dgtlmoon
3a71777499
UI - Fixing lots of actions that should be a POST style action which led to a 404
...
Also solves some of GHSA-56fq-63vj-9992 Add-watch-UI should be POST/CSRF protected
2026-09-04 12:38:20 +02:00
dgtlmoon
89a41c0dda
GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection
2026-08-20 10:59:38 +02:00
dgtlmoon
71d332d5a0
UI full refactor / upgrade ( #4183 )
Build and push containers / metadata (push) Has been cancelled
Build and push containers / build-push-containers (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Has been cancelled
ChangeDetection.io App Test / lint-code (push) Has been cancelled
ChangeDetection.io App Test / lint-translations (push) Has been cancelled
ChangeDetection.io App Test / lint-template-i18n (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built package works basically. (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-10 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-11 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-12 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-13 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-14 (push) Has been cancelled
2026-07-16 15:08:29 +02:00
dgtlmoon
08017d66d6
Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential
2026-05-25 17:57:41 +02:00
dgtlmoon
ba20f66cee
Security - Arbitrary Local File Read via crafted backup restore
2026-04-27 16:35:07 +10:00
dgtlmoon
722644b111
Handle inline favicons ( #4047 #3891 )
2026-04-11 07:35:27 +02:00
dgtlmoon
1889a10ef6
CVE-2026-27696 Small fix - Restricted hostnames can still be added but are only checked at fetch-time (not when rendering lists etc) ( #3938 )
2026-03-01 00:17:29 +01:00
dgtlmoon
9e907d8466
Unresolvable hostnames should still be added, they are checked for security at fetch time ( #3933 )
2026-02-27 11:00:44 +01:00
dgtlmoon
fe7aa38c65
CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254 , http://10.0.0.1/ , http://127.0.0.1/ , etc.
2026-02-23 21:56:43 +01:00
dgtlmoon
1dbf1f5db5
UI - Watch overview - Restock price, validate number before output ( #3883 )
2026-02-16 18:50:37 +01:00
dgtlmoon
c5bd7da647
Security - Adding small test and fixing overzealous filename cleaner ( #3884 )
2026-02-16 18:31:25 +01:00
dgtlmoon
9d38b45173
Security CVE-2026-25527 - Unauthenticated static path traversal in resources
2026-02-16 15:48:03 +01:00
dgtlmoon
3d14df6a11
Development branch merge into release/master
...
Multi-language / Translations Support (#3696 )
- Complete internationalization system implemented
- Support for 7 languages: Czech (cs), German (de), French (fr), Italian (it), Korean (ko), Chinese Simplified (zh), Chinese Traditional (zh_TW)
- Language selector with localized flags and theming
- Flash message translations
- Multiple translation fixes and improvements across all languages
- Language setting preserved across redirects
Pluggable Content Fetchers (#3653 )
- New architecture for extensible content fetcher system
- Allows custom fetcher implementations
Image / Screenshot Comparison Processor (#3680 )
- New processor for visual change detection (disabled for this release)
- Supporting CSS/JS infrastructure added
UI Improvements
Design & Layout
- Auto-generated tag color schemes
- Simplified login form styling
- Removed hard-coded CSS, moved to SCSS variables
- Tag UI cleanup and improvements
- Automatic tab wrapper functionality
- Menu refactoring for better organization
- Cleanup of offset settings
- Hide sticky tabs on narrow viewports
- Improved responsive layout (#3702 )
User Experience
- Modal alerts/confirmations on delete/clear operations (#3693 , #3598 , #3382 )
- Auto-add https:// to URLs in quickwatch form if not present
- Better redirect handling on login (#3699 )
- 'Recheck all' now returns to correct group/tag (#3673 )
- Language set redirect keeps hash fragment
- More friendly human-readable text throughout UI
Performance & Reliability
Scheduler & Processing
- Soft delays instead of blocking time.sleep() calls (#3710 )
- More resilient handling of same UUID being processed (#3700 )
- Better Puppeteer timeout handling
- Improved Puppeteer shutdown/cleanup (#3692 )
- Requests cleanup now properly async
History & Rendering
- Faster server-side "difference" rendering on History page (#3442 )
- Show ignored/triggered rows in history
- API: Retry watch data if watch dict changed (more reliable)
API Improvements
- Watch get endpoint: retry mechanism for changed watch data
- WatchHistoryDiff API endpoint includes extra format args (#3703 )
Testing Improvements
- Replace time.sleep with wait_for_notification_endpoint_output (#3716 )
- Test for mode switching (#3701 )
- Test for #3720 added (#3725 )
- Extract-text difference test fixes
- Improved dev workflow
Bug Fixes
- Notification error text output (#3672 , #3669 , #3280 )
- HTML validation fixes (#3704 )
- Template discovery path fixes
- Notification debug log now uses system locale for dates/times
- Puppeteer spelling mistake in log output
- Recalculation on anchor change
- Queue bubble update disabled temporarily
Dependency Updates
- beautifulsoup4 updated (#3724 )
- psutil 7.1.0 → 7.2.1 (#3723 )
- python-engineio ~=4.12.3 → ~=4.13.0 (#3707 )
- python-socketio ~=5.14.3 → ~=5.16.0 (#3706 )
- flask-socketio ~=5.5.1 → ~=5.6.0 (#3691 )
- brotli ~=1.1 → ~=1.2 (#3687 )
- lxml updated (#3590 )
- pytest ~=7.2 → ~=9.0 (#3676 )
- jsonschema ~=4.0 → ~=4.25 (#3618 )
- pluggy ~=1.5 → ~=1.6 (#3616 )
- cryptography 44.0.1 → 46.0.3 (security) (#3589 )
Documentation
- README updated with viewport size setup information
Development Infrastructure
- Dev container only built on dev branch
- Improved dev workflow tooling
2026-01-12 17:50:53 +01:00
dgtlmoon
ae532c82e8
Run all pytests in parallel ( #3569 )
2025-10-28 21:32:25 +01:00
dgtlmoon
ab0b85d088
Unify safe URL checking to the one function, strengthen tests and filters ( #3564 )
Build and push containers / metadata (push) Has been cancelled
Build and push containers / build-push-containers (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built package works basically. (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/amd64 (alpine) (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/arm64 (alpine) (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/amd64 (main) (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/arm/v7 (main) (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/arm/v8 (main) (push) Has been cancelled
ChangeDetection.io Container Build Test / Build linux/arm64 (main) (push) Has been cancelled
ChangeDetection.io App Test / lint-code (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-10 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-11 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-12 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-13 (push) Has been cancelled
2025-10-28 13:24:37 +01:00
dgtlmoon
2116b2cb93
CVE-2025-62780 - Stored XSS in Watch update via API
2025-10-28 10:09:30 +01:00
dgtlmoon
4dbab8d77a
Test speedup - remove common calls for function calls ( #3477 )
2025-10-10 01:16:03 +02:00
dgtlmoon
b74b76c9f9
"Time between check" field is now validated correctly (requires atleast one of the weeks days hours minutes seconds to be set)
Build and push containers / metadata (push) Has been cancelled
Build and push containers / build-push-containers (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built 📦 package works basically. (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Has been cancelled
ChangeDetection.io App Test / lint-code (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-10 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-11 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-12 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-13 (push) Has been cancelled
2025-09-16 19:09:45 +02:00
dgtlmoon
3d5a544ea6
CVE-2025-52558 - Fixing XSS in error handling output of watch overview list
2025-06-21 09:45:22 +02:00
dgtlmoon
73f3beda00
Realtime UI - Socketio tweaks and refactor ( #3220 )
2025-06-03 10:17:19 +02:00
dgtlmoon
302ef80d95
Server - Path blueprint fixes and moving code blueprint to fix RSS forward slash on url ( #3054 )
Build and push containers / metadata (push) Waiting to run
Build and push containers / build-push-containers (push) Waiting to run
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Waiting to run
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built 📦 package works basically. (push) Blocked by required conditions
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Blocked by required conditions
ChangeDetection.io App Test / lint-code (push) Waiting to run
ChangeDetection.io App Test / test-application-3-10 (push) Blocked by required conditions
ChangeDetection.io App Test / test-application-3-11 (push) Blocked by required conditions
ChangeDetection.io App Test / test-application-3-12 (push) Blocked by required conditions
ChangeDetection.io App Test / test-application-3-13 (push) Blocked by required conditions
2025-03-25 22:57:15 +01:00
dgtlmoon
73189672c3
Refactor code layout, add extra tests
Build and push containers / metadata (push) Has been cancelled
Build and push containers / build-push-containers (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Build distribution 📦 (push) Has been cancelled
ChangeDetection.io App Test / lint-code (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Test the built 📦 package works basically. (push) Has been cancelled
Publish Python 🐍distribution 📦 to PyPI and TestPyPI / Publish Python 🐍 distribution 📦 to PyPI (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-10 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-11 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-12 (push) Has been cancelled
ChangeDetection.io App Test / test-application-3-13 (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
CodeQL / Analyze (python) (push) Has been cancelled
2025-03-18 10:40:22 +01:00
dgtlmoon
4419bc0e61
Fixing test for CVE-2024-56509 ( #2864 )
2024-12-27 11:09:52 +01:00
dgtlmoon
f7e9846c9b
CVE-2024-56509 - Stricter file protocol checking pre-check ( Improper Input Validation Leading to LFR/Path Traversal when fetching file:.. )
2024-12-27 09:26:28 +01:00
dgtlmoon
d297850539
Security - Fix test
2024-11-07 20:10:02 +01:00
dgtlmoon
751239250f
Security check - improve test
2024-11-07 19:41:48 +01:00
dgtlmoon
49bc982c69
CVE-2024-51998 - file:/ path traversal access should not be allowed to access a file without ALLOW_FILE_URI set
2024-11-07 18:45:19 +01:00
dgtlmoon
e756e0af5e
Fixing file:// file pickup - for change detection of local files ( #2505 )
2024-07-18 13:05:27 +02:00
dgtlmoon
8f3a6a42bc
Testing - Adding simple memory usage test ( #2483 )
2024-07-11 15:03:42 +02:00
dgtlmoon
c0f000b1d1
Merge pull request from GHSA-pwgc-w4x9-gw67
...
* Auto-escape was not enabled GHSA-pwgc-w4x9-gw67
* Auto-escape was not enabled because the filenames were not something jinja2 enables it for.
2024-05-02 11:46:31 +02:00
dgtlmoon
c8dcc072c8
Code refactor for fetchers ( #1941 )
2023-11-13 10:42:56 +01:00
dgtlmoon
52f2c00308
UI/Functionality - Ability to manage/apply filters and notifications across tags/groups
2023-06-19 23:29:13 +02:00
dgtlmoon
f8e587c415
Security - Possible stored XSS in watch list - Only permit HTTP/HTTP/FTP by default - override with env var SAFE_PROTOCOL_REGEX ( #1359 )
2023-01-29 11:12:06 +01:00
dgtlmoon
f2fa638480
Security update - Protect against file:/// type access by webdriver/chrome. ( #483 )
2022-03-21 20:59:20 +01:00
dgtlmoon