What's Changed

• fix: report the actual 1-based failed browser-step number (#4200) by @ebarkhordar in #4258
• UI medium refactor by @dgtlmoon in #4183
• Show regex-tagged watches under their group tab by @willyjfarrell in #4267
• Watch history - fix for restock.previous_price returns the first-ever price once a watch has 3+ snapshots by @dgtlmoon in #4268
• Fix LLM token counter race condition by @honma89 in #4276
• fix: Visual Selector renders scraped selectors as text, not markup by @kah-ja in #4282
• fix: sanitize lone unicode surrogates before filtering JSON by @snowyukitty in #4293
• fix: invalidate favicon cache when clearing watch history by @snowyukitty in #4286
• fix: avoid division by zero when logging watch load rate by @snowyukitty in #4289
• UI - Move rendering of each watchlist row out of the watchlist main template so it can be re-used by the realtime update by @dgtlmoon in #4305
• Security: hide the running version from anonymous visitors when a password is set (#2190) by @pongoe in #4306
• Move development tools out of runtime requirements by @Nameless-Monster-Nerd in #4280
• CSRF - Test fix by @dgtlmoon in #4316
• feature: allow a watch or group to append to the inherited AI Change Summary prompt by @snowyukitty in #4294
• RSS - RSS pubDate is wrong on any non-UTC container: local time is relabelled as UTC - #4309 by @dgtlmoon in #4314
• GHSA-56fq-63vj-9992 Improved URL filtering by @dgtlmoon in #4315
• GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field by @dgtlmoon in #4317
• Bump actions/setup-python from 6 to 7 in the all group across 1 directory by @dependabot[bot] in #4291
• GHSA-23mp-8222-96fr - reflected XSS in /diff//download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm) Co-Authored-By: Claude Opus 5 (1M context) [email protected] by @dgtlmoon in #4324
• LIBXML Data integrity fix, libxml must be locked across threads for any XML parsing by @dgtlmoon in #4325
• Add Polish translation by @osaczony30 in #4329
• Add Ukrainian support for the 'In stock'/'Not in stock' status by @iG8R in #4330
• Add watch UI should show which browser(s) are available and set default browser by @dgtlmoon in #4334
• feat: make Playwright CSP bypass configurable by @kquinsland in #4298
• Restock detection - fix inverted condition that skipped the OpenGraph availability fallback by @TowyTowy in #4262
• Add watch UI default browser by @dgtlmoon in #4335
• fix: Browser Steps picker cannot select a nested in a by @thejdubb02 in https://github.com//pull/4336
• deps: update litellm dependency cap by @apeabody in https://github.com//pull/4341
• fix(backup): add utf-8 encoding when writing url list files by @apeabody in https://github.com//pull/4345
• Puppeteer/Playwright CSP bypass - test refactor by @dgtlmoon in https://github.com//pull/4346
• Python 3.10 EOL October/2026 - Dropping support - conflicts with jsonschema and litellm by @dgtlmoon in https://github.com//pull/4347
• fix(llm): support reasoning models (), safe booleans, and timestamp diffs by @apeabody in https://github.com//pull/4340
• fix(llm): handle reasoning blocks that aren't a well-formed pair by @dgtlmoon in https://github.com//pull/4349
• Memory - GC freeze after startup to save CPU cycles and improve memory management by @dgtlmoon in https://github.com//pull/4351
• Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added timezone to the official API docs by @dgtlmoon in https://github.com//pull/4350
• Memory usage - small improvement by tidying up module imports by @dgtlmoon in https://github.com//pull/4352
• UTF-8/Lone Surrogate encoding test improvements related to #4273 by @dgtlmoon in https://github.com//pull/4353
• LLM - Per watch/group settings and UI tidyup by @dgtlmoon in https://github.com//pull/4354
• Update - pyppeteer-ng to 2.0.0rc16 by @dgtlmoon in https://github.com//pull/4357
• fix(llm): support Gemini flash-lite & reasoning models, strip extra_body on 400 retry by @apeabody in https://github.com//pull/4342
• Watch loading - Dont crawl whole datastore on disk, just check each directory for watch.json / tag.json by @dgtlmoon in https://github.com//pull/4358
• Env var - PAGE_WATCH_LIMIT enhancements by @dgtlmoon in https://github.com//pull/4359
• Feature/watch limit by @dgtlmoon in https://github.com//pull/4360
• fix(api): accept an existing tag UUID in the watch tag field, and deprecate it by @dgtlmoon in https://github.com//pull/4361
• fix(conditions): support zero values in condition filtering and json logic conversion by @apeabody in https://github.com//pull/4362

New Contributors

• @willyjfarrell made their first contribution in https://github.com//pull/4267
• @honma89 made their first contribution in https://github.com//pull/4276
• @kah-ja made their first contribution in https://github.com//pull/4282
• @snowyukitty made their first contribution in https://github.com//pull/4293
• @pongoe made their first contribution in https://github.com//pull/4306
• @Nameless-Monster-Nerd made their first contribution in https://github.com//pull/4280
• @osaczony30 made their first contribution in https://github.com//pull/4329
• @iG8R made their first contribution in https://github.com//pull/4330
• @kquinsland made their first contribution in https://github.com//pull/4298
• @thejdubb02 made their first contribution in https://github.com//pull/4336

Full Changelog: https://github.com/dgtlmoon/changedetection.io/compare/0.55.8...0.60.1

What's Changed

• feat: Czech translation updated and refined by @svetlemodry in #4203
• fix: extract <title> from pages with large sections (#4217) by @crossi-dev in #4220
• Restock rename original price to last price by @dgtlmoon in #4227
• fix: Tag RSS feed ignores security token when password protection is enabled by @medzin in #4235
• LLM: strip sampling params and retry when the model rejects them by @quinnypig in #4241
• fix: URL validation rejects valid URLs with '|' in the anchor/fragment (#4209) by @AmirF194 in #4243
• fix: .gitignore the real test-log path (changedetectionio/tests/logs) by @AmirF194 in #4247
• Add Russian (ru) translation by @Marfa in #4236
• Bump the all group across 1 directory with 2 updates by @dependabot[bot] in #4238
• fix: don't error watches when Content-Type is JSON but body isn't parsable (#3827) by @TowyTowy in #4250
• fix: safe-empty restock default so restock notification tokens work for any watch by @ebarkhordar in #4249
• LLM - Raise or remove LLM timeout when local endpoint detected #4225 by @dgtlmoon in #4254
• [i18n] JavaScript UI strings not covered by translations #4233 by @dgtlmoon in #4255
• [feature] Restock LLM fallback: make the 8000 char content limit configurable, change to 15,000 chars by default #4213 by @dgtlmoon in #4257

New Contributors

• @crossi-dev made their first contribution in #4220
• @medzin made their first contribution in #4235
• @quinnypig made their first contribution in #4241
• @AmirF194 made their first contribution in #4243
• @Marfa made their first contribution in #4236
• @TowyTowy made their first contribution in #4250
• @ebarkhordar made their first contribution in #4249

Full Changelog: 0.55.7...0.55.8

Security updates

Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential

What's Changed

• UI - Preview problem fix for extract_text/ignore_text #4138 by @dgtlmoon in #4169
• UI - LLM - Flag LLM_FEATURES_DISABLED to disable all LLM from the UI/system by @dgtlmoon in #4171
• Notifications - raw_diff token was missing by @dgtlmoon in #4177
• LLM UI - Blueprint/code also disabled when env flag LLM_FEATURES_DISABLED is enabled by @dgtlmoon in #4180
• Llm settings pydantic refactor by @dgtlmoon in #4181
• lint: Bump dennis — adopt --strict mode and drop false-positive workarounds by @skkzsh in #4182

Full Changelog: 0.55.5...0.55.6

What's Changed

i18n: Ruff INT (flake8-gettext) by @skkzsh in #4096

UI - AI/LLM - "Summary" button should set last viewed by @dgtlmoon in #4095

Improve LiteLLM deps #4093 by @dgtlmoon in #4102

i18n: Add dennis .pot/.po lint by @skkzsh in #4097

API - watch.link was accidently a tuple, enforcing string by @dgtlmoon in #4104

API - Add restock config to API /v1/watch/ json output #4099 by @dgtlmoon in #4103

i18n: Enforce dennis lint warnings in CI by @skkzsh in #4105

i18n: Clear pre-existing dennis warnings in messages.pot by @skkzsh in #4112

i18n: Fix broken HTML tags and enforce dennis lint warnings in CI by @skkzsh in #4116

Notifications - extra check for system default by @dgtlmoon in #4122

Notifications - Escape only the diff variables before Jinja2 renders them into the template ( Stop breaking custom HTML for plaintext pages on HTML notifications) #4121 by @dgtlmoon in #4123

Fixing GHSA-vwgh-2hvh-4xm5 — substring match in the shared_diff_access by @dgtlmoon in #4130

Bumping tests by @dgtlmoon in #4131

LLM - Self-hosted OpenAI-compatible endpoint support (vLLM, LM Studio, llama.cpp) — refs #3204 by @tekgnosis-net in #4117

LLM integration - LiteLLM config - UI tweaks by @dgtlmoon in #4134

UI - Make LLM status sticky by @dgtlmoon in #4135

LLM - Fixing summary cache miss-hit by @dgtlmoon in #4136

Text filters - Process subtractive_selectors first by @dgtlmoon in #4142

API - Better support for watch API private/internal vars by @dgtlmoon in #4144

Text filters - Ignore text should run before 'extract text' by @dgtlmoon in #4143

Fix/pr 4110 czech l12n catalog sync by @dgtlmoon in #4145

Docker - INSTALLED_MARKER is kept in /datastore but package installs are not persistent (Dont use custom marker file, rely on pip instead) by @dgtlmoon in #4147

Fix/llm ollama etc tweaks by @dgtlmoon in #4148

UI - LLM - SSRF guard for the LLM api_base setting by @dgtlmoon in #4157

API Security - Watch GET history snapshot - Should return text/plain mimetype so it cant be accidently executed in the browser by @dgtlmoon in #4158

New Contributors

@tekgnosis-net made their first contribution in #4117

Full Changelog: 0.55.3...0.55.4

Big stuff

AI / LLM rulesets - Set your AI change detection rules and text summary rules, use hundreds of existing providers via LiteLLM.

What's Changed

• Use pgettext for diff page From/To labels to prevent context collisions by @skkzsh in #4073
• Fix broken opacity feedback for restock/price fields on tag edit screen by @skkzsh in #4072
• i18n: Wrap untranslated UI strings in include_subtract.html and add ja translations by @skkzsh in #4054
• Re #4080 msgfmt linting by @dgtlmoon in #4081
• Update python-engineio requirement from <5,>=4.9.0 to >=4.13.1,<5 by @dependabot[bot] in #4079
• CI - Translation sync check by @dgtlmoon in #4085
• DeprecationWarning: codecs.open() is deprecated. Use open() instead. by @skkzsh in #4078
• LLM implementation - by @dgtlmoon in #4057
• i18n: Consolidate fragmented gettext calls into entire-sentence msgids by @skkzsh in #4076
• Translations - Playwright macro unused, add extra linting for translations, add TRANSLATORS.md by @dgtlmoon in #4087
• [i18n] "Usage" tab label in AI settings is ambiguous across contexts #4086 by @dgtlmoon in #4088
• Update Korean language by @limeade23 in #4084

New Contributors

• @limeade23 made their first contribution in #4084

Full Changelog: 0.54.10...0.55.1

What's Changed

• Add Japanese translation (ja) by @skkzsh in #4019
• Update Selenium RemoteConnection to use ClientConfig for timeout by @mikaelz in #4027
• Fix SCREENSHOT_MAX_HEIGHT not enforced: cap viewport step_size and clip stitched output to max capture height #3810 by @dgtlmoon in #4030
• Notification - Adding tokens {{diff_changed_from}} and {{diff_changed_to}} #3818 by @dgtlmoon in #4031
• Feature - Groups/tag - Apply a group by specifying a wildcard, ie mysite.com by @dgtlmoon in #4032
• Add Portuguese (Brasil) translation by @mstrey in #4033
• fix: word-level diff ignores include_change_type_prefix by @lawrence3699 in #4037
• Groups - Set custom colour for tag/group/label background by @dgtlmoon in #4040
• Fix/step failure notification crash by @dgtlmoon in #4041
• Test - Word level diff - Re #4037 by @dgtlmoon in #4042
• fix: XLSX import error messages report wrong row number after failed rows by @lawrence3699 in #4036
• Czech l12n by @svetlemodry in #4043
• Add Turkish translation by @hekwert in #4044
• Handle inline favicons - Re #3891 by @dgtlmoon in #4047
• Text filters - New simpler filter "Extract lines containing text" by @dgtlmoon in #4046
• Test improvement - text extract tidyup by @dgtlmoon in #4048
• Update Japanese translations for new strings and fix fragment handling by @skkzsh in #4050
• Fix strings not rendered in user's locale despite having .po entries by @skkzsh in #4051
• Ignore text should override trigger text (It should ignore the trigger text if it appears) by @dgtlmoon in #3450

New Contributors

• @skkzsh made their first contribution in #4019
• @mikaelz made their first contribution in #4027
• @lawrence3699 made their first contribution in #4037
• @hekwert made their first contribution in #4044

Full Changelog: 0.54.8...0.54.9

Security

• XPath json-doc() Arbitrary File Read Bypass ( Similar fix as CVE-2026-29039 )
• CVE-2026-33981 - Environment Variable Disclosure via jq env Builtin in Include Filters

What's Changed

• UI - Text tidyup by @dgtlmoon in #3989
• Realtime - Suppress socket.io errors in logs by @dgtlmoon in #3991
• Restock - Add previous_price to restock values #3987 by @dgtlmoon in #3993
• fix: correct critical errors in Spanish (es) translation by @rasputino in #3994
• last_error should be cleared if page content was the same and there was no error by @dgtlmoon in #3997
• fix: Czech translation strings updated by @svetlemodry in #4008

New Contributors

• @rasputino made their first contribution in #3994
• @svetlemodry made their first contribution in #4008

Full Changelog: 0.54.6...0.54.7