Skip to content

Telemetry Tracker v1.18.4

Choose a tag to compare

View all tags
@unjica unjica released this 09 Oct 18:20
· 153 commits to develop since this release
v1.18.4
43319cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

Security patch for the dashboard.

  • Next.js 15.5.18 → 15.5.27, sharp 0.34.5 → 0.35.5 (#754). Fixes the App Router Server Actions denial of service (GHSA-m99w-x7hq-7vfj), the Image Optimization AVIF RCE (GHSA-2xp9-vwfh-vxw4), plus SSRF, cache-confusion and image DoS advisories in Next.js and libvips/libheif advisories in sharp.

⚠️ Windows self-hosters: upgrade now

Next.js < 15.5.24 allows unauthenticated remote code execution on Windows-hosted servers (CVE-2026-75604 / GHSA-p293-qw3h-jr36). If you run the dashboard on Windows, upgrade to v1.18.4 immediately. Linux/Docker deployments (including the hosted cloud) are not affected by this specific issue but should still upgrade for the other fixes.

Upgrade steps

  • No database migrations since v1.18.3.
  • No new or changed environment variables.
  • SDKs unchanged (@telemetry-tracker/next keeps its next >=14 peer range).

Full details: CHANGELOG

Assets 2
Loading