Baby Buddy

🚨 Security Fixes

• Fixed a vulnerability reported by @JulienPerrinGithub allowing an attacker can send a REMOTE-USER header to impersonate any user on all API endpoints when REVERSE_PROXY_AUTH=True.
  • Impact: Instances running Baby Buddy version 2.3.0 to 2.10.1 with REVERSE_PROXY_AUTH=True. Originally introduced in 2c10fc03a56d9a7cd5e24ea4124646a835c444ce.
  • Tracking: A CVE identifier has been requested through GitHub and this section will be updated once assigned. You can monitor the status via the GitHub Security Advisory.

What’s Changed

• fix(core): populate the read-only group on first migrate by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1141
• fix: apply model permissions to reports, the timeline and dashboard cards by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1143
• fix: correct the permission codenames used by head circumference and tags by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1144
• fix: stop the password reset test from logging out the shared client by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1145
• feat(core): add diaper change colors (gray, orange, red, white) + migration by @SoTHISIsFitness in https://github.com/babybuddy/babybuddy/pull/1083
• Add Recent Notes dashboard card (#1038) by @SoTHISIsFitness in https://github.com/babybuddy/babybuddy/pull/1114
• feat(l10n): improve Dutch translations by @JurianLock in https://github.com/babybuddy/babybuddy/pull/1137
• feat(l10n): improve Russian translations by @HKSsss in https://github.com/babybuddy/babybuddy/pull/1142
• Update to plotly.py to v6 and plotly.js by @Cadair in https://github.com/babybuddy/babybuddy/pull/1074
• fix: quick-start timer child association not working with more than one child by @cdubz with @Copilot in https://github.com/babybuddy/babybuddy/pull/1139
• feat: add a scoped caregiver user role by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1134
• fix: empty-state colspan on Notes list (multiple children) by @TianHengZhuang in https://github.com/babybuddy/babybuddy/pull/1147
• fix: empty-state colspan on list pages (multiple children) by @TianHengZhuang in https://github.com/babybuddy/babybuddy/pull/1148
• fix(reports): plot solid and wet diaper intervals on the right dates by @NotAFlightRisk in https://github.com/babybuddy/babybuddy/pull/1150
• chore(deps): bump pillow from 11.3.0 to 12.3.0 in the pip group across 1 directory by @dependabot[bot] in https://github.com/babybuddy/babybuddy/pull/1071
• feat: add a notes field to Tummy Time by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1146
• feat: let users complete their own timers by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1156
• feat: add an optional access expiry to user accounts by @Daltonganger in https://github.com/babybuddy/babybuddy/pull/1157
• feat(core): show the timer name on activity add forms by @superphosphate in https://github.com/babybuddy/babybuddy/pull/1135

New Contributors

• @SoTHISIsFitness made their first contribution in https://github.com/babybuddy/babybuddy/pull/1083
• @JurianLock made their first contribution in https://github.com/babybuddy/babybuddy/pull/1137
• @HKSsss made their first contribution in https://github.com/babybuddy/babybuddy/pull/1142
• @Cadair made their first contribution in https://github.com/babybuddy/babybuddy/pull/1074
• @TianHengZhuang made their first contribution in https://github.com/babybuddy/babybuddy/pull/1147
• @superphosphate made their first contribution in https://github.com/babybuddy/babybuddy/pull/1135

Full Changelog: https://github.com/babybuddy/babybuddy/compare/v2.10.1…v2.11.0