Cloudron Forum

[4.172.0]

• Update wekan to 11.72
• Full Changelog
• Fix board JSON exports containing HTML. Thanks to xet7.
• Design: how an attachment is deleted, shown in the card history, restored and purged. Thanks to xet7.

[1.33.1]

• Update changedetection.io to 0.60.4
• Full Changelog
• Add Indonesian (Bahasa Indonesia) translation by @Yoruxyv in #4402
• UI - Left menu folds out ONTOP of content, Improving VisualSelector & BrowserSteps width, Darkmode transitions off. #4380 by @dgtlmoon in #4401
• Fix TestHistoryPathTraversal on macOS, and cover the containment check by @GG5533 in #4390
• API - DELETE for Watch history #4397 by @dgtlmoon in #4403
• Apprise notifications - Updating to 1.13.1 by @dgtlmoon in #4404
• feature: Implemented optional override link by @jhedlund in #4290
• Perf/open link single eval by @dgtlmoon in #4405
• UI - Edit watch - Moving notification error alert to 'error' tab, hiding less used Page Title and Link options under foldout by @dgtlmoon in #4406
• UI - Groups - Fixing button alignment and using better form handling by @dgtlmoon in #4409
• UI - Watchlist - bring back Restock & Price column to watchlist overview by @dgtlmoon in #4410

[1.22.32]

• Update invoiceninja to 5.13.40
• Full Changelog
• Adjustments for location props for Template Service
• Lock props on Payment mEthods
• Fixes for static analysis
• Adjustments for activity dates for task calendars
• Improvements for auto bill options at checkout
• Fixes for schematron validations
• Support Convert to Purchase Order for Invoices and Quotes
• Generic OpenID Connect (OIDC) provider env-driven, .well-known discovery by @matheusliraofficial in #12073
• Add Stripe PromptPay payment method support by @bold84 in #12243
• Make the VIES check work: REST instead of SOAP, and record a "no" by @payware in #12249

[1.31.0]

• Update navidrome to 0.64.0
• Full Changelog
• All internal IDs are re-encoded to a single canonical 128-bit base62 format. The migration touches every table, so back up your database before upgrading. Clients that cache item IDs (for example, offline downloads) may need to re-sync. (#5824)
• Plugin authors: Extism's built-in HTTP is disabled. Calls through pdk.NewHTTPRequest (Go), http::request (Rust) or the equivalent in other PDKs now fail with HTTP request ... is not allowed. Plugins must use the host HTTP service instead: host.HTTPSend (Go) or nd_pdk::host::http::send (Rust). Also, plugin HTTP and WebSocket connections to private or loopback addresses are now blocked for named hosts; to reach a LAN service, list its IP or CIDR in the manifest's requiredHosts, or use a bare "*". (1a8463f7d, 276d767ce)
• Shares are always owned by the user who creates them. Admins can no longer create shares on behalf of another user via userId. (1a8463f7d)
• Configuration durations are now validated. Negative values are rejected at startup. (#6002)
• Add an experimental Jellyfin Music API, enabling Jellyfin-compatible music clients to connect to Navidrome. Enable it with Jellyfin.Enabled = true. (#5730 by @deluan)
• Add Refresh Metadata action to album and artist pages and context menus. (#6036, #6078 by @deluan)
• Add playlist favourites: heart button, list filter, and a sidebar favourites-only toggle. (#5805 by @deluan)
• Add Catppuccin Mocha and Frapp themes, and update Macchiato to match the official palette. (#5835 by @cmyksoda)
• Fix logins sometimes showing the wrong user. (#5882 by @deluan, #5767 by @apkatsikas)
• Fix sources already in the player's forced format being re-encoded, and make piped FLAC transcodes seekable. (#6105 by @deluan)

[1.18.4]

• Update pocketbase to 0.40.4
• Full Changelog
• Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836).
• app.ResetBootstrapState() was soft-deprecated in favour of app.ClearBootstrap().
• Additionally a new app.OnClearBootstrap() hook was added to allow clearing custom allocated OnBootstrap resources in case the app uses a non-standard initialization (e.g. doesn't call Start() or intentionally skip the OnTerminate hook).
• Bumped golang.org/x/* dependencies.

[1.43.1]

• Update whitebophir to 2.17.1
• Full Changelog

[1.16.32]

• Update freescout to 1.8.240
• Full Changelog
• Allow to Archive mailboxes.
• Added Azerbaijani translation.
• Highlight number of replies in the conversations list.
• Added America/Vancouver timezone (#5622)
• Fixed To field in notes created when forwarding to multiple recipients (#5441)
• Do not send email to customer via SendReplyToCustomer listener if thread is not set in the event (#5616)
• Automatically rename incrorrectly named Module folders on activation.
• Added csrf token to Undo Reply action (GHSA-5vw8-4wxh-6mpr)
• Use Message-Id from headers for In-Reply-To when message_id is generated (#5620)
• Use user timezone in the text body of user email notifications (closes #5628)

[1.2.0]

• Update opodsync to 0.6.0
• Full Changelog
• New: Add in-browser player that remembers position (thanks @debenore)
• New: display play progress in list of episodes
• New: Use relative date for listing last updated feeds
• Move list of episodes actions to a separate page
• Fix issues with feed updates reaching max_execution_time (thanks @MartinCa)
• Fix: durations were wrongly stored when they were in the HH:MM:SS format in feeds
• Fix: all feeds were always updated, now they're only updated if they have new actions
• Fix: set timeout for fetching a feed to 5 seconds (should be plenty enough)

[2.8.1]

• Update cloudflared to 2026.9.1

[2.15.0]

• Update rallly to 4.15.0
• Full Changelog
• Who this affects: instances using Microsoft sign-in on a multi-tenant endpoint which is the default. MICROSOFT_TENANT_ID defaults to common, so this applies unless you have set it to your own tenant ID. Instances set to a single tenant are unaffected, as are OIDC and Google.
• On a multi-tenant endpoint any tenant can assert any email address, so Rallly now needs Microsoft to confirm an address before creating an account from it. Microsoft only sends that confirmation if the app registration asks for it.
• This release does not break these sign-ins. If the claims are missing, Rallly still creates the account and logs a warning. A future release will refuse them. Add the claims now so that release is uneventful:
• Full instructions: https://support.rallly.co/self-hosting/single-sign-on#microsoft
• In previous versions, responses were soft-deleted. In this release responses are hard-deleted and previously soft-deleted responses are purged. Back up before upgrading.
• This release contains several security fixes. Upgrading is recommended. Advisories with full details, affected versions and credit to the reporters will follow shortly.
• Hosts can now invite participants by email from the Share dialog: send personal invite links, copy an invitee's link, remove a pending invite, and see when a link has been opened.
• Every response now carries an edit token, so the link in a confirmation email edits exactly the response it names. Hosts can still copy the invite link and hand it to someone who responded without leaving an email address.
• Full Changelog: https://github.com/lukevella/rallly/compare/v4.14.0...v4.15.0

[2.9.7]

• Update mirotalksfu to 2.4.49

[1.20.14]

• Update mirotalkp2p to 1.9.64

[2.0.3]

• Update grav to 2.0.27
• Full Changelog
• Grav 2.0 sites can update to 2.1. bin/gpm selfupgrade treated each minor release as a separate line, the way 1.7 and 1.8 were, so a 2.0 site was told it was up to date while 2.1.0 was out. Only a new major version now needs a manual move #4299
• When a new major version of Grav is out, bin/gpm selfupgrade says so and links to the migration guide instead of only reporting that the site is up to date
• Licence keys from other stores are accepted. The key format check only knew the Grav Premium format, so a KahunaCart key such as KC-XXXX-XXXX-XXXX-XXXX was refused by the API plugin's install endpoint and by License Manager. The check now only turns away what no store could have issued
• When getgrav.org refuses a premium download for a reason the person can act on, such as an updates window that has ended, bin/gpm install prints the store's explanation instead of only "Unauthorized Premium License Key". The API plugin bundled with this release relies on it

[0.8.6]

• Update infisical to v0.165.10
• Full Changelog
• fix(group-service): block sub-org membership changes on parent-owned groups by @victorvhs017 in #8030
• fix(pki): issue only policy-validated subject and SAN values by @carlosmonastyrski in #8056
• fix(pam): atomic recording secret mint by @bernie-g in #8043
• feat: validation rule api revamp by @varonix0 in #8046
• fix(announcements): stabilize modal height and image loading by @andrewhuhh in #8042
• feat(pki): manage imported certificates by attaching a certificate profile by @carlosmonastyrski in #7961
• feat(vault-migration): add support for folder creation by @adilsitos in #7928

[2.19.0]

• Update cubby to 2.19.0
• Move from PostgreSQL to SQlite reducing memory footprint
• Make Cloudron groups available for sharing and group folders
• Use Cloudron app passwords for webdav
• Recoll search indexer fixes
• Improve timestamp usage in UI

[0.11.0]

• Update mail to 0.11.0
• Fix unread count

[0.10.0]

• Update mail to 9fdb077
• move the layout/view settings to local storage from db
• bubble up the unread count indicator in folder view
• rename layout to message below and message to the right
• show time and not just the date for messages

[1.3.0]

• Update contacts to 1.3.0
• Use new cloudron app passwords route for carddav
• Fix contact avatar edit
• Fix browser history bugs

[1.4.0]

• Update calendar to 1.4.0
• Use the new app bridge API

[1.28.0]

• Update sockpuppetbrowser to a4a9ee3