v4.9.5

4.9.5 (2026-06-06)

Bug Fixes

• container startup (#1077) (b33d2cb)

v4.9.4

4.9.4 (2026-06-06)

⚠️ Broken release — container fails to start. Use 4.9.5 instead.

Bug Fixes

• restrict migrate.php to CLI and admin session (85bba48)
• secure unauthenticated db restore endpoint with a setup token (85bba48)
• validate oidc state parameter to prevent csrf login attack (85bba48)

v4.9.3

4.9.3 (2026-05-27)

Bug Fixes

• bump version (#1069) (fb96250)

v4.9.2

4.9.2 (2026-05-27)

Bug Fixes

• build (#1067) (ee62138)

v4.9.1

4.9.1 (2026-05-27)

Bug Fixes

• cross-user data isolation issues (e276147)
• ensure a user always has an api key generated (e276147)
• null pointer on subscription with price 0 (e276147)

v4.9.0

4.9.0 (2026-05-16)

Features

• allow multiple filters on the settings page (0fef959)
• filter by notification status (0fef959)
• lifetime subscriptions (0fef959)
• rework icons (0fef959)
• sort graphs on the statistics page by usage (0fef959)

Bug Fixes

• don't use mbstring (0fef959)
• migrations using double quotes (0fef959)
• ntfy notifications with strange chars (0fef959)
• null array on empty subscription list (0fef959)
• open 3 dot menu abone for the subscriptions at the bottom (0fef959)

v4.8.4

4.8.4 (2026-04-27)

Bug Fixes

• improve date formatting with IntlDateFormatter fallback (b2c565f) (#1048) (8d43623)
• missing year for subscription next payment display (ca5823d) (8d43623)

v4.8.3

4.8.3 (2026-04-26)

Bug Fixes

• cases on private endpoints where self-xss was possible (#1045) (d4725f3)

v4.8.2

4.8.2 (2026-04-18)

Bug Fixes

• logo cut on registration page (#1040) (a95aaad)

v4.8.1

4.8.1 (2026-04-18)

Bug Fixes

• dns rebinding vulnerability (e79f28b)
• only allow to use internal urls csrf validation bypass by admin user (e79f28b)
• ssrf vultenaribility on add subscription (#1038) (e79f28b)