Rallly - Package Updates

[Package Updates]

[2.15.1]

• Update rallly to 4.15.1
• Full Changelog
• Send login code emails in the requester's language (#3275)

[Package Updates]

[2.15.2]

• Update rallly to 4.15.2
• Full Changelog
• Decouple registration from email login (#3337)

[Package Updates]

[2.15.3]

• Update rallly to 4.15.3
• Full Changelog
• Resolve Alberta, Manitoba and BC time zones consistently across engines (#3396)
• Link OIDC sign-ins to existing users by email (#3407)

[Package Updates]

[2.15.4]

• Update rallly to 4.15.4
• Full Changelog
• Critical security fix: remote code execution in poll preview images
• This patch fixes a critical vulnerability in an upstream dependency. Please upgrade as soon as possible.
• Rallly v4.8.0 through v4.15.3 ship a version of Next.js affected by GHSA-vcvr-r3jv-pc5j (critical, CVSS 9.5). The ImageResponse renderer from next/og can be made to execute code on the server when attacker-controlled text reaches the image it renders.
• Rallly uses that renderer for poll link previews at /api/og-image-poll, and the poll title and author come straight from the query string. That endpoint needs no sign-in, so anyone who can reach your instance can send a crafted request.
• This release upgrades Next.js from 16.3.3 to 16.3.8, which contains the fix. Nothing else changes.
• If you can't upgrade right away, block /api/og-image-poll at your reverse proxy until you can. Shared poll links will show no preview image in the meantime; nothing else is affected.
• Upgrade Next.js to 16.3.8 to patch next/og RCE (#3451)
• Full Changelog: https://github.com/lukevella/rallly/compare/v4.15.3...v4.15.4

[Package Updates]

[2.15.5]

• Update rallly to 4.15.5
• Full Changelog
• Upgrade Next.js to 16.4.2 to patch Server Actions DoS (#3564)

[Package Updates]

[2.16.0]

• Update rallly to 4.16.0
• Full Changelog
• Organizers can now add a Google Meet, Zoom, Microsoft Teams or Webex call to a poll. Rallly creates the meeting on the organizer's account when the poll is finalized and puts the join link in the event, the calendar invite and the confirmation emails.
• Finalizing is now a three step flow that shows the time zone and each option's votes. Participants are told how they voted in the confirmation email, and invites are sent in batches from a queue inside the app, so large polls no longer hold up the request. No cron is needed.
• Plain yes or no polls: the "if need be" vote can be turned off.
• One edit page for details, options and settings. Old edit links redirect to it, and each change appears in the poll's activity feed.
• Edit and Duplicate from the polls list.
• A refreshed interface with list views for polls, events, members and home.
• When removing a member, choose whether their polls are reassigned or deleted.
• The login page remembers which method you used last.
• The Control Panel tells you when an update is available and whether it fixes a security issue. Rallly checks api.rallly.co hourly, sending only the version and an anonymous instance ID. On a restricted network the check fails silently; see Corporate Networks.
• Rate limits: response submission is now limited to 200 per poll per hour. Counts are kept in memory. If you run your own reverse proxy, make sure it sets X-Real-IP to the visitor's address, or set RATE_LIMIT_ENABLED=false.

[Package Updates]

[2.17.0]

• Update node-base | final to 24-20261021
• security: fix eMudhra cert compromise

[Package Updates]

[2.17.1]

• Update rallly to 4.16.1
• Full Changelog
• Set GOOGLE_LOGIN_ENABLED=false or MICROSOFT_LOGIN_ENABLED=false to hide it. Meet, Teams and Google Calendar keep working. (#3590, reported in #3580)
• Guests now see an error when Rallly can't create a guest session (for example when cookies are blocked), instead of the vote, comment or poll failing on submit. (#3585)
• The polls and events lists load 50 at a time, with previous and next links, and show a single loading state. The members page loads the same way. (#3581, #3582, #3583)
• Email link scanners such as Safe Links no longer open a database connection for every link they check. (#3571)
• Faster poll list and member counts. (#3573, #3575)
• Rounded buttons on the login and other auth pages. (#3587, #3589)

[Package Updates]

[2.17.2]

• Update rallly to 4.16.2
• Full Changelog

[Package Updates]

[2.17.3]

• Update rallly to 4.16.3
• Full Changelog
• Poll times saved an hour off around daylight saving changes
• In the week view, the hour skipped when clocks go forward is shown as a hatched "Clocks go forward" band, and a slot can't start inside it.
• In the month view, the start time dropdown lists exactly the times that exist in the poll's time zone.
• Options you already saved are not changed. If you created a poll with times close to a daylight saving change, check its options.