Solidtime

[!IMPORTANT] This release includes a security fix for Host header handling.

The issue only affects setups where requests can reach solidtime with arbitrary Host headers, for example when a reverse proxy forwards unvalidated Host headers or when no reverse proxy is used.

solidtime Cloud and our recommended Traefik setup are not affected.

Affected self-hosted installations should upgrade as soon as possible.

[!CAUTION] Make sure your APP_URL is set correctly before updating, otherwise the solidtime instance will not work properly

What’s Changed

• Add trusted host validation middleware to prevent Host header poisoning. Thanks to @tonghuaroot for the security report
• Fixed invoice tax rate by @korridor in https://github.com/solidtime-io/solidtime/pull/1184

For self-hosting

This release adds host validation based on APP_URL.

By default, solidtime now only accepts requests for the hostname configured in APP_URL and its subdomains. Requests for other hostnames are rejected with HTTP 400.

If your instance is intentionally reachable through additional hostnames, configure the new TRUSTED_HOSTS environment variable:

APP_URL=https://solidtime.example.com
TRUSTED_HOSTS=solidtime.internal,solidtime.tailnet-name.ts.net

Wildcard subdomains are supported:

TRUSTED_HOSTS=*.example.com

No database migrations are included in this release.

Full Changelog: https://github.com/solidtime-io/solidtime/compare/v0.18.0…v0.19.0