates

[1.30.0]

Update Wallos to 5.8.1
Full Changelog
buttons position for push notifications (#1226) (9e2ad14)
add push notifications (ece43eb)
admin: let the deployment own the instance SMTP settings and the server URL (1ea12e6)
currency: add frankfurter.dev as a provider that needs no account (dd7cf87)
admin: let the SMTP test button see a managed password (cbd4ec1)
categories: recognise the no-category placeholder by language (1f27e7a)
i18n: a new account's categories are in the language it was created with (9dd66f4)
i18n: an account an identity provider creates is in the language it named (5b3f445)
notifications: ask the SSRF check about the account, not the last payer (4d24ccc)
push: stop reloading the page to subscribe or remove a device (b308da0)

Package Updates

[1.30.1]

Update Wallos to 5.8.2
Full Changelog
auth: enforce SSO-only server-side, not just in the UI (GHSA-vhv8-cw23-59xm) (#1246) (a81772e)
subscriptions: enforce foreign-key ownership on (ba9973d)
subscriptions: enforce foreign-key ownership on subscription save (GHSA-797x-473j-px9p) (a81772e)

Package Updates

[1.30.2]

Package Updates

[1.30.3]

Update Wallos to 5.8.4
Full Changelog
i18n: complete Arabic translation and plural "days before" label (#1266) (ff78a22)

Package Updates

[1.31.0]

Update Wallos to 5.10.0
Full Changelog
bulk: polish the bulk toolbar and keep Apply disabled until it has something to apply (29b5b5d)
bulk: keep payer and category rows in step with bulk delete and set-category (b3a4d98)
i18n: rename default names when switching between any two languages (b3acdc0)
subscriptions: allow several categories per subscription (d750eac)
subscriptions: allow several payers per subscription (faa0226)
subscriptions: show card actions as a 2x2 grid (a224dd2)
pwa: rename the static cache when a script or stylesheet changes (1d37f89)
stats: drop point labels and dates from the cost trend graph (3a1da1c)

Package Updates

[1.32.0]

Package Updates

[1.32.1]

Update Wallos to 5.10.1
Full Changelog
rebuild on php 8.3.36 to pick up the security release (CVE-2026-109618, CVE-2026-109619) (a540a9e)
rebuild on php 8.3.36 to pick up the security release (CVE-2026-109618, CVE-2026-109619) (9e560ed)

Package Updates

[1.32.2]

Cloudron Forum