🍴🍴🍴🍴🍴🍴

🎉 Highlights

Security Fixes

#6743 fixes two security issues

• A security issue which allows users to access arbitrary system files
• Updates SafeMarkdown to be more aggressive with which HTML attributes we allow

Both security issues required access to Mealie in order to exploit them.

✨ New features

• feat: Optionally include URL when importing via HTML/JSON @michael-genson (#6709)

🐛 Bug fixes

• fix: Disable submit on enter when editing timeline events @michael-genson (#6707)
• fix: Improved bulk deletion by reducing refreshs @davidschinkel (#6634)
• fix: Put tooltips behind app bar @michael-genson (#6711)
• fix: More lenient postgres override parsing @michael-genson (#6712)
• fix: localize text validators message @p0lycarpio (#6719)
• fix: Security Patches @michael-genson (#6743)

🧰 Maintenance

⬆️ Dependency updates

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

The newest version of Mealie includes several new features and quality of life improvements. We've also got five first-time contributors in this release!

ℹ️ IMPORTANT NOTICE

Included in this release we updated our image processing algorithm to improve image quality and compression (thanks @1-tempest!). This improves all new images added to Mealie moving forward. If you'd like to reprocess your existing images, we've included a user script:

docker exec -it mealie bash
python /opt/mealie/lib64/python3.12/site-packages/mealie/scripts/reprocess_images.py

More information in the docs, including some configuration options to speed things up if you have stronger hardware. This process could take several minutes depending on how many recipes you have (and your hardware).

🎉 Highlights

• Updated image processing algorithm improving image quality and compression
• You can now choose a snack, drink, and dessert in your meal planner

✨ New features

• feat: Put calendar directly in the date picker dialogs @noxhirsch (#6110)
• feat: Add snack, drink, and dessert @cashpw (#6149)
• feat: frontend autocomplete is diacritics/ligatures insensitive @Noneangel (#6169)
• feat: Improve Image Minification Logic and Efficiency @1-tempest (#5883)
• feat: Reprocess image user script @michael-genson (#6704)
• feat: Improve startup workflow UI @miah120 (#6342)
• feat: autofill default credentials on first login @hay-kot (#6666)
• feat: Add user QueryFilter and improve UI on mobile @p0lycarpio (#6235)
• feat: Suggest HTML importer on URL importer failure @michael-genson (#6685)

🐛 Bug fixes

• fix: change log rotation size from 10kb to 10mb @hay-kot (#6648)
• fix: clear cached store data on logout to prevent user data leakage @hay-kot (#6665)
• fix: improve password manager autofill compatibility on login page @henricook (#6662)
• fix: Reprocess script UUID handling for postgres @michael-genson (#6705)

🧰 Maintenance

📚 Documentation

• docs: add theming examples to backend configuration guide @n-winspear (#6443)

🔨 Internal development

• dev: Add copilot-instructions.md @michael-genson (#6659)

⬆️ Dependency updates

🙏 New Contributors

• @cashpw made their first contribution in #6149
• @Noneangel made their first contribution in #6169
• @1-tempest made their first contribution in #5883
• @n-winspear made their first contribution in #6443
• @henricook made their first contribution in #6662

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

Minor bug fixes to remove some unnecessary backend polling. This release also tests a new workflow which will hopefully update the version in time for the release build.

🐛 Bug fixes

• fix: Remove Auth Refresh @michael-genson (#6646)
• fix: Bump version before building release @michael-genson (#6647)

🧰 Maintenance

• chore(l10n): New Crowdin updates @hay-kot (#6643)

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

This version of Mealie comes with a bunch of fixes and stability improvements. Some users have been experiencing issues with session times (i.e. getting logged out too quickly), particularly on Safari/iOS, and those should be resolved now.

✨ New features

• feat: Remove backend cookie and use frontend for auth @michael-genson (#6601)

🐛 Bug fixes

• fix: Favorites page fails to load when sorted by random @ithabi (#6517)
• fix: Can't edit extra long category name depending on resolution @ithabi (#6536)
• fix: Set maxAge on frontend auth cookie @michael-genson (#6576)
• fix: Tool management bug #6447 - correct mismatch between event fired vs event handler @simon-lam (#6590)
• fix: PWA follows OS screen rotation/lock settings @cordlord (#6573)
• fix: recipe recursion false positive @parumpum (#6591)
• fix: Asset type selector dropdown #6413; asset entry layout; asset download content disposition @simon-lam (#6595)
• fix: Enabled newlines in timeline comment @davidschinkel (#6620)

🧰 Maintenance

📚 Documentation

• docs(auto): Update image tag, for release v3.5.0 @github-actions (#6542)

🔨 Internal development

• dev: Allow dev server to be accessed on local network @miah120 (#6581)

⬆️ Dependency updates

🙏 New Contributors

• @ithabi made their first contribution in #6536
• @simon-lam made their first contribution in #6590
• @cordlord made their first contribution in #6573
• @davidschinkel made their first contribution in #6620

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

Welcome to the latest release of Mealie! This release contains a minor breaking change; the flow for downloading a recipe .zip has been simplified and no longer requires a zip token. If you are leveraging the .zip API, you'll want to update your scripts.

🎉 Highlights

• You can now add recipes as an ingredient for other recipes. Got a great teriyaki sauce recipe to go with your hibachi fried rice? You can add it as an ingredient now.

🚨 Breaking changes

• fix: Refactor Recipe Zip File Flow @michael-genson (#6170)

✨ New features

• feat: Add DELETE /{slug}/image @chollinger93 (#6259)
• feat: Add recipe as ingredient @parumpum (#4800)

🐛 Bug fixes

• fix: Locale dates format @p0lycarpio (#6211)
• fix: Update the random button flow @aliyyanWijaya (#6248)
• fix: Include contents of purpose field when parsing ingredients @strangetom (#6494)
• fix: Refactor Recipe Zip File Flow @michael-genson (#6170)
• fix: Stabilize shopping list queuing @michael-genson (#6498)
• fix: Brute parser fails if unit or food is empty @michael-genson (#6500)
• fix: Make Ingredients and Instructions independently scrollable in cook mode @AurelienPautet (#6358)
• fix: Improve recipe ingredient selection @p0lycarpio (#6518)
• fix: prevent URL encoding in postgres placeholder display @LaurianeH-05 (#6438)

🧰 Maintenance

📚 Documentation

• docs(auto): Update image tag, for release v3.4.0 @github-actions (#6471)

🔨 Internal development

• dev: Migrate to uv @michael-genson (#6470)

⬆️ Dependency updates

🙏 New Contributors

• @aliyyanWijaya made their first contribution in #6248
• @strangetom made their first contribution in #6494
• @chollinger93 made their first contribution in #6259
• @LaurianeH-05 made their first contribution in #6438

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

This release contains mostly bug fixes, though we fit in a few features for you too!

🎉 Highlights

You can now set the default activity per-device (thanks @miah120!). Upon logging-in (or opening the PWA). You can choose to navigate to:

• Your recipes (like before)
• Your shopping lists
• The meal planner

This can be configured in your profile. By default, your default activity will be the recipes page (just like how it used to be before this update).

✨ New features

• feat: Add new migration for DVO Cook'n @keyofdminer (#5085)
• feat: Support User-Level Default Activities @miah120 (#5125)
• feat: Improve shopping list label sections @miah120 (#6345)

🐛 Bug fixes

• fix: Change 'Units' to 'Unit' in shopping list item editor @ritoban23 (#6372)
• fix: Check x-forwarded-proto header when determining auth cookie samesite attribute @michael-genson (#6383)
• fix: Upgrade Pydantic and remove manual Postgres URL parsing @michael-genson (#6385)
• fix: Use crossorigin: "use-credentials" with PWA manifest @michael-genson (#6430)
• fix: dash slug names @fernandom06 (#5709)
• fix: Make docs:gen consistent regardless of timestamp (again) @michael-genson (#6432)
• fix: Changed sorting icons @RichardVanLeeuwen (#6354)
• fix: Heart and Ranking Stars overlap each other @AurelienPautet (#6359)
• fix: Food seed only works for American English (#6204) @flomero (#6436)

🧰 Maintenance

📚 Documentation

• docs(auto): Update image tag, for release v3.3.2 @github-actions (#6346)

⬆️ Dependency updates

🙏 New Contributors

• @keyofdminer made their first contribution in #5085
• @ritoban23 made their first contribution in #6372
• @fernandom06 made their first contribution in #5709
• @AurelienPautet made their first contribution in #6359
• @flomero made their first contribution in #6436

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

This release contains bug-fixes related to authentication and fixes a breaking change related to long passwords (>72 bytes). No action is needed for users with long passwords, though it may be worth checking out the PR for more information.

✨ New features

• feat: Added url to current version release @Choromanski (#6308)

🐛 Bug fixes

• fix: Re-write Nuxt auth backend and get rid of sidebase auth @michael-genson (#6322)
• fix: Remove unused next-auth dependency @p0lycarpio (#6328)
• fix: No Redirect On Valid Token @michael-genson (#6327)
• fix: Translate log-out string @michael-genson (#6332)
• fix: Truncate Long Passwords (>72 bytes) @michael-genson (#6335)

🧰 Maintenance

📚 Documentation

• docs(auto): Update image tag, for release v3.3.1 @github-actions (#6300)

⬆️ Dependency updates

🍴🍴🍴🍴🍴🍴

This release contains few minor bug fixes that can impact users trying the ingredient parser for the first time.

🐛 Bug fixes

• fix: Default to "0" qty when creating ingredients everywhere @michael-genson (#6285)
• fix: Restore recipe meta for non-logged-in users @michael-genson (#6286)
• fix: Updated pwa orientation to any @Choromanski (#6298)

🧰 Maintenance

• chore(auto): Update pre-commit hooks @github-actions (#6282)

📚 Documentation

• docs(auto): Update image tag, for release v3.3.0 @github-actions (#6267)
• docs: Update TOKEN_TIME docs to include max @michael-genson (#6279)

⬆️ Dependency updates

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

Welcome to the latest Mealie release!
This update brings a major update to how you parse recipes, home to some of the most heavily-requested features. This update also brings a truckload of fixes to round out some performance issues and fix some fairly-regular annoyances.

❗❗❗Minor breaking change with TOKEN_TIME

This PR introduces a maximum for the TOKEN_TIME variable. If TOKEN_TIME is greater than 87600 (10 years, in hours) the application will fail to load. This was introduced as setting too high of a value can cause an overflow error when generating auth tokens, which can be more difficult to debug since the error wouldn't necessarily appear at startup.

🎉 Highlights

📋 Semi-automated Ingredient Parser

Mealie v3.3.0 introduces an entirely new workflow to parsing recipes. The new parsing workflow includes many heavily-requested features such as:

• A more focused, guided ingredient parser which lets you parse one ingredient at a time
• Initiate parsing immediately after creating a new recipe (with an option to turn this off, though we encourage you to try it!)
• Automatically parse ingredients which can be matched with a reasonably high level of accuracy
• Much much more!

Auth Timeout and iframe Support

Users have been experiencing issues with authentication, including being logged-out seemingly randomly between sessions (even if TOKEN_TIME is set, which is a requirement for longer session times). This update should resolve flaky session times ignoring the TOKEN_TIME.

Additionally, support for hosting Mealie in an iframe (such as via Home Assistant) should be fixed. Note that iframe support only works if being served over HTTPS, which is a browser requirement. For more information, see the samesite Cookie header spec.

✨ New features

• feat: Manually calculate OpenAI Parsing Confidence @michael-genson (#6141)
• feat: Upgraded Ingredient Parsing Workflow @michael-genson (#6151)
• feat: Ingredient Parser Enhancements @michael-genson (#6228)
• feat: Simplify Default Layout Logic and Add Household.name To Cookbooks API @michael-genson (#6243)

🐛 Bug fixes

• fix: Print Button Does Nothing @michael-genson (#6178)
• fix: ingredient linker and instructions titles @p0lycarpio (#6146)
• fix: multiple RecipeRating backend calls @p0lycarpio (#6194)
• fix: Actually Fix Token Time @michael-genson (#6215)
• fix: Remove explicit timeout from OpenAI image API Call @michael-genson (#6227)
• fix: Workflow Issues with Deleting Ingredient In Parser @michael-genson (#6230)
• fix: Enabled Using Mealie In iframe If Served Over HTTPS @michael-genson (#6128)
• fix: Remove constraint on unhashed password being 'LDAP' @cmintey (#6236)
• fix: Remove Double Cookie Refresh @michael-genson (#6242)
• fix: Misc Issues with Ingredient Parser @michael-genson (#6250)
• fix: Make Ingredient Parser Dialog Use Full Space @michael-genson (#6253)
• fix: Check for non-hid properties when injetcing SPA meta @michael-genson (#6256)
• fix: Stores Not Populating Sometimes @michael-genson (#6266)

🧰 Maintenance

📚 Documentation

• docs(auto): Update image tag, for release v3.2.1 @github-actions (#6172)
• docs: Add Info Regarding Theme Settings Config @michael-genson (#6198)
• docs: Fix formatting in some community guides @lehnerpat (#6223)
• docs: Update navigation instructions for (admin) settings pages @lehnerpat (#6220)
• docs: Improve formatting in 'Automating Backups with n8n' community guide @lehnerpat (#6221)

⬆️ Dependency updates

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

A quick bug fix release to fix state issues on the recipe explorer overview page.

🐛 Bug fixes

• fix: Explorer Page State Not Working On Hitting Back @michael-genson (#6171)

📚 Documentation

• docs(auto): Update image tag, for release v3.2.0 @github-actions (#6164)

⬆️ Dependency updates

• fix(deps): update dependency ingredient-parser-nlp to v2.3.0 @renovate (#6163)

🍴🍴🍴🍴🍴🍴