OliveTin Files

Changelog

Security

• [904616] security: GHSA-jm28-2wcr-qf3h (LOW) enforce logs ACL on sync execution endpoints
• [4ef86a] security: GHSA-vc6p-m6vx-6cwq (HIGH) harden shellAfterCompleted execution
• [0e45f3] security: GHSA-xc5w-4v5w-7x65 (HIGH) harden shell argument type safety
• [422044] security: GHSA-xpxj-f2fm-rqch (HIGH) bound OAuth2 state map growth

Features

• [e24ae6] feat: Checklist support (#922)
• [a856d4] feat: Checklist support (#922) (#1066)
• [0c4d25] feat: add entity UI with list filtering and prefilled action arguments
• [6ce936] feat: add entity UI with list filtering and prefilled action arguments (#1069)
• [afd9f9] feat: expand entity list and detail APIs with properties and related actions
• [506ad4] feat: expand entity list and detail APIs with properties and related … (#1068)

Bug fixes

• [42f257] fix(config): reject ambiguous checklist comma format and propagate encode errors ParseChecklistValue now accepts JSON arrays or single bare values and rejects legacy comma-separated input. Empty JSON segments are validated consistently, and FormatChecklistValue returns marshal errors instead of an empty string
• [8eda67] fix(docs): correct shellAfterCompleted quoting for output and exitCode The after-completion example put {{ output }} and {{ exitCode }} inside single-quoted shell arguments, so and never expanded after substituteShellAfterCompletedEnvRefs runs. Update the apprise sample to use printf-based quoting that allows env substitution, document the single-quote pitfall, and extend TestShellAfterCompletedUsesOutputEnvSafely to assert stdout is substituted as well as injection being blocked.
• [139618] fix(executor): always anchor custom regex patterns and harden shellAfterCompleted Wrap regex: patterns in a non-capturing group before applying ^...$ so alternation cannot bypass full-string matching. Return template parse errors from buildShellAfterCommand, and guard nil binding/action before building shellAfterCompleted commands.
• [b18518] fix: add support for entities in checklists
• [58dc80] fix: coderabbit suggestions on the justification
• [09212d] fix: default choices causing the filter values to be hidden (#1065)
• [9dc51d] fix: harden checklist JSON wire format, entity pagination, and review findings across API and UI

Others

• [ec114e] Merge commit from fork
• [e42178] Merge commit from fork
• [995ff7] Merge commit from fork
• [d0075a] Next (#1070)

Container images (from GitHub)

• docker pull ghcr.io/olivetin/olivetin:3000.17.0

Container images (on Docker Hub)

• docker pull docker.io/jamesread/olivetin:3000.17.0

Upgrade warnings, or breaking changes

• No such issues between the last release and this version.

Useful links

• Which download do I need?
• Ask for help and chat with others users in the Discord community

Thanks for your interest in OliveTin!