2.6.13

• updated translations

2.6.12

• fixed private recipes could be manipulated by space users trough steps API GHSA-wjf3-fq5w-7j7w
• updated translations

2.6.11

• improved pantry booking dialog and table
• fixed another order parameter

2.6.10

• fixed recipes marked as private could be viewed trough API utility endpoints GHSA-cqj3-64qw-4w52
• fixed recipe search and recipe book API endpoints accepting any order by attribute GHSA-4x57-2q4q-xwpp
• fixed regex ddos possibility in automation engine GHSA-f2gw-c2c7-59v7
• fixed AI Providers could be configured with malicious URLs to allow SSRF GHSA-wq4h-2r8x-cv65
  • ⚠️ if you are using custom AI backends you need to add them to the new AI_ALLOWED_URLS settings (see https://docs.tandoor.dev/system/configuration/#ai-integration)
• fixed bookmarklets of other users in your own space could be accessed/deleted GHSA-4vw7-c646-g23w
• updated lots of dependencies
• updated translations for various languages

2.6.9

• fixed another stored XSS in recipe instructions GHSA-89pw-5qxc-7v86
• updated pillow library security update

2.6.8

• fixed broken markdown rendering in recipes

2.6.7

• improved app importer error messages
• fixed error while search in slow network conditions #4621
• fixed stored XSS issues in the templating engine

2.6.6

• fixed household setup not skippable #4609

2.6.5

• fixed docs link to gunicorn docs #4563 (thanks to @igordiogobp #4608)
• fixed vite error (thanks to @smilerz #4592)
• fixed shopping list error when item has no amount
• fixed minus in meal plan editor could remove the date completely
• fixed move ingredient dialog not working #4552
• fixed potential DDoS by limiting uploaded zip file sizes GHSA-w8pq-4pwf-r2m8
• updated FAQ for webserver setups (thanks to @JoywinNeilLasrado #4607)
• updated dependencies

2.6.4

• added Household setup page and default creation to welcome stepper
• added django migration records to admin
• fixed food shopping sub endpoint not validating amount and unit inputs GHSA-8w8h-3pv2-3554
• fixed a shared user could make changes to a book trough the API GHSA-xvmf-cfrq-4j8f
• fixed style tags allowed in rendered markdown could lead to CSS injection in third party clients that did not properly clean the output on the frontend GHSA-9hhh-g2fc-r8x2
• fixed recipe batch update endpoint could be used to update private recipes of other space members if the ID was known GHSA-v8x3-w674-55p5
• fixed performance issues on some admin views
• fixed admins can accidentally lock themselves out of their space
• fixed category order jumping in shopping list when checking and not having any supermarket selected #4446
• fixed selecting no supermarket in shopping not working
• removed shopping list entries and meal plans from previously shopping shared users being shown
• updated dependencies