🍴🍴🍴🍴🍴🍴

🎉 Highlights

Security Fixes

#6743 fixes two security issues

• A security issue which allows users to access arbitrary system files
• Updates SafeMarkdown to be more aggressive with which HTML attributes we allow

Both security issues required access to Mealie in order to exploit them.

✨ New features

• feat: Optionally include URL when importing via HTML/JSON @michael-genson (#6709)

🐛 Bug fixes

• fix: Disable submit on enter when editing timeline events @michael-genson (#6707)
• fix: Improved bulk deletion by reducing refreshs @davidschinkel (#6634)
• fix: Put tooltips behind app bar @michael-genson (#6711)
• fix: More lenient postgres override parsing @michael-genson (#6712)
• fix: localize text validators message @p0lycarpio (#6719)
• fix: Security Patches @michael-genson (#6743)

🧰 Maintenance

10 changes

• chore(l10n): New Crowdin updates @hay-kot (#6706)
• chore: Miscellaneous cleanup @michael-genson (#6708)
• chore(l10n): New Crowdin updates @hay-kot (#6710)
• chore(l10n): Crowdin locale sync @github-actions (#6716)
• chore(l10n): New Crowdin updates @hay-kot (#6722)
• chore(l10n): New Crowdin updates @hay-kot (#6725)
• chore(auto): Update pre-commit hooks @github-actions (#6724)
• chore(l10n): New Crowdin updates @hay-kot (#6729)
• chore(l10n): New Crowdin updates @hay-kot (#6733)
• chore(l10n): New Crowdin updates @hay-kot (#6736)

⬆️ Dependency updates

8 changes

• fix(deps): update dependency fastapi to v0.124.4 @renovate (#6702)
• fix(deps): update dependency authlib to v1.6.6 @renovate (#6700)
• fix(deps): update dependency tzdata to v2025.3 @renovate (#6713)
• chore(deps): update dependency mypy to v1.19.1 @renovate (#6723)
• chore(deps): update dependency pre-commit to v4.5.1 @renovate (#6734)
• fix(deps): update dependency fastapi to v0.125.0 @renovate (#6740)
• chore(deps): update dependency ruff to v0.14.10 @renovate (#6742)
• fix(deps): update dependency openai to v2.13.0 @renovate (#6726)

🍴🍴🍴🍴🍴🍴