Download Latest Version
v0.19.1 source code.zip (4.7 MB)
Get an email when there's a new version of solidtime
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| 0.19.0 source code.tar.gz | 2026-08-06 | 4.0 MB | |
| 0.19.0 source code.zip | 2026-08-06 | 4.7 MB | |
| README.md | 2026-08-06 | 1.7 kB | |
| Totals: 3 Items | 8.7 MB | 0 | |
[!IMPORTANT] This release includes a security fix for Host header handling.
The issue only affects setups where requests can reach solidtime with arbitrary
Hostheaders, for example when a reverse proxy forwards unvalidated Host headers or when no reverse proxy is used.solidtime Cloud and our recommended Traefik setup are not affected.
Affected self-hosted installations should upgrade as soon as possible.
[!CAUTION] Make sure your
APP_URLis set correctly before updating, otherwise the solidtime instance will not work properly
What's Changed
- Add trusted host validation middleware to prevent Host header poisoning. Thanks to @tonghuaroot for the security report
- Fixed invoice tax rate by @korridor in https://github.com/solidtime-io/solidtime/pull/1184
For self-hosting
This release adds host validation based on APP_URL.
By default, solidtime now only accepts requests for the hostname configured in APP_URL and its subdomains. Requests for other hostnames are rejected with HTTP 400.
If your instance is intentionally reachable through additional hostnames, configure the new TRUSTED_HOSTS environment variable:
:::env
APP_URL=https://solidtime.example.com
TRUSTED_HOSTS=solidtime.internal,solidtime.tailnet-name.ts.net
Wildcard subdomains are supported:
:::env
TRUSTED_HOSTS=*.example.com
No database migrations are included in this release.
Full Changelog: https://github.com/solidtime-io/solidtime/compare/v0.18.0...v0.19.0
