v3.8.0
mealie-recipes/mealiev3.8.0Dec 19, 2025by github-actions[bot]
AI Summary
A security-focused release that patches two vulnerabilities allowing arbitrary file access and updates SafeMarkdown to be more aggressive with HTML attributes.
Key Highlights
- Security fix for arbitrary system file access
- Updated SafeMarkdown to restrict allowed HTML attributes
- Optional URL inclusion when importing via HTML/JSON
New Features
- Optionally include URL when importing via HTML/JSON
Full Release Notes
# 🍴🍴🍴🍴🍴🍴 ## 🎉 Highlights ### Security Fixes #6743 fixes two security issues - A security issue which allows users to access arbitrary system files - Updates SafeMarkdown to be more aggressive with which HTML attributes we allow Both security issues required access to Mealie in order to exploit them. ## ✨ New features - feat: Optionally include URL when importing via HTML/JSON @michael-genson (#6709) ## 🐛 Bug fixes - fix: Disable submit on enter when editing timeline events @michael-genson (#6707) - fix: Improved bulk deletion by reducing refreshs @davidschinkel (#6634) - fix: Put tooltips behind app bar @michael-genson (#6711) - fix: More lenient postgres override parsing @michael-genson (#6712) - fix: localize text validators message @p0lycarpio (#6719) - fix: Security Patches @michael-genson (#6743) ## 🧰 Maintenance <details> <summary>10 changes</summary> - chore(l10n): New Crowdin updates @hay-kot (#6706) - chore: Miscellaneous cleanup @michael-genson (#6708) - chore(l10n): New Crowdin updates @hay-kot (#6710) - chore(l10n): Crowdin locale sync @github-actions (#6716) - chore(l10n): New Crowdin updates @hay-kot (#6722) - chore(l10n): New Crowdin updates @hay-kot (#6725) - chore(auto): Update pre-commit hooks @github-actions (#6724) - chore(l10n): New Crowdin updates @hay-kot (#6729) - chore(l10n): New Crowdin updates @hay-kot (#6733) - chore(l10n): New Crowdin updates @hay-kot (#6736) </details> ## ⬆️ Dependency updates <details> <summary>8 changes</summary> - fix(deps): update dependency fastapi to v0.124.4 @renovate (#6702) - fix(deps): update dependency authlib to v1.6.6 @renovate (#6700) - fix(deps): update dependency tzdata to v2025.3 @renovate (#6713) - chore(deps): update dependency mypy to v1.19.1 @renovate (#6723) - chore(deps): update dependency pre-commit to v4.5.1 @renovate (#6734) - fix(deps): update dependency fastapi to v0.125.0 @renovate (#6740) - chore(deps): update dependency ruff to v0.14.10 @renovate (#6742) - fix(deps): update dependency openai to v2.13.0 @renovate (#6726) </details> # 🍴🍴🍴🍴🍴🍴