changedetection.io

GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field (#4317 )

2026-08-20 17:59:02 +02:00

GHSA-23mp-8222-96fr - reflected XSS in /diff/<uuid>/download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-24 14:03:30 +02:00

browser_steps

GHSA-56fq-63vj-9992 Improved URL filtering (#4315 )

2026-08-20 15:49:41 +02:00

conditions

i18n: Wrap untranslated UI strings and update ja translations (#4052 )

2026-04-16 03:54:13 +02:00

content_fetchers

GHSA-56fq-63vj-9992 Improved URL filtering (#4315 )

2026-08-20 15:49:41 +02:00

diff

Fix - diff_changed_to causing some missed notifications #4063 #3818 (#4066 )

2026-04-19 12:11:34 +02:00

jinja2_custom

Memory improvement - Use builtin markupsafe instead of creating a jinja2 template env each time for small strings (#3836 )

2026-02-05 10:07:36 +01:00

llm

feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294 )

2026-08-20 15:14:59 +02:00

model

feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294 )

2026-08-20 15:14:59 +02:00

notification

Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential

2026-05-25 17:57:41 +02:00

processors

GHSA-56fq-63vj-9992 Improved URL filtering (#4315 )

2026-08-20 15:49:41 +02:00

realtime

UI - Move rendering of each watchlist row out of the watchlist main template so it can be re-used by the realtime update (#4305 )

2026-08-16 18:07:34 +02:00

static

GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection

2026-08-20 10:59:38 +02:00

store

Security - GHSA-mh42-m7cg-49fr - Authenticated path traversal to arbitrary file write via the watch processor field (enum bypassed through /imports/import)

2026-08-20 10:56:13 +02:00

templates

feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294 )

2026-08-20 15:14:59 +02:00

tests

GHSA-23mp-8222-96fr - reflected XSS in /diff/<uuid>/download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-24 14:03:30 +02:00

translations

GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field (#4317 )

2026-08-20 17:59:02 +02:00

widgets

Language updates (#3764 )

2026-01-17 14:11:57 +01:00

__init__.py

Security: hide the running version from anonymous visitors when a password is set (#2190 ) (#4306 )

2026-08-20 11:09:13 +02:00

.gitignore

…

auth_decorator.py

Fixing GHSA-vwgh-2hvh-4xm5 — substring match in the shared_diff_access, improve access control to shared diff access (#4130 )

2026-05-11 14:43:27 +02:00

custom_queue.py

Page fetchers - Were not truely running independently and could have been blocking eachother, this commit speeds up page fetches where there is more than 1 worker.

2026-01-13 16:32:50 +01:00

favicon_utils.py

Memory - Favicon reader had a memory leak, Restart fetch workers between jobs, misc tweaks (#3787 )

2026-01-20 12:49:53 +01:00

flask_app.py

GHSA-q85w-c766-h5g8 - Advisory for four unprotected routes in price_data_follower, check_proxy and language handling that missing. Reported-by: Mayssare Amakhtari (@cy3erm) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-24 13:47:31 +02:00

forms.py

feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294 )

2026-08-20 15:14:59 +02:00

gc_cleanup.py

Adding a GC memory cleanup (releases cached libxml memory and others) (#3079 )

2025-04-01 15:48:14 +02:00

html_tools.py

fix: sanitize lone unicode surrogates before filtering JSON (#4293 )

2026-08-15 17:24:47 +02:00

is_safe_url.py

Development branch merge into release/master

2026-01-12 17:50:53 +01:00

languages.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00

notification_service.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00

pluggy_interface.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00

PLUGIN_README.md

Watch history - Don't rescan whole history.txt when looking up a timestamp <->filepath (#3602 )

2025-11-05 18:50:27 +01:00

pytest.ini

Run all pytests in parallel (#3569 )

2025-10-28 21:32:25 +01:00

queue_handlers.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00

queuedWatchMetaData.py

…

rss_tools.py

RSS Reader Mode parser improvements - Pick up all fields from RSS where possible, better auto-detect of the XML encoding if it wasnt set by the browser (#3646 )

2025-11-19 16:42:25 +01:00

run_basic_tests.sh

RSS - RSS pubDate is wrong on any non-UTC container: local time is relabelled as UTC - #4309 (#4314 )

2026-08-20 15:49:29 +02:00

run_custom_browser_url_tests.sh

Build/test - Parallel test jobs for faster testing (#3568 )

2025-10-28 13:24:22 +01:00

run_proxy_tests.sh

Run all pytests in parallel (#3569 )

2025-10-28 21:32:25 +01:00

run_socks_proxy_tests.sh

Run all pytests in parallel (#3569 )

2025-10-28 21:32:25 +01:00

strtobool.py

Page fetchers - Were not truely running independently and could have been blocking eachother, this commit speeds up page fetches where there is more than 1 worker.

2026-01-13 16:32:50 +01:00

test_cli_opts.sh

DB data migration upgrade fixes (#3811 )

2026-01-28 12:02:19 +01:00

time_handler.py

Fix time schedule off-by-one bug at exact end times for all durations and add comprehensive edge case tests Re #846 (#3890 )

2026-02-17 02:38:16 +01:00

validate_url.py

ghsa-gwph-fp79-379w - changedetection.io SSRF protection bypass via CGNAT addresses, also adding to ALLOW_IANA_RESTRICTED_ADDRESSES behaviour.

2026-08-20 18:11:02 +02:00

worker_pool.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00

worker.py

UI full refactor / upgrade (#4183 )

2026-07-16 15:08:29 +02:00