Starstruk Logo MarkStarstruk

v3.18.0

harry0703/MoneyPrinterTurbov3.18.0May 20, 2026by github-actions[bot]

AI Summary

This release focuses on enhancing the shopping list user experience and fixing critical security vulnerabilities. It includes UI improvements for mobile users, bug fixes for authentication flows and data normalization, and updates to various Python and Node.js dependencies.

Key Highlights

  • Improved shopping list UI and memory for screen lock preference.
  • Fixed critical security issues regarding scriptable asset extensions and recipe deletion ownership.
  • Resolved infinite API loops and improved OpenAI recipe parsing accuracy.

New Features

  • Improve new shopping list UI
  • Remember screen lock preference

Full Release Notes

# 🍴🍴🍴🍴🍴🍴

## ✨ New features

- feat: Improve new shopping list UI @michael-genson (#7600)
- feat: Remember screen lock preference @michael-genson (#7609)

## 🐛 Bug fixes

- fix: Query Filter Builder "Advanced" bug @michael-genson (#7599)
- fix: make PWA share target functional on Android Chrome @zdenek-stursa (#7468)
- fix: redirect to login and validate input on password reset flow @zdenek-stursa (#7521)
- fix: Update backend normalization to match search normalization logic @michael-genson (#7603)
- fix: Update OpenAI recipe parse prompt to return the same number of ingredients as given @michael-genson (#7604)
- fix: redirect to new slug URL after recipe rename @zdenek-stursa (#7522)
- fix: prevent double-scaling of sub-recipe ingredients in shopping list @zdenek-stursa (#7537)
- fix: Infinite API request loop on empty stores @michael-genson (#7613)
- fix: downgrade OIDC missing-claims log from ERROR to DEBUG (#6801) @hay-kot (#7620)
- fix: use locale for Recipe Created timeline event (#4497) @hay-kot (#7623)
- fix: block scriptable asset extensions and force Content-Disposition: attachment (GHSA-gfwc-pjx4-mg9p) @hay-kot (#7626)
- fix: enforce ownership check on recipe deletion (GHSA-x5v9-9jvh-7c7q) @hay-kot (#7625)

## 🧰 Maintenance

<details>
<summary>8 changes</summary>

- chore(l10n): New Crowdin updates @hay-kot (#7571)
- chore(l10n): Crowdin locale sync @[mealie-actions[bot]](https://github.com/apps/mealie-actions) (#7595)
- chore(l10n): New Crowdin updates @hay-kot (#7589)
- chore(l10n): New Crowdin updates @hay-kot (#7605)
- chore(l10n): New Crowdin updates @hay-kot (#7608)
- chore: update SECURITY.md for GitHub private vulnerability reporting @hay-kot (#7612)
- chore(l10n): Crowdin locale sync @[mealie-actions[bot]](https://github.com/apps/mealie-actions) (#7637)
- chore(l10n): New Crowdin updates @hay-kot (#7617)
</details>

## ⬆️ Dependency updates

<details>
<summary>7 changes</summary>

- chore(deps): update dependency mypy to v2 @[renovate[bot]](https://github.com/apps/renovate) (#7584)
- chore(deps): update dependency types-requests to v2.33.0.20260503 @[renovate[bot]](https://github.com/apps/renovate) (#7587)
- chore(deps): update node.js to 34f0eb9 @[renovate[bot]](https://github.com/apps/renovate) (#7590)
- chore(deps): update node.js to 050bf2b @[renovate[bot]](https://github.com/apps/renovate) (#7592)
- fix(deps): update dependency authlib to v1.7.1 @[renovate[bot]](https://github.com/apps/renovate) (#7593)
- fix(deps): update dependency openai to v2.34.0 @[renovate[bot]](https://github.com/apps/renovate) (#7594)
- fix(deps): update dependency authlib to v1.7.2 @[renovate[bot]](https://github.com/apps/renovate) (#7606)
</details>

# 🍴🍴🍴🍴🍴🍴