Version 27.0.1

[!WARNING] This release is a security release to patch a NodeJS upstream vulnerability. We advise updating to this version of Homebox as soon as possible.

Security Issues Patched

This version patches NodeJS to remediate risks surrounding Node2Shell. Homebox does not leverage PHP and therefore was not affected by the PHP2Shell vulnerability that was disclosed.

Full Changelog: https://github.com/sysadminsmedia/homebox/compare/v0.27.0...v0.27.1

Source GitHub

[!CAUTION] Homebox now defaults to blocking notifiers to all internal IP addresses, if you have internal services with RFC1918 IPs that Homebox needs access to for webhooks or otherwise, please review our documentation on notifier security configuration: https://homebox.software/en/user-guide/notifiers/#network-security-for-notifiers

What's New

• This release includes significant improvements to search, including tokenization for database-based searching, and the ability to use Meilisearch as a backend. See our documentation for configuration: https://homebox.software/en/quick-start/configure/search/

Security Issues Patched

This release fixes 15 security issues:

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mw9p-fhpj-jf82

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h7wm-wjr6-cfxh

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-mgw9-qw3h-224m

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-58m4-m8xj-v3j2

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-754m-5j7m-8wfv

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-59cq-p2m6-hh23

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j935-m3f2-frrj

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4gp5-59x3-vhhg

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-4p8r-vm9v-c9pm

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-wxcf-4p4j-vhvg

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-g3p9-jfjj-pqgw

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-xqg9-6xxv-3452

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-h4x5-6587-jpwp

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-jm28-2xm3-m6m5

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-rhfm-x4x2-p3qr

As usual, we thank all security researchers who reported issues.

What's Changed

• flake.lock: Update by @6543 in https://github.com/sysadminsmedia/homebox/pull/1558

• chore: more consistent css by @andrewhong04 in https://github.com/sysadminsmedia/homebox/pull/1559

• fix: various other issues with v0.26.x by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1564

• linting improvements and apply formatting fixes by @harrisony in https://github.com/sysadminsmedia/homebox/pull/1567

• Fix update-currencies CI job: restcountries API name field returns string instead of object by @tankerkiller125 with @Copilot in https://github.com/sysadminsmedia/homebox/pull/1570

• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1568

• fix: backup memory usage by @lpiepiora in https://github.com/sysadminsmedia/homebox/pull/1582

• fix: various bugs by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1596

• feat: replace the deprecated countries API with v5 by @ydkmlt84 in https://github.com/sysadminsmedia/homebox/pull/1622

• Update currencies.json by @github-actions[bot] in https://github.com/sysadminsmedia/homebox/pull/1638

• Fix/currency krone labels by @JacosVerksted in https://github.com/sysadminsmedia/homebox/pull/1640

• fix: a few random crash fixes by @harrisony in https://github.com/sysadminsmedia/homebox/pull/1628

• Fix item detail photo grid to load thumbnails instead of originals by @WangLeto in https://github.com/sysadminsmedia/homebox/pull/1607

• fix: clamp processedChars before slicing in wrapText by @SAY-5 in https://github.com/sysadminsmedia/homebox/pull/1658

• fix: preserve asset ID when re-importing items by import ref (#1100) by @TowyTowy in https://github.com/sysadminsmedia/homebox/pull/1610

• fix: resolve golangci-lint failures in Go CI by @harrisony in https://github.com/sysadminsmedia/homebox/pull/1629

• fix: use standard Cross-Origin header names in SecurityHeaders by @Ajithkumar003-dev in https://github.com/sysadminsmedia/homebox/pull/1682

• fix(ci): attest the published manifest list digest instead of a copied source manifest by @Datastream-x86 in https://github.com/sysadminsmedia/homebox/pull/1685

• fix broken internal links in contribute docs by @Gorghs in https://github.com/sysadminsmedia/homebox/pull/1689

• Fixed bug in Quickstart instructions by @stephenlf in https://github.com/sysadminsmedia/homebox/pull/1687

• feat: use full path in location search by @lpiepiora in https://github.com/sysadminsmedia/homebox/pull/1511

• fix: infinite preference sync feedback loop and default item page size by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1632

• Update currencies.json by @github-actions[bot] in https://github.com/sysadminsmedia/homebox/pull/1695

• docs: fix typo extenal -> external by @vaibhav8a in https://github.com/sysadminsmedia/homebox/pull/1705

• fix: dates (hopefully) by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1708

• fix(devcontainer): bump Go feature to 1.26 to match go.mod by @lonerockz in https://github.com/sysadminsmedia/homebox/pull/1710

• fix: make repo docker-compose.yml startable by @lonerockz in https://github.com/sysadminsmedia/homebox/pull/1711

• fix(lint): extract repeated notifier URL fixture into a constant by @landscapejohn in https://github.com/sysadminsmedia/homebox/pull/1722

• Return barcode results when one provider fails by @justadityaraj in https://github.com/sysadminsmedia/homebox/pull/1727

• Fix Traditional Chinese label generator crash by @justadityaraj in https://github.com/sysadminsmedia/homebox/pull/1728

• your -> you are / you're by @Some1withgithub in https://github.com/sysadminsmedia/homebox/pull/1724

• fix(scanner): guard AR overlay against locations with no children by @costajohnt in https://github.com/sysadminsmedia/homebox/pull/1741

• docs: explain how Ensure Asset IDs treats an ID of 0 versus an empty one by @costajohnt in https://github.com/sysadminsmedia/homebox/pull/1743

• fix: redirect back to tags list after deleting a tag by @costajohnt in https://github.com/sysadminsmedia/homebox/pull/1744

• docs: publish the Entity Types page the user guide already links to by @vaibhav8a in https://github.com/sysadminsmedia/homebox/pull/1748

• feat: better search by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1550

• fix: child item seperate location by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1696

• fix: roll back thumbnail transaction on all errors to prevent DB lockups by @marazmarci in https://github.com/sysadminsmedia/homebox/pull/1761

• Update currencies.json by @github-actions[bot] in https://github.com/sysadminsmedia/homebox/pull/1793

New Contributors

• @andrewhong04 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1559

• @ydkmlt84 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1622

• @JacosVerksted made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1640

• @WangLeto made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1607

• @SAY-5 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1658

• @TowyTowy made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1610

• @Ajithkumar003-dev made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1682

• @Datastream-x86 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1685

• @Gorghs made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1689

• @stephenlf made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1687

• @vaibhav8a made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1705

• @lonerockz made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1710

• @landscapejohn made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1722

• @justadityaraj made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1727

• @Some1withgithub made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1724

• @costajohnt made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1741

• @marazmarci made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1761

Full Changelog: https://github.com/sysadminsmedia/homebox/compare/v0.26.2...v0.27.0

Source GitHub

What's Changed

• fix: various new bugs by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1553

Full Changelog: https://github.com/sysadminsmedia/homebox/compare/v0.26.1...v0.26.2

Source GitHub