Wishlist

Important security updates

This release addresses various vulnerabilities. Please update to the latest version as soon as you can.

One of the main changes is that scraping from private address (such as your local network) are now forbidden by default. You can override this by setting the IP addresses you wish to scrape from in ALLOWED_IPS. Generally, this is not necessary for nearly anyone running Wishlist.

New features

• The list card got a bit of a refresh
• New error toast will surface when adding an item and the details could not be scraped
• List owners can now edit and remove claims on their items if the “show claims for list owner” is enabled for the group

What’s Changed

• pin pnpm by @cmintey in https://github.com/cmintey/wishlist/pull/761
• docs: Update development documenation by @skeletonkey in https://github.com/cmintey/wishlist/pull/743
• feat: list layout — availability/claimed counts, progress bar, hide owner by @skeletonkey in https://github.com/cmintey/wishlist/pull/752
• Translations update from Hosted Weblate by @weblate in https://github.com/cmintey/wishlist/pull/758
• Update packages by @renovate[bot] in https://github.com/cmintey/wishlist/pull/760
• Update actions/setup-node action to v7 by @renovate[bot] in https://github.com/cmintey/wishlist/pull/762
• feat: claim management by @cmintey in https://github.com/cmintey/wishlist/pull/709
• Surface an error when product info can’t be scraped by @fmurodov in https://github.com/cmintey/wishlist/pull/770
• Update dependency fuzzysort to v4 by @renovate[bot] in https://github.com/cmintey/wishlist/pull/769
• Update node by @renovate[bot] in https://github.com/cmintey/wishlist/pull/759
• Update packages by @renovate[bot] in https://github.com/cmintey/wishlist/pull/765
• Translations update from Hosted Weblate by @weblate in https://github.com/cmintey/wishlist/pull/767
• Translations update from Hosted Weblate by @weblate in https://github.com/cmintey/wishlist/pull/772
• Translations update from Hosted Weblate by @weblate in https://github.com/cmintey/wishlist/pull/774
• Update packages by @renovate[bot] in https://github.com/cmintey/wishlist/pull/775
• Docs: Replace helm chart with an up-to-date fork in README by @fox1e-dev in https://github.com/cmintey/wishlist/pull/773
• fix: prevent path traversal by @cmintey in https://github.com/cmintey/wishlist/pull/779
• Update pnpm to v12 by @renovate[bot] in https://github.com/cmintey/wishlist/pull/776
• fix: add ssrf protection to external URLs by @cmintey in https://github.com/cmintey/wishlist/pull/783
• Update packages by @renovate[bot] in https://github.com/cmintey/wishlist/pull/780
• Update dependency @types/node to ^24.13.5 by @renovate[bot] in https://github.com/cmintey/wishlist/pull/781
• add additional checks on various APIs by @cmintey in https://github.com/cmintey/wishlist/pull/778
• Translations update from Hosted Weblate by @weblate in https://github.com/cmintey/wishlist/pull/784
• feat: rework list card slightly by @cmintey in https://github.com/cmintey/wishlist/pull/785
• fix(tests): fix list card tests by @cmintey in https://github.com/cmintey/wishlist/pull/786

New Contributors

• @skeletonkey made their first contribution in https://github.com/cmintey/wishlist/pull/743
• @fmurodov made their first contribution in https://github.com/cmintey/wishlist/pull/770
• @fox1e-dev made their first contribution in https://github.com/cmintey/wishlist/pull/773

Full Changelog: https://github.com/cmintey/wishlist/compare/v0.66.0…v0.67.0