Skip to content

v5.19.0

Choose a tag to compare

View all tags
@evilguy4000 evilguy4000 released this 05 Nov 23:06
· 39 commits to develop since this release
v5.19.0
c392c49
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[5.19.0] - 2026-11-05

Added

  • Public demo (DEMO_MODE) — Skip the setup wizard and seed browseable sample data for public demos; README/demo assets aligned with the live demo.
  • App shell UX — Improved UI look, information architecture, and brand consistency across the app shell.
  • First-run / contributor UX — Onboarding, empty states, and i18n improvements for new installs and contributors.

Security

  • SSRF / XSS / mass-assignment / deploy defaults — Harden outbound URL validation, CORS/Socket.IO, DOM escaping, attachment path jailing, and compose/env credential defaults.
  • Render health checks — Tolerate transient connection-refused blips during deploys.
  • CodeQL follow-ups — Clear property-injection, stack-trace, and log-injection findings; run helper images as non-root; Dependabot overrides for follow-redirects and minimatch.

Fixed

  • Timer — Bulk entry can add a slot that starts when another entry ends (adjacent slots).
  • Projects — Show the new-install empty state when no status filter is set; wrap filter labels/options in gettext.
  • Web — Restore #746 reconnect guards; harden entry/invoice paths; restore curated timezones and template script blocks.
  • Migrations — Make late SQLite upgrades batch-safe.
  • Mobile — Use named flutter_local_notifications APIs after dependency updates.
  • Docker — Fix local-test compose build context for the root Dockerfile (#818); restore app boot after Dependabot major bumps.
  • CI / develop image — Broaden CD-Development path filters for image-affecting trees and stop cancelling in-flight publishes so :develop reaches GHCR/Docker Hub more reliably.

Changed

  • CI / releases — Consolidated PR checks into a single path-aware ci.yml with a required ci-pass aggregator; Dependabot + nightly dependency audit; automated Prepare/Finalize release workflows (rc/v* → tag → publish) and scripts/bump_version.py as the version source of truth.
  • Dependencies — Large pip, GitHub Actions, npm (root + desktop), and Flutter mobile dependency bumps.

Documentation

  • First-five-minutes checklist after Docker quick start; demo credentials beside the live demo link; refreshed dashboard screenshot; community/discovery funnel tweaks.
  • Release and version docs aligned with Prepare/Finalize + bump_version.py (superseding manual GitHub Releases / version-manager.sh as the primary path).
Assets 9
Loading