v1.8.2

Recipes synced from Mealie and Tandoor get their ingredients and steps, and security updates for the e-mail and rate-limit libraries.

Mealie and Tandoor recipes are complete again

Synced recipes arrived with a title, a description and nothing to cook: no ingredients, no instructions. Both Mealie and Tandoor list recipes without those details, which only come from each recipe's own page, and the sync stored the list entry (#110, reported by @GuybrushThreewood).

• The sync now reads each recipe in full.
• Recipes already synced empty are filled in at the next sync: after upgrading, open Integrations and sync again. A recipe you filled in yourself is never overwritten.
• Mealie: ingredients kept whole in the note (unparsed) come through as Mealie shows them, and durations written in words ("15 minutes") are read.
• Tandoor: section titles are no longer imported as ingredients.

Security

• nodemailer 10.0.13 fixes a high-severity advisory (GHSA-6vj9-mwq6-2f5v: the DNS cache could reuse a TLS server name across mail transports) and three moderate ones in its address parser. Only invitation and password-reset e-mails use it.
• ip-address 10.7.2, used by the login rate limit, fixes four moderate advisories in IP address classification (#108).
• brace-expansion, a build-time tool, fixes three denial-of-service advisories (#109). It is not part of the images.

Upgrading

No new setting and no migration since 1.8.1. nodemailer 10 needs Node.js 20 or newer, which the Docker images and the Windows installer already use. If you run the server yourself outside Docker, check node --version.

Ready-made images: ghcr.io/nexaflowfrance/openfamily-server:1.8.2 and ghcr.io/nexaflowfrance/openfamily-client:1.8.2, for amd64 and arm64.

What's Changed

• build(deps): bump brace-expansion by @dependabot[bot] in #109

Full Changelog: v1.8.1...v1.8.2

What's Changed

• build(deps): bump brace-expansion by @dependabot[bot] in #109

Full Changelog: v1.8.1...v1.8.2