v0.27.0

[tankerkiller125]

Caution

Homebox now defaults to blocking notifiers to all internal IP addresses, if you have internal services with RFC1918 IPs that Homebox needs access to for webhooks or otherwise, please review our documentation on notifier security configuration: https://homebox.software/en/user-guide/notifiers/#network-security-for-notifiers

What's New

• This release includes significant improvements to search, including tokenization for database-based searching, and the ability to use Meilisearch as a backend. See our documentation for configuration: https://homebox.software/en/quick-start/configure/search/

Security Issues Patched

This release fixes 15 security issues:

• GHSA-mw9p-fhpj-jf82
• GHSA-h7wm-wjr6-cfxh
• GHSA-mgw9-qw3h-224m
• GHSA-58m4-m8xj-v3j2
• GHSA-754m-5j7m-8wfv
• GHSA-59cq-p2m6-hh23
• GHSA-j935-m3f2-frrj
• GHSA-4gp5-59x3-vhhg
• GHSA-4p8r-vm9v-c9pm
• GHSA-wxcf-4p4j-vhvg
• GHSA-g3p9-jfjj-pqgw
• GHSA-xqg9-6xxv-3452
• GHSA-h4x5-6587-jpwp
• GHSA-jm28-2xm3-m6m5
• GHSA-rhfm-x4x2-p3qr

What's Changed

• flake.lock: Update by @6543 in flake.lock: Update #1558
• chore: more consistent css by @andrewhong04 in chore: more consistent css #1559
• fix: various other issues with v0.26.x by @tankerkiller125 in fix: various other issues wit v0.26.x #1564
• linting improvements and apply formatting fixes by @harrisony in linting improvements and apply formatting fixes #1567
• Fix update-currencies CI job: restcountries API name field returns string instead of object by @tankerkiller125 with @Copilot in Fix update-currencies CI job: restcountries API name field returns string instead of object #1570
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #1568
• fix: backup memory usage by @lpiepiora in fix: backup memory usage #1582
• fix: various bugs by @tankerkiller125 in fix: various bugs #1596
• feat: replace the deprecated countries API with v5 by @ydkmlt84 in feat: replace the deprecated countries API with v5 #1622
• Update currencies.json by @github-actions[bot] in Update currencies.json #1638
• Fix/currency krone labels by @JacosVerksted in Fix/currency krone labels #1640
• fix: a few random crash fixes by @harrisony in fix: a few random crash fixes #1628
• Fix item detail photo grid to load thumbnails instead of originals by @WangLeto in Fix item detail photo grid to load thumbnails instead of originals #1607
• fix: clamp processedChars before slicing in wrapText by @SAY-5 in fix: clamp processedChars before slicing in wrapText #1658
• fix: preserve asset ID when re-importing items by import ref (Importing a File with import_ref increments asset-id #1100) by @TowyTowy in fix: preserve asset ID when re-importing items by import ref (#1100) #1610
• fix: resolve golangci-lint failures in Go CI by @harrisony in fix: resolve golangci-lint failures in Go CI #1629
• fix: use standard Cross-Origin header names in SecurityHeaders by @Ajithkumar003-dev in fix: use standard Cross-Origin header names in SecurityHeaders #1682
• fix(ci): attest the published manifest list digest instead of a copied source manifest by @Datastream-x86 in fix(ci): attest the published manifest list digest instead of a copied source manifest #1685
• fix broken internal links in contribute docs by @Gorghs in fix broken internal links in contribute docs #1689
• Fixed bug in Quickstart instructions by @stephenlf in Fixed bug in Quickstart instructions #1687
• feat: use full path in location search by @lpiepiora in feat: use full path in location search #1511
• fix: infinite preference sync feedback loop and default item page size by @IceeAn in fix: infinite preference sync feedback loop and default item page size #1632
• Update currencies.json by @github-actions[bot] in Update currencies.json #1695
• docs: fix typo extenal -> external by @vaibhav8a in docs: fix typo extenal -> external #1705
• fix: dates (hopefully) by @tankerkiller125 in fix: dates (hopefully) #1708
• fix(devcontainer): bump Go feature to 1.26 to match go.mod by @lonerockz in fix(devcontainer): bump Go feature to 1.26 to match go.mod #1710
• fix: make repo docker-compose.yml startable by @lonerockz in fix: make repo docker-compose.yml startable #1711
• fix(lint): extract repeated notifier URL fixture into a constant by @landscapejohn in fix(lint): extract repeated notifier URL fixture into a constant #1722
• Return barcode results when one provider fails by @justadityaraj in Return barcode results when one provider fails #1727
• Fix Traditional Chinese label generator crash by @justadityaraj in Fix Traditional Chinese label generator crash #1728
• your -> you are / you're by @Some1withgithub in your -> you are / you're #1724
• fix(scanner): guard AR overlay against locations with no children by @costajohnt in fix(scanner): guard AR overlay against locations with no children #1741
• docs: explain how Ensure Asset IDs treats an ID of 0 versus an empty one by @costajohnt in docs: explain how Ensure Asset IDs treats an ID of 0 versus an empty one #1743
• fix: redirect back to tags list after deleting a tag by @costajohnt in fix: redirect back to tags list after deleting a tag #1744
• docs: publish the Entity Types page the user guide already links to by @vaibhav8a in docs: publish the Entity Types page the user guide already links to #1748
• feat: better search by @tankerkiller125 in feat: better search #1550
• fix: child item seperate location by @tankerkiller125 in fix: child item seperate location #1696
• fix: roll back thumbnail transaction on all errors to prevent DB lockups by @marazmarci in fix: roll back thumbnail transaction on all errors to prevent DB lockups #1761
• Update currencies.json by @github-actions[bot] in Update currencies.json #1793

New Contributors

• @andrewhong04 made their first contribution in chore: more consistent css #1559
• @ydkmlt84 made their first contribution in feat: replace the deprecated countries API with v5 #1622
• @JacosVerksted made their first contribution in Fix/currency krone labels #1640
• @WangLeto made their first contribution in Fix item detail photo grid to load thumbnails instead of originals #1607
• @SAY-5 made their first contribution in fix: clamp processedChars before slicing in wrapText #1658
• @TowyTowy made their first contribution in fix: preserve asset ID when re-importing items by import ref (#1100) #1610
• @Ajithkumar003-dev made their first contribution in fix: use standard Cross-Origin header names in SecurityHeaders #1682
• @Datastream-x86 made their first contribution in fix(ci): attest the published manifest list digest instead of a copied source manifest #1685
• @Gorghs made their first contribution in fix broken internal links in contribute docs #1689
• @stephenlf made their first contribution in Fixed bug in Quickstart instructions #1687
• @vaibhav8a made their first contribution in docs: fix typo extenal -> external #1705
• @lonerockz made their first contribution in fix(devcontainer): bump Go feature to 1.26 to match go.mod #1710
• @landscapejohn made their first contribution in fix(lint): extract repeated notifier URL fixture into a constant #1722
• @justadityaraj made their first contribution in Return barcode results when one provider fails #1727
• @Some1withgithub made their first contribution in your -> you are / you're #1724
• @costajohnt made their first contribution in fix(scanner): guard AR overlay against locations with no children #1741
• @marazmarci made their first contribution in fix: roll back thumbnail transaction on all errors to prevent DB lockups #1761

Full Changelog: v0.26.2...v0.27.0

---

This discussion was created from the release v0.27.0.