HomeBox

[!IMPORTANT] This release includes 3 security vulnerability patches. These include issues with CVE scores ranging from 4.6 to 7.4 scores.

• 7.4 CVE-2026-27981
• 5.0 CVE-2026-27600
• 4.6 CVE-2026-26272

Thank you to @G3XAR and @djnnvx for their responsible disclosures of these issues.

What’s Changed

• Add Documentation Detailing Websocket Requirement for Reverse Proxies by @KevinFumbles in https://github.com/sysadminsmedia/homebox/pull/1297
• Add a tenant get param when generating labels on the item page. by @cdjk in https://github.com/sysadminsmedia/homebox/pull/1303
• Migrate to Startlight Documentation by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1304
• docs: update links in README.md by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1314
• feat: add new field types to template_fields schema by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1315
• fix: tenant miss in export download URLs by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1313
• fix: hardcoded frontend strings by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1311
• chore(deps): bump nanotar from 0.2.0 to 0.2.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1317
• Update incorrect env variables in quick-start/configure/database by @KillerOfPie in https://github.com/sysadminsmedia/homebox/pull/1320
• fix: improve mobile image popup sizing by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1321
• feat: add skip-first-labels and location-row toggle to label generator by @max2697 in https://github.com/sysadminsmedia/homebox/pull/1306
• chore(deps): bump markdown-it from 14.1.0 to 14.1.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1324
• implement show/hide items for locations tree by @tonyaellie in https://github.com/sysadminsmedia/homebox/pull/1328
• chore(deps): bump ajv from 8.17.1 to 8.18.0 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1330
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1331
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1334
• feat: add configurable security options for generic notifiers by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1335
• Update currencies.json by @github-actions[bot] in https://github.com/sysadminsmedia/homebox/pull/1329
• fix(currencies): update CLP decimals to 0 to comply with ISO 4217 by @sRamosDev in https://github.com/sysadminsmedia/homebox/pull/1342
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1347

New Contributors

• @KevinFumbles made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1297
• @cdjk made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1303
• @IceeAn made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1314
• @KillerOfPie made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1320
• @max2697 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1306
• @sRamosDev made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1342

Full Changelog: https://github.com/sysadminsmedia/homebox/compare/v0.23.1…v0.24.0