Mirrors/mealie
1
0
Fork 0
mirror of https://github.com/mealie-recipes/mealie.git synced 2026-07-25 00:50:14 -04:00
Code Issues Packages Projects Releases Wiki Activity
5,100 Commits 10 Branches 99 Tags
fix/harden-outbound-http-ssrf
Commit Graph

5100 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Hayden
ce88ed6841 fix: harden server-initiated HTTP against SSRF and DNS rebinding 
Route all server-initiated outbound HTTP through one SSRF-protected layer:

- Resolve each host once, validate every resolved address (private,
  loopback, link-local, CGNAT 100.64/10, multicast, reserved, unspecified,
  IPv4-mapped IPv6), and reject if any is unsafe.
- Pin the connection to the validated address via curl's RESOLVE option so
  curl cannot re-resolve to a rebound IP (closes the validate-then-connect
  TOCTOU). Uses getaddrinfo so IPv6 records are checked too.
- Add a sync SafeTransport and safehttp.post, and move the webhook and
  recipe-action paths off raw requests.post so they are guarded like the
  scraper.
- Add HTTP_ALLOW_LIST / HTTP_DISALLOW_LIST settings (deny > allow > default)
  so operators can reach an internal server or block extra hosts.

Apprise notifications egress through the third-party library and are not
covered here.
 2026-07-19 21:41:30 -05:00
renovate[bot]
db4262dc67 chore(deps): update dependency mypy to v2.3.0 (#7898) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-18 14:20:18 +00:00
Hayden
9700cf1774 chore(l10n): New Crowdin updates (#7894) 2026-07-18 09:59:42 +00:00
renovate[bot]
c187ba942a chore(deps): update dependency coverage to v7.15.1 (#7892) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-17 21:20:39 +00:00
Hayden
8d8a71aea5 chore(l10n): New Crowdin updates (#7891) 2026-07-17 20:55:59 +00:00
Ivan Bondarenko
0d189da328 fix: wrap long words in timeline to prevent horizontal scroll (#7819) 2026-07-17 18:55:02 +00:00
Arsène Reymond
4eae486908 feat: ui fixes & backup link on onboarding screen (#7743) 2026-07-17 18:41:35 +00:00
ft4453080
7092497cd2 fix: prevent empty bulk add from clearing import URLs (#7820) 
Co-authored-by: zhangjian45 <zhangjian45@lenovo.com>
 2026-07-17 18:40:45 +00:00
gitolicious
bda2f3637c fix: handle IntegrityError with 409 conflict response (#7712) 2026-07-17 18:39:43 +00:00
TowyTowy
95277e0e6b fix: truncate scraped recipe slug to filesystem-safe length (#7862) 
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
 2026-07-17 18:37:19 +00:00
Brian Choromanski
31187b1a74 feat: Added sitewide statistics (#7322) 2026-07-17 18:34:08 +00:00
Henri Cook
16a0ba2e21 fix: preserve deep link when redirecting to login (#7876) 2026-07-17 18:21:19 +00:00
renovate[bot]
ae5aa5a0b8 chore(deps): update dependency types-requests to v2.33.0.20260712 (#7889) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-17 09:06:21 +00:00
renovate[bot]
3dce59326d fix(deps): update dependency tzdata to v2026.3 (#7887) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-15 11:51:48 +00:00
Hayden
2eb306d257 chore(l10n): New Crowdin updates (#7871) 2026-07-15 02:00:11 +00:00
Hayden
eba994b068 fix: re-enable automatic merges with crowding CI (#7886) 2026-07-15 01:34:10 +00:00
renovate[bot]
90228c48c3 chore(deps): update node.js to 5711a0d (#7883) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-14 22:47:48 +00:00
renovate[bot]
87e2473165 chore(deps): update dependency ruff to v0.15.21 (#7884) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-14 22:47:12 +00:00
renovate[bot]
74d2d77484 fix(deps): update dependency openai to v2.45.0 (#7882) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-14 18:46:24 +00:00
renovate[bot]
37e385e11a chore(deps): update node.js to d5adb04 (#7878) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-14 10:20:26 +00:00
renovate[bot]
f99be53158 fix(deps): update dependency uvicorn to v0.51.0 (#7875) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-13 11:19:32 +00:00
renovate[bot]
6dab679002 chore(deps): update dependency mypy to v2.2.0 (#7873) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-13 01:56:37 +00:00
renovate[bot]
a2140fb3d3 chore(deps): lock file maintenance (#7874) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-13 01:46:51 +00:00
Luke Hsiao
5abe41c852 chore(deps): remove unused aiofiles dependency (#7872) 
Signed-off-by: Luke Hsiao <luke@hsiao.dev>
 2026-07-12 20:03:09 +00:00
Hayden
16c13dc936 chore(l10n): New Crowdin updates (#7853) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2026-07-12 03:35:23 +00:00
mealie-actions[bot]
5ab867291c chore(l10n): Crowdin locale sync (#7870) 
Co-authored-by: GitHub Action <action@github.com>
 2026-07-12 03:06:40 +00:00
renovate[bot]
f9dddee818 fix(deps): update dependency uvicorn to v0.50.2 (#7868) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-11 14:01:41 +00:00
renovate[bot]
fe320ca862 fix(deps): update dependency uvicorn to v0.50.1 (#7867) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-11 10:12:09 +00:00
renovate[bot]
cd94f47950 fix(deps): update dependency yt-dlp to v2026.7.4 (#7866) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-10 02:19:37 +00:00
renovate[bot]
f70550c32e fix(deps): update dependency apprise to v1.12.0 (#7864) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-09 20:12:11 +00:00
renovate[bot]
8d550f6afa chore(deps): update dependency setuptools to v83 (#7865) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-09 20:01:14 +00:00
renovate[bot]
6c2cd499c5 fix(deps): update dependency uvicorn to v0.50.0 (#7861) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-09 07:04:18 +00:00
Michael Genson
5d1f9ff72a fix: Fix embedded tokens not persisting across sessions (#7860) 2026-07-08 15:13:42 -05:00
renovate[bot]
7bc19beb70 chore(deps): update node.js to 392e1e2 (#7858) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-07 19:05:42 +00:00
Arsène Reymond
0154bda8bb fix: shopping list UI improvements (#7215) 2026-07-07 13:51:28 +00:00
renovate[bot]
23d71ca977 fix(deps): update dependency typing-extensions to v4.16.0 (#7856) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-07 13:26:54 +00:00
renovate[bot]
fd21023dcd chore(deps): update dependency coverage to v7.15.0 (#7855) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-07 13:25:27 +00:00
Michael Genson
ac31c3f5d9 dev: Add GH CLI to devcontainer (#7857) 2026-07-07 08:37:31 -05:00
Michael Genson
48ca2238c2 dev: Skip template check on Crowdin PRs (#7854) 2026-07-07 08:25:48 -05:00
Hayden
3d615cdf20 chore(l10n): New Crowdin updates (#7839) 2026-07-07 02:14:22 +00:00
renovate[bot]
bd916b2ce7 fix(deps): update dependency fastapi to v0.139.0 (#7849) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-06 21:19:23 +00:00
Archit Goyal
05521f0e6f docs: clarify manage and organize permissions (#7823) 2026-07-06 13:15:16 +00:00
renovate[bot]
61676eb25e fix(deps): update dependency pillow to v12.3.0 (#7848) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-06 13:14:09 +00:00
renovate[bot]
5975e9a67e chore(deps): lock file maintenance (#7846) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-06 01:52:08 +00:00
mealie-actions[bot]
9c871e1059 chore(l10n): Crowdin locale sync (#7842) 
Co-authored-by: GitHub Action <action@github.com>
 2026-07-05 03:09:11 +00:00
renovate[bot]
c2d7c7a3a7 fix(deps): update dependency fastapi to v0.138.2 (#7841) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-04 14:22:59 +00:00
Hayden
0efa5315ef chore(l10n): New Crowdin updates (#7837) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
 2026-07-02 17:52:38 +00:00
Ivan Bondarenko
3ddb47ac02 fix: clear cached recipe actions on logout to prevent cross-user leak (#7815) 
Co-authored-by: Michael Genson <71845777+michael-genson@users.noreply.github.com>
Co-authored-by: Michael Genson <genson.michael@gmail.com>
 2026-07-02 12:52:15 -05:00
Hayden
87468de8b6 chore(l10n): New Crowdin updates (#7836) 2026-07-01 14:02:12 -05:00
renovate[bot]
bcb2f7642b fix(deps): update dependency fastapi to v0.138.1 (#7834) 
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-30 22:41:34 +00:00