Cloudron Forum

[1.30.0]

• Update tymeslot to 1.41.0
• Full Changelog
• calendar: Make the selected date, today marker and schedule tabs readable
• calendar: Make the calendar grid usable from the keyboard and screen readers
• dashboard: Name the setup checklist by the text it shows
• dashboard: Make the selected option of toggle controls readable
• booking: Show the organiser's legal links when a group booking is full
• themes: Preload booking page fonts so the page stops jumping on load
• payments: Stop an earlier dispute's late close clearing a live one
• admin: Let admins cancel a pending invitation
• admin: Invite users by email from the admin users page
• embed: Keep the booking popup inside the window on tablets

[2.16.0]

• Update prometheus to 3.16.0
• Full Changelog
• API: The experimental search endpoints now clamp batch_size to 1000. #19731
• Configuration: Default --web.external-url to https when --web.config.file enables TLS. #19241
• Remote write: Stop exposing the deprecated prometheus_remote_storage_metadata_total, prometheus_remote_storage_metadata_failed_total, prometheus_remote_storage_metadata_retried_total, and prometheus_remote_storage_metadata_bytes_total metrics for Remote Write 2.0 queues. #20080
• TSDB: Reject exemplars whose label names are not unique, instead of storing them and serving a duplicate JSON key from /api/v1/query_exemplars. #19896
• API: Allow overriding PromQL Start Timestamp processing on a per-query basis using the X-Prometheus-Use-Start-Timestamps HTTP header. #19066
• PromQL: Add experimental integral() function for computing integral-over-time of range vectors behind the --enable-feature=promql-experimental-functions flag. #14440
• PromQL: Add experimental query cost estimation, actual cost reporting, and configurable execution limits, enabled with --enable-feature=query-cost. #20028
• PromQL: Allow unquoted Unicode letters and dots behind a feature flag #20162
• BUGFIX] Remote read: Abort failed streaming responses without writing duplicate headers or appending plain-text errors to the protobuf stream #19749
• BUGFIX] TSDB: Fix loss of out-of-order samples when a WAL checkpoint drops a series record that the out-of-order write-behind log still needs #19737

[2.2.1]

• Update planka to 2.3.1
• Full Changelog
• Fix the description editor crashing to a blank page on boards with a member who has no username

[3.2.2]

• Update formbricks to 6.1.4
• Full Changelog
• Fix CSP violations in choice and matrix survey questions with styled headlines by removing inline styles before parsing survey HTML. #9931
• Add an optional SMTP_REQUIRE_TLS=1 setting to require STARTTLS for explicit-TLS SMTP (typically port 587). The default remains 0 for compatibility with local relays; enable it only after confirming your provider supports STARTTLS. #9922
• Bound collection sizes in authentication requests and reject unsupported request bodies early. #9938
• Restore AuthZed projection delivery after transient Redis interruptions with an outbox recovery safety net and updated job dependencies. #9947

[2.7.2]

• Update joplin to 3.7.4
• Full Changelog
• Improved: Index locked note resources (#15717) (#15714 by @keshav0479)
• Fixed: Fix renderer crash loop when sqlite-vec is unavailable (#15762) (#15761)

[1.15.1]

• Update calendar to 1.15.1
• Support recurring event exceptions

[1.24.11]

• Update mirotalkp2p to 2.2.80

[2.13.7]

• Update mirotalksfu to 2.7.81

[3.15.0]

• Add all upstream supported locales

[1.15.0]

• Update calendar to 93cc418
• Various UI fixes

[1.34.1]

• better postinstall msg

[1.28.0]

• Update snappymail to 3.0.0
• Full Changelog
• HTML Injection via SVG attachement - by @wlp3s0 GHSA-cjq6-6gwv-qxjj
• Unauthenticated SSRF in ServiceProxyExternal - by @metadust GHSA-wq6r-r5m6-485g
• Stored XSS via javascript: URLs in Email Links - by @wyx98765 GHSA-7463-5wp4-wx54
• PHP 8.2 is the minimum due to Sabre
• Test contacts CardDAV settings
• Setting for default messages sort mode
• Ask to decrypt PGP and S/MIME messages before edit/reply/forward/etc. #1849
• Can not send email using SCRAM #1813
• Inline images break when editing emails #1846
• Duplicate contacts on autosave for addresses with uppercase letters - by @MiDniGG #2079

[1.27.0]

• Update playwright to 1.65.0
• Full Changelog
• The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:
• New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.
• New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:
• TypeScript class fields now follow useDefineForClassFields from your tsconfig.json, the same as tsc. It is enabled for ES2022 and later targets, and when target is not specified. A field initializer that reads a constructor parameter property now fails, because the initializer runs first:
• Actions such as locator.click(), locator.check(), locator.tap(), locator.fill(), locator.clear() and locator.selectOption() now wait for the element to be not inert. An action on an element with the inert attribute, or inside such an element, now times out if the element stays inert.
• A sharded run now fails with "No tests found" when no tests match across all shards. Pass --pass-with-no-tests to allow this. An empty shard still passes when other shards have tests.
• Cookie matching now follows RFC 6265. With a URL, browserContext.cookies() and apiRequestContext.cookies() no longer return host-only cookies for subdomains or Path=/api cookies for /apiv2, and a Path=/foo/ cookie does not match /foo. APIRequestContext sends a cookie without a name as Cookie: x instead of Cookie: =x, and stores Set-Cookie: token as a cookie without a name.
• Proxy credentials are no longer sent to websites. The credentials in the proxy option now answer only proxy challenges. To authenticate on a website, use httpCredentials.
• Text that the browser does not render, such as text that is not assigned to a slot or text directly inside a closed <details>, is no longer part of accessible names and aria snapshots. This can change the results of page.getByRole() with a name, locator.ariaSnapshot() and expect(locator).toMatchAriaSnapshot().
• Playwright no longer tests on Node.js 20. Use Node.js 22, 24 or 26, as listed in the system requirements.

[1.19.14]

• Update ollama to 0.40.15
• Full Changelog
• ollama launch now supports Kimi Code CLI the successor to kimi-cli and offers to migrate existing kimi-cli setups
• ollama launch now fills in Pi's model list automatically so models can be picked inside Pi, and Claude Desktop's model picker shows Ollama's actual model names
• Recurrent and vision GGUF models can now serve more than one request at a time
• Qwen3 and Qwen3.5 models using long-context (YaRN) scaling
• Running ollama with no arguments opens the welcome launcher
• Full Changelog: https://github.com/ollama/ollama/compare/v0.40.14...v0.40.15

[1.34.2]

• Update mattermost to 12.0.2
• Full Changelog
• Mattermost Platform Release 12.0.2 contains Medium to High severity level security fixes.

[1.103.14]

• Update immich to 3.3.6
• Full Changelog
• fix(ml): disable onnxruntime telemetry by @mjkent in #32956

[3.19.0]

• Update Stirling-PDF to 3.3.0
• Full Changelog
• fix(viewer): keep the reading page after adding a bookmark by @EthanHealy01 in #8675
• fix(cert-sign): accept unencrypted PKCS#8 PEM private keys by @EthanHealy01 in #8694
• fix(security): bound request size and harden the mobile scanner relay by @reecebrowne in #8672
• fix(fileEditor): only offer archive extraction for .zip files by @balazs-szucs in #8722
• feat(security): SSO auto-login with password login enabled, bypassable via /login?all by @EthanHealy01 in #8486
• feat(api): implement Hibernate second-level caching for core entities using Caffeine JCache by @balazs-szucs in #7504
• Replace OpenCV in the mobile scanner with built-in page detection by @Frooodle in #8719
• Upgrade Office Convert to 0.3.3 and extend native conversion options by @Frooodle in #8761
• Fix Convert batch routing, ebook settings and email recipients by @Frooodle in #8766
• Keep form fields fillable when embedding fonts for PDF/UA by @Frooodle in #8716

[1.8.3]

• Update keycloak to 26.8.2
• Full Changelog
• #53061 [CVE-2026-92358] Cross-browser fallback proof survives successful account linking and self-service unlink organizations
• #53618 [CVE-2026-105305] Device Authorization Grant bypasses per-client minimum.acr.value enforcement authentication
• #53749 CVE-2026-107623: OIDC DCR read-modify-write silently disables offline token revocation on backchannel logout oidc
• #53813 [CVE-2026-107889] Stored XSS on the login page via kcSanitize bypass authentication
• #54184 Upgrade to Quarkus 3.40.1.1 dist/quarkus
• #44474 Keycloak Maximum Concurrent Session Limit is incorrectly registered as a login failure, triggering Keycloak's Brute Force protection authentication
• #52870 Realm import: JSON representation migration fails with LazyInitializationException when a users file is present (regression in 26.3) import-export
• #53238 Theme resources intermittently 404 on a cold gzip cache: GzipResourceEncodingProvider replaces the cached file non-atomically core
• #53612 BCFIPS imports only the first certificate from a multi-certificate PEM trust bundle core
• #53809 ISPN000427 timeout on distributed caches when entry lock is contended during topology change infinispan

[3.33.2]

• Update metabase to 0.65.3.4

[1.28.0]

• Update vikunja to 2.8.0
• Full Changelog
• Reject JSON bodies containing NUL on /api/v1
• Reject JSON bodies containing NUL on /api/v2
• Apply calendar-query filters to tasks
• Restore task cards to kanban boards
• Auto-scroll the board while dragging a task to off-screen buckets
• Return the user object instead of user_id on time entries
• Sync teams from oidc groups claim (#4311)
• Persist linked OIDC identities and authenticate local accounts
• Lock account after 10 failed password attempts
• Trash and restore project trees