Wallos

This release addresses multiple security vulnerabilities, including account takeover, SSRF, and path traversal, while fixing a subscription cloning bug.

This release fixes an issue related to container startup.

This release includes bug fixes for migration restrictions, database restore security, and OIDC state validation, though the container is reported as broken.

This release updates the software version.

This release includes a bug fix for the build process.

This release fixes bugs related to cross-user data isolation, API key generation, and null pointer exceptions for zero-priced subscriptions.

Version 4.9.0 introduces lifetime subscriptions, enhanced settings filters, redesigned icons, and various bug fixes including improvements to notifications and migrations.

Fixed date formatting issues and restored the missing year in subscription next payment displays.

Fixed a self-XSS vulnerability on private endpoints.

Fixed an issue where the logo was cut off on the registration page.

This release addresses security vulnerabilities including DNS rebinding, CSRF validation bypass, and SSRF on subscription additions.

Introduces OpenAI compatible hosts and scheduled AI recommendations, moves the update banner to the dashboard, and fixes AI response formatting.

This release fixes bugs related to image search saving and session expiration on Android PWAs.

This release addresses security vulnerabilities by fixing a 2FA bypass and implementing a 60-minute expiration for password reset tokens.

Fixed a bug where an extra line in languages.php caused headers already sent errors.

This release adds Romanian translations, masks AI API keys, and addresses several security vulnerabilities including XSS and SSRF.

This release fixes several security vulnerabilities, including SSRF on test notifications, unauthorized avatar deletion, and XSS on the password reset page.

This release fixes a security vulnerability in the add subscription endpoint.

This release introduces Catalan translation, serverchan notifications, extended notification windows, and improvements to iCal export compliance and stability.

Introduces enforced CSRF protection and a POST-only policy across all endpoints.

Fixed a bug where the get_subscriptions API endpoint was not returning subscriptions.

This release introduces Mattermost notifications, an OpenRouter AI endpoint, enhanced admin access for the get_subscriptions API, and input autocomplete fixes.

Added a health endpoint and container healthcheck.

This release introduces the Pushplus notification service, improves container shutdown, adds an option to delete AI recommendations, and fixes Gemini recommendation parsing.

This release includes bug fixes for API key validation, new user dashboard redirection, and password login disabling logic.

This release introduces an at-a-glance dashboard, AI recommendations via ChatGPT, Gemini, or Ollama, and enhanced OIDC authentication options.

This release introduces OAuth and OIDC support.

This release fixes bugs related to the New Taiwan Dollar code, webhook notification header decoding, and Telegram notification unicode issues.

New subscriptions now default to today's start date and a visual bug affecting date fields on iOS has been fixed.

This release adds a payment date autofill button, user profile names, Indonesian language support, new currencies, IPv6 compatibility, and a security fix for the test webhook endpoint.

Fixed an issue where prices were not listing correctly after adding UAH to the currency list.

This release adds Danish translations and includes bug fixes for TOTP backup codes, Gotify settings testing, and a vulnerability related to logo URLs.

This release fixes avatar deletion issues in subfolders, addresses a deletion vulnerability, and corrects missing translations on the calendar page.

This release fixes bugs related to clearing budget fields and prevents budget alerts from appearing when the budget is set to zero.

This release simplifies webhook notifications, introduces cancellation notifications, replaces checkboxes with mobile-style toggles, and fixes dark theme placeholder readability.

This release fixes incorrect headers on the API.

Fixed an error on the statistics page that occurred when the budget was set to zero.

Introduces a new graph comparing cost versus budget in the statistics section.

Fixed an issue where cronjob timezones were not prioritizing the TZ environment variable.

Added over budget warnings to the calendar and fixed timezone issues for cronjobs.

Fixed date localization issues for non-English browsers.

This release improves the subscription list by shortening dates and using user-defined languages, while fixing mobile menu translations and subscription name display limits.

This release fixes an issue with the version number.

This release introduces improvements to mobile views, notifications, and currency formatting, along with bug fixes for cronjobs, email SSL, and ntfy headers.

Fixed a bug where notifications were incorrectly sent multiple days after a subscription was due.

Adds update notifications and release notes to the about page and improves privacy by removing referrers for external URLs.

Fixed minor layout inconsistencies on the dashboard.

This release introduces filtering and sorting by renew type, adds Ukrainian translation, improves calendar exports, and fixes several bug issues.

Fixes a bug in the calculation of the monthly cost progress graph.

This release ensures sorting by category or payment method respects the settings page order and fixes a tmp folder access issue for www-data.

This release includes various bug fixes related to currency settings, subscription progress, translations, and image processing library fallbacks.

This release includes translation improvements for Czech, Japanese, and Traditional Chinese, as well as the ability to set PGID and PUID for the container.

Added Czech translations.

This release fixes a bug related to setting the date of the last exchange rates update.

This release adds the ability to receive notifications on due dates and fixes bugs related to iCal feeds and email notification tests.

Fixed a bug where the edit and delete subscription menus were inaccessible.

Introduces a version API endpoint, a subscription cycle progress display option, and fixes a currency symbol bug in the monthly budget.

Fixed an issue related to the version number.

Fixed a bug by removing a debug echo on the stats page.

This release introduces a monthly cost trend graph, enables unauthenticated email notifications, and fixes bugs related to disabled subscriptions and avatar selection XSS vulnerabilities.

This release adds payment cycle to exports, implements automatic database migrations after imports or restores, tracks weekly total yearly costs, and fixes double encoding in statistics labels.

Added Dutch translation support.

Fixed an SVG error on the calendar page.

This release introduces support for icalendar subscriptions.

This release fixes a security vulnerability found in the restore database endpoints.

Fixed an issue where the logo search was positioned below other elements.

This release fixes a bug on the subscriptions dashboard introduced in version 2.38.0.

Introduces manual/automatic renewal options, TOTP code leeway, subscription start dates, and fixes a search layout issue.

This release fixes a version mismatch bug.

Adds monthly statistics to the calendar page and fixes an issue where notifications were sent on the wrong day.

Fixed an issue to ensure the swipe hint is only displayed on mobile screens.

This release fixes a bug related to the version number.

Added a hint for the mobile swipe action.

Introduces new menu icons and swipe actions for subscriptions on the experimental mobile navigation.

This release adds a GitHub link to the version update banner, improves filter visibility, and ensures category and payment method filters follow the defined settings order.

This release fixes a layout issue on the settings page and improves localization.

Introduces replacements for disabled subscriptions to improve the accuracy of savings calculations.

Added settings to allow ignoring certificates for specific notification methods.

This release fixes a missing webhook variable and improves email test error reporting.

Added support for handling webhook payloads as strings when they are not JSON objects.

This release includes a bug fix to ensure the correct path is verified before creating the logos folder.

Added Vietnamese translation support.

Fixed an XSS vulnerability on the dashboard.

This release fixes a MySQL injection vulnerability and resolves a service worker caching issue on the new profile page.

Added URL and notes variables to the notifications webhook and fixed a bug when looping multiple subscriptions.

This release introduces several new API endpoints for retrieving admin settings, categories, currencies, household information, notifications, payment methods, general settings, subscriptions, and user data.

This release fixes issues with missing fonts and folders on baremetal installations.

This release includes a version bump.

This release fixes a bug by adding missing assets to the service worker.

Introduces a new API endpoint for monthly cost calculation, adds API keys to user profiles, redesigns mobile navigation, and splits settings into separate settings and profile pages.

Added mobile menu navigation to experimental settings and implemented browser locale for dashboard date formatting.

This release introduces support for two-factor authentication (2FA).

Fixed a small layout issue on the settings page.

This release adds a search field cleanup button and fixes issues related to theme/sort cookies and RTL layout dropdown positioning.

Fixed a bug affecting the sort order after editing a subscription when the cookie is missing.

Fixed a warning appearing on the top of the dashboard page.

This release introduces support for multiple email recipients, dashboard improvements including original price visibility and multiple filters, and several bug fixes for CSV exports.

Fixed a layout issue where inline items in the subscription form were out of place.

Administrators can now manually trigger cronjobs, with added restrictions on who can run them and reduced log file sizes.

This release fixes issues with avatar uploads in French and reduces deprecation warnings during image uploads.