Change Detection - Package Updates

[Package Updates]

[1.28.2]

• Update changedetection.io to 0.53.4
• Full Changelog
• Pluggy plugin hook for before and after a watch is processed by @​dgtlmoon in #​3888
• UI - Fixing realtime updates for status updates when checking by @​dgtlmoon in #​3889
• Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #​3846 by @​dgtlmoon in #​3890
• "Error 200 no content" - Some very large SPA pages make HTML to Text fail by dumping 10Mb+ into page header, strip extras. by @​dgtlmoon in #​3892
• Large html to text error 200 blank by @​dgtlmoon in #​3893
• Fix: Some SPAs with long content - Stripping tags must also find matching close tag by @​dgtlmoon in #​3895
• Puppeteer - Adding extra browser cleanup by @​dgtlmoon in #​3897
• Updates/migration - Re-run tag update, re-save to cleanup changedetection.json, code refactor by @​dgtlmoon in #​3898

[Package Updates]

[1.28.3]

• Update changedetection.io to 0.53.5
• Full Changelog
• Backup restore by @​dgtlmoon in #​3899
• Fixing bad replacement of metadata causing possible content removal #​3906 by @​dgtlmoon in #​3908

[Package Updates]

[1.28.4]

• Update changedetection.io to 0.53.6
• Full Changelog
• Pip installs - remove flask patch and pin library versions by @​dgtlmoon in #​3912 #​3910
• Fixing exclude compression (which has some kind of memory leak with flask-socketio)

[Package Updates]

[1.28.5]

• Update changedetection.io to 0.53.7
• Full Changelog
• Upgrading flask-socketio ( #​3910 ) by @​dgtlmoon in #​3918
• Bump referencing from 0.35.1 to 0.37.0 by @​dependabot[bot] in #​3677
• Dont pin referencing library by @​dgtlmoon in #​3919

[Package Updates]

[1.29.1]

• Update changedetection.io to 0.54.2
• Full Changelog
• Fixing change_datetime notification token (and adding test) by @​dgtlmoon in #​3922
• Notification Token {{diff}} can accept arguments like {{diff_added(lines=5, context=2)}} by @​dgtlmoon in #​3923
• Processor extensible API for updating by @​dgtlmoon in #​3902
• Update jsonpath-ng requirement from ~=1.7.0 to ~=1.8.0 by @​dependabot[bot] in #​3929
• Bump the all group with 2 updates by @​dependabot[bot] in #​3931
• Unresolvable hostnames should still be added, they are security checked at fetch time by @​dgtlmoon in #​3933

[Package Updates]

[1.29.2]

• Update changedetection.io to 0.54.3
• Full Changelog
• Update messages.po in French translation by @​RithyNicolasTAN in #​3926
• Adding Ukrainian (uk) translations, rebuilding translations. by @​dgtlmoon in #​3936
• CVE-2026-27696 Small fix - Restricted hostnames can still be added but are only checked at fetch-time (not when rendering lists etc) by @​dgtlmoon in #​3938

[Package Updates]

[1.29.3]

• Update changedetection.io to 0.54.4
• Full Changelog
• fix(i18n): accept translated confirmation text when clearing snapshot history by @​eren-karakus0 in #​3940
• CVE-2026-29038 - Reflected XSS in RSS Tag Error Response
• CVE-2026-29039 - XPath - Arbitrary File Read via unparsed-text()
• CVE-2026-29065 - fix(backups): patch zip slip advisory, zip bomb, upload size limit, UUID validation, secret.txt leakage, and download edge cases

[Package Updates]

[1.29.4]

• Update changedetection.io to 0.54.5
• Full Changelog
• Restock - No need to extract the text because it's not used anyway by @​dgtlmoon in #​3951
• Content fetching -Better detection of other encodings, Replace/upgrade broken UTF-8 , Ensure rest of retrieved content is UTF-8 for the app by @​dgtlmoon in #​3954
• UI - Price amount is sometimes string or integer by @​dgtlmoon in #​3950
• *CI - Bump the all group with 5 updates by @​dependabot[bot] in #​3955
• Various memory and CPU improvements by @​dgtlmoon in #​3960
• Add complete Spanish translation (es) by @​adriangc24 in #​3961
• Create (POST) tag/group through API do not save processor_config_restock_diff values by @​dgtlmoon in #​3968
• UI - Fixing Preview "GO" version button by @​dgtlmoon in #​3969
• API - Invert changes_only flag for include_equal parameter by @​dgtlmoon in #​3976

[Package Updates]

[1.29.6]

• Update changedetection.io to 0.54.7
• Full Changelog
• XPath json-doc() Arbitrary File Read Bypass ( Similar fix as CVE-2026-29039 )
• CVE-2026-33981 - Environment Variable Disclosure via jq env Builtin in Include Filters
• UI - Text tidyup by @​dgtlmoon in #​3989
• Realtime - Suppress socket.io errors in logs by @​dgtlmoon in #​3991
• Restock - Add previous_price to restock values #​3987 by @​dgtlmoon in #​3993
• fix: correct critical errors in Spanish (es) translation by @​rasputino in #​3994
• last_error should be cleared if page content was the same and there was no error by @​dgtlmoon in #​3997
• fix: Czech translation strings updated by @​svetlemodry in #​4008

[Package Updates]

[1.29.7]

• Update changedetection.io to 0.54.8
• Full Changelog
• CVE-2026-35490 - Authentication Bypass via Decorator Ordering
• Extendable theme pluggy implementation by @​dgtlmoon in #​4011

[Package Updates]

[1.29.8]

• Update changedetection.io to 0.54.9
• Full Changelog
• Add Japanese translation (ja) by @​skkzsh in #​4019
• Update Selenium RemoteConnection to use ClientConfig for timeout by @​mikaelz in #​4027
• Fix SCREENSHOT_MAX_HEIGHT not enforced: cap viewport step_size and clip stitched output to max capture height #​3810 by @​dgtlmoon in #​4030
• Notification - Adding tokens {{diff_changed_from}} and {{diff_changed_to}} #​3818 by @​dgtlmoon in #​4031
• Feature - Groups/tag - Apply a group by specifying a wildcard, ie *mysite.com* by @​dgtlmoon in #​4032
• Add Portuguese (Brasil) translation by @​mstrey in #​4033
• fix: word-level diff ignores include_change_type_prefix by @​lawrence3699 in #​4037
• Groups - Set custom colour for tag/group/label background by @​dgtlmoon in #​4040
• Fix/step failure notification crash by @​dgtlmoon in #​4041
• Test - Word level diff - Re #​4037 by @​dgtlmoon in #​4042

[Package Updates]

[1.29.9]

• Update changedetection.io to 0.54.10
• Full Changelog
• i18n: Wrap untranslated UI strings and update ja translations by @skkzsh in #4052
• Bump apprise from 1.9.8 to 1.9.9 by @dependabot[bot] in #4059
• Fix - diff_changed_to causing some missed notifications by @dgtlmoon in #4066
• Fix untranslated labels on mobile watchlist view by @skkzsh in #4064
• Fix unresponsive "help and tips" button on tag edit screen by @skkzsh in #4055

[Package Updates]

[1.30.0]

• Update changedetection.io to 0.55.1
• Full Changelog
• Use pgettext for diff page From/To labels to prevent context collisions by @skkzsh in #4073
• Fix broken opacity feedback for restock/price fields on tag edit screen by @skkzsh in #4072
• i18n: Wrap untranslated UI strings in include_subtract.html and add ja translations by @skkzsh in #4054
• Update python-engineio requirement from <5,>=4.9.0 to >=4.13.1,<5 by @dependabot[bot] in #4079
• DeprecationWarning: codecs.open() is deprecated. Use open() instead. by @skkzsh in #4078
• LLM implementation - by @dgtlmoon in #4057
• i18n: Consolidate fragmented gettext calls into entire-sentence msgids by @skkzsh in #4076
• Translations - Playwright macro unused, add extra linting for translations, add TRANSLATORS.md by @dgtlmoon in #4087
• [i18n] "Usage" tab label in AI settings is ambiguous across contexts #4086 by @dgtlmoon in #4088
• Update Korean language by @limeade23 in #4084

[Package Updates]

[1.30.1]

• Update changedetection.io to 0.55.3
• Full Changelog

[Package Updates]

[1.30.2]

• Update changedetection.io to 0.55.4
• Full Changelog
• UI - AI/LLM - "Summary" button should set last viewed by @skkzsh in #4095
• API - watch.link was accidently a tuple, enforcing string by @dgtlmoon in #4104
• API - Add restock config to API /v1/watch/ json output #4099 by @dgtlmoon in #4103
• Notifications - Escape only the diff variables before Jinja2 renders them into the template ( Stop breaking custom HTML for plaintext pages on HTML notifications) #4121 by @dgtlmoon in #4123
• Fixing GHSA-vwgh-2hvh-4xm5 substring match in the shared_diff_access by @dgtlmoon in #4130
• LLM - Self-hosted OpenAI-compatible endpoint support (vLLM, LM Studio, llama.cpp) refs #3204 by @tekgnosis-net in #4117
• Text filters - Process subtractive_selectors first by @dgtlmoon in #4142
• Text filters - Ignore text should run before 'extract text' by @dgtlmoon in #4143
• UI - LLM - SSRF guard for the LLM api_base setting by @dgtlmoon in #4157
• API Security - Watch GET history snapshot - Should return text/plain mimetype so it cant be accidently executed in the browser by @dgtlmoon in #4158

[Package Updates]

[1.30.3]

• Update changedetection.io to 0.55.5
• Full Changelog
• Fix Spanish translations for 'Changed' and 'Last Changed' by @maperal in #4160
• Notifications - Fix 'str' object is not callable when {{ diff(...)}} callable tokens are used with HTML/htmlcolor output by @dgtlmoon in #4161
• LLM - Master on/off switch (enable/disable) by @dgtlmoon in #4162

[Package Updates]

[1.30.4]

• Update changedetection.io to 0.55.7
• Full Changelog
• Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential
• UI - LLM - Fix for settings (wtforms vs pydantic) by @dgtlmoon in #4184
• UI - Preview problem fix for extract_text/ignore_text #4138 by @dgtlmoon in #4169
• UI - LLM - Flag LLM_FEATURES_DISABLED to disable all LLM from the UI/system by @dgtlmoon in #4171
• Notifications - raw_diff token was missing by @dgtlmoon in #4177
• LLM UI - Blueprint/code also disabled when env flag LLM_FEATURES_DISABLED is enabled by @dgtlmoon in #4180
• Llm settings pydantic refactor by @dgtlmoon in #4181