v0.27.0

Caution

Homebox now defaults to blocking notifiers to all internal IP addresses, if you have internal services with RFC1918 IPs that Homebox needs access to for webhooks or otherwise, please review our documentation on notifier security configuration: https://homebox.software/en/user-guide/notifiers/#network-security-for-notifiers

What's New

• This release includes significant improvements to search, including tokenization for database-based searching, and the ability to use Meilisearch as a backend. See our documentation for configuration: https://homebox.software/en/quick-start/configure/search/

Security Issues Patched

This release fixes 15 security issues:

• GHSA-mw9p-fhpj-jf82
• GHSA-h7wm-wjr6-cfxh
• GHSA-mgw9-qw3h-224m
• GHSA-58m4-m8xj-v3j2
• GHSA-754m-5j7m-8wfv
• GHSA-59cq-p2m6-hh23
• GHSA-j935-m3f2-frrj
• GHSA-4gp5-59x3-vhhg
• GHSA-4p8r-vm9v-c9pm
• GHSA-wxcf-4p4j-vhvg
• GHSA-g3p9-jfjj-pqgw
• GHSA-xqg9-6xxv-3452
• GHSA-h4x5-6587-jpwp
• GHSA-jm28-2xm3-m6m5
• GHSA-rhfm-x4x2-p3qr

As usual, we thank all security researchers who reported issues.

What's Changed

• flake.lock: Update by @6543 in #1558
• chore: more consistent css by @andrewhong04 in #1559
• fix: various other issues with v0.26.x by @tankerkiller125 in #1564
• linting improvements and apply formatting fixes by @harrisony in #1567
• Fix update-currencies CI job: restcountries API name field returns string instead of object by @tankerkiller125 with @Copilot in #1570
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1568
• fix: backup memory usage by @lpiepiora in #1582
• fix: various bugs by @tankerkiller125 in #1596
• feat: replace the deprecated countries API with v5 by @ydkmlt84 in #1622
• Update currencies.json by @github-actions[bot] in #1638
• Fix/currency krone labels by @JacosVerksted in #1640
• fix: a few random crash fixes by @harrisony in #1628
• Fix item detail photo grid to load thumbnails instead of originals by @WangLeto in #1607
• fix: clamp processedChars before slicing in wrapText by @SAY-5 in #1658
• fix: preserve asset ID when re-importing items by import ref (#1100) by @TowyTowy in #1610
• fix: resolve golangci-lint failures in Go CI by @harrisony in #1629
• fix: use standard Cross-Origin header names in SecurityHeaders by @Ajithkumar003-dev in #1682
• fix(ci): attest the published manifest list digest instead of a copied source manifest by @Datastream-x86 in #1685
• fix broken internal links in contribute docs by @Gorghs in #1689
• Fixed bug in Quickstart instructions by @stephenlf in #1687
• feat: use full path in location search by @lpiepiora in #1511
• fix: infinite preference sync feedback loop and default item page size by @IceeAn in #1632
• Update currencies.json by @github-actions[bot] in #1695
• docs: fix typo extenal -> external by @vaibhav8a in #1705
• fix: dates (hopefully) by @tankerkiller125 in #1708
• fix(devcontainer): bump Go feature to 1.26 to match go.mod by @lonerockz in #1710
• fix: make repo docker-compose.yml startable by @lonerockz in #1711
• fix(lint): extract repeated notifier URL fixture into a constant by @landscapejohn in #1722
• Return barcode results when one provider fails by @justadityaraj in #1727
• Fix Traditional Chinese label generator crash by @justadityaraj in #1728
• your -> you are / you're by @Some1withgithub in #1724
• fix(scanner): guard AR overlay against locations with no children by @costajohnt in #1741
• docs: explain how Ensure Asset IDs treats an ID of 0 versus an empty one by @costajohnt in #1743
• fix: redirect back to tags list after deleting a tag by @costajohnt in #1744
• docs: publish the Entity Types page the user guide already links to by @vaibhav8a in #1748
• feat: better search by @tankerkiller125 in #1550
• fix: child item seperate location by @tankerkiller125 in #1696
• fix: roll back thumbnail transaction on all errors to prevent DB lockups by @marazmarci in #1761
• Update currencies.json by @github-actions[bot] in #1793

New Contributors

• @andrewhong04 made their first contribution in #1559
• @ydkmlt84 made their first contribution in #1622
• @JacosVerksted made their first contribution in #1640
• @WangLeto made their first contribution in #1607
• @SAY-5 made their first contribution in #1658
• @TowyTowy made their first contribution in #1610
• @Ajithkumar003-dev made their first contribution in #1682
• @Datastream-x86 made their first contribution in #1685
• @Gorghs made their first contribution in #1689
• @stephenlf made their first contribution in #1687
• @vaibhav8a made their first contribution in #1705
• @lonerockz made their first contribution in #1710
• @landscapejohn made their first contribution in #1722
• @justadityaraj made their first contribution in #1727
• @Some1withgithub made their first contribution in #1724
• @costajohnt made their first contribution in #1741
• @marazmarci made their first contribution in #1761

Full Changelog: v0.26.2...v0.27.0