Mealie Release Notes

Patch release to fix auth issues when embedding Mealie in an iframe.

🐛 Bug fixes

• fix: translate recipe time units according to locale @deeumiya-huang (#8268)
• fix: remove unsupported partitioned cookie @michael-genson (#8278)

🧰 Maintenance

• chore(l10n): New Crowdin updates @hay-kot (#8270)

⬆️ Dependency updates

• chore(deps): update dependency coverage to v7.16.0 @renovate[bot] (#8266)
• fix(deps): update dependency openai to v3.6.0 @renovate[bot] (#8267)
• chore(deps): update dependency pylint to v4.0.8 @renovate[bot] (#8279)

🙏 New Contributors

• @deeumiya-huang made their first contribution in #8268

Original source

This release comes with an overhaul to Mealie's internal auth, making it more inline with what you generally expect, specifically with "Remember Me" and TOKEN_TIME.

Tokens now refresh automatically before they expire. As long as you use the app before your token expires, it will automatically be refreshed with a new token. What this means for users is that you won't be logged-out mid-session, and you shouldn't have to log-in periodically unless you haven't used the app in some time (see TOKEN_TIME changes).

Once you close your tab/browser/session, you will be logged-out. To stay logged-in between sessions, check "Remember Me" when logging in. Since this is the opposite behavior of how logins worked before this change, "Remember Me" is checked by default to help ease the learning curve.

TOKEN_TIME now defines how long a session will last before expiring. Many instances previously set this value arbitrarily high to prevent users from being logged-out. Now with auto-refresh this is unnecessary, and can be substantially lowered (we recommend turning this down to at most 168 hours, i.e. one week).

⚠️⚠️⚠️ IMPORTANT BREAKING CHANGE FOR APP DEVELOPERS ⚠️⚠️⚠️

GET /api/auth/refresh has been removed, and is instead now a POST API.

🎉 Highlights

Overhauled internal auth (see above)

You can now delete unused organizers from the data management page

You can now leverage a recipe's rating in meal plan rules, cookbooks, and the recipe finder

Clicking on a recipe's image or asset will show the the fully expanded image

The Meal Planner UI has been reworked to make it easier to use

🚨 Breaking changes

feat: add token refresh, fix remember me, and fix Safari token expiration @michael-genson (#8200)

✨ New features

feat: add token refresh, fix remember me, and fix Safari token expiration @michael-genson (#8200)
feat: organizer improvements — recipeCount, merge endpoint, delete unused UI @bferd (#7829)
feat: Shopping list focus polishes @miah120 (#7890)
feat: add rating as a query filter field @dominikrein (#7966)
feat: click-to-expand lightbox for recipe hero image and asset images @bferd (#7933)
feat: improve registration UX by coloring Next button based on form validity @Luna-81 (#8233)
feat: Improve recipe parsing ui @miah120 (#7984)
feat: rank exact and prefix matches above substring matches in food search @dyllan500 (#7781)
feat: Meal Planner UI Improvements @miah120 (#7946)
feat: add autofocus to RecipeSelector input field @torbenvanassche (#8262)

🐛 Bug fixes

fix: fallback to regular HTML if video download fails @michael-genson (#8203)
fix: Improve keyboard navigation of search results @mbianucci (#7869)
fix: allow deleting a user who both rated and favorited a recipe (#8121) @chiliec (#8131)
fix: wrap timeline event subjects @YibingZhang325 (#8218)
fix: Account for on hand items when adding a recipe to a shopping list @miah120 (#7912)
fix: close long-lived token auth transaction @stieglma (#7897)
fix: stamp timeline events at request time, not process start @alexander-wenzel-dev (#7896)
fix: repoint shopping list items when merging a food or unit @henry1113nz (#8146)
fix: parse day- and week-only ISO 8601 durations in recipe time cleaner @TowyTowy (#7895)
fix: strip trailing footnote markers from parsed ingredient names @henry1113nz (#8145)
fix: hide "No Label" heading when copying an unlabeled shopping list @brent20 (#7905)
fix: Add bottom padding to prevent fab overlapping content @miah120 (#7940)
fix: resize images before AI import to avoid provider size limits @chiliec (#8241)
fix: Keep instruction sticky in ingredient linker @miah120 (#7925)
fix: skip image request when a recipe has no image @henry1113nz (#8075)
fix: preserve source language in AI recipe parsing @x0x0b (#8236)
fix: refetch organizer data pages on visit to avoid stale data @lotusk (#8260)

🧰 Maintenance

14 changes
chore(l10n): New Crowdin updates @hay-kot (#8171)
chore(l10n): New Crowdin updates @hay-kot (#8206)
chore(l10n): New Crowdin updates @hay-kot (#8207)
chore(l10n): New Crowdin updates @hay-kot (#8212)
chore(l10n): New Crowdin updates @hay-kot (#8216)
chore(l10n): New Crowdin updates @hay-kot (#8217)
chore(l10n): New Crowdin updates @hay-kot (#8219)
chore(l10n): New Crowdin updates @hay-kot (#8229)
chore(l10n): New Crowdin updates @hay-kot (#8234)
chore(l10n): Crowdin locale sync @mealie-actions[bot] (#8244)
chore(l10n): New Crowdin updates @hay-kot (#8237)
chore(l10n): New Crowdin updates @hay-kot (#8253)
chore(l10n): New Crowdin updates @hay-kot (#8257)
chore(l10n): New Crowdin updates @hay-kot (#8261)

📚 Documentation

docs: Add advice when backup is successful but keeps user logged out @qlassalle (#7919)

🔨 Internal development

dev: don't clobber devEngines.packageManager.version on release bump @lotusk (#8258)
dev: fix mangled pnpm version @michael-genson (#8264)

⬆️ Dependency updates

10 changes
fix(deps): update dependency openai to v3.3.1 @renovate[bot] (#8201)
fix(deps): update dependency yt-dlp to v2026.8.19 @renovate[bot] (#8205)
fix(deps): update dependency apprise to v1.13.0 @renovate[bot] (#8208)
chore(deps): update dependency ruff to v0.16.4 @renovate[bot] (#8211)
chore(deps): lock file maintenance @renovate[bot] (#8248)
fix(deps): update dependency openai to v3.4.0 @renovate[bot] (#8251)
fix(deps): update dependency openai to v3.5.0 @renovate[bot] (#8252)
chore(deps): update dependency ruff to v0.16.5 @renovate[bot] (#8255)
chore(deps): update node.js to be23f54 @renovate[bot] (#8256)
fix(deps): update dependency pydantic to v2.13.5 @renovate[bot] (#8263)

🙏 New Contributors

@mbianucci made their first contribution in #7869
@chiliec made their first contribution in #8131
@YibingZhang325 made their first contribution in #8218
@stieglma made their first contribution in #7897
@qlassalle made their first contribution in #7919
@henry1113nz made their first contribution in #8146
@dominikrein made their first contribution in #7966
@brent20 made their first contribution in #7905
@dyllan500 made their first contribution in #7781
@x0x0b made their first contribution in #8236
@torbenvanassche made their first contribution in #8262

Original source

🎉 Highlights

The meal planner features a much-improved recipe selector when editing entries directly:
Several improvements have been made to lower idle RAM usage and speed up startup time.

✨ New features

• feat: improve meal planner editor @michael-genson (#8152)
• feat: remove share text @michael-genson (#8168)
• feat: Added support for disable services @Choromanski (#7434)
• feat: add optional linked ingredients to print view @BWagener (#7632)
• feat: lazy module loading and deferred pydantic build @michelezoncheddu (#7316)
• feat: allow user to specify cookiefile for yt-dlp @space192 (#7363)
• feat: add URL-backed cook mode for recipe pages @micsco (#7287)

🐛 Bug fixes

• fix: registration with seed data returns a 500 @justadityaraj (#8170)
• fix: return HTTP 200 for SPA fallback responses @roadhero (#7656)

🧰 Maintenance

7 changes

• chore(l10n): New Crowdin updates @hay-kot (#8135)
• chore(l10n): New Crowdin updates @hay-kot (#8144)
• chore(l10n): New Crowdin updates @hay-kot (#8155)
• chore(l10n): New Crowdin updates @hay-kot (#8161)
• chore: remove unused translations and unused icons @michael-genson (#8169)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#8185)
• chore: resolve warnings and update some older deps @michael-genson (#8193)

🔨 Internal development

• dev: switch to pnpm and update devcontainer @p0lycarpio (#7663)
• dev: renamed and moved github copilot-specific repository context to AGENTS.md, which is harness-agnostic @lcs-crr (#8134)
• dev: relax pnpm pin @michael-genson (#8189)

⬆️ Dependency updates

19 changes

• chore(deps): update dependency ruff to v0.16.3 @renovate[bot] (#8136)
• fix(deps): update dependency uvicorn to v0.52.3 @renovate[bot] (#8137)
• fix(deps): update dependency orjson to v3.12.0 @renovate[bot] (#8153)
• fix(deps): update dependency openai to v3.1.0 @renovate[bot] (#8157)
• chore(deps): update dependency types-pyyaml to v6.0.12.20260815 @renovate[bot] (#8158)
• chore(deps): update dependency mypy to v2.3.1 @renovate[bot] (#8159)
• chore(deps): update dependency dompurify to v3.4.11 [security] @renovate[bot] (#8164)
• chore(deps): update dependency dompurify to v3.4.13 [security] @renovate[bot] (#8167)
• chore(deps): update dependency axios to v1.18.0 [security] @renovate[bot] (#8166)
• chore(deps): update dependency nuxt to v4.5.1 [security] @renovate[bot] (#8165)
• fix(deps): update dependency python-dotenv to v1.2.3 @renovate[bot] (#8174)
• fix(deps): update dependency openai to v3.2.0 @renovate[bot] (#8182)
• chore(deps): update dependency httpx2 to v2.11.0 @renovate[bot] (#8186)
• chore(deps): update dependency httpx2 to v2.12.0 @renovate[bot] (#8187)
• chore(deps): lock file maintenance @renovate[bot] (#8191)
• fix(deps): update dependency openai to v3.3.0 @renovate[bot] (#8190)
• chore(deps): lock file maintenance @renovate[bot] (#8192)
• fix(deps): update dependency lxml to v6.1.2 @renovate[bot] (#8195)
• fix(deps): update dependency uvicorn to v0.52.4 @renovate[bot] (#8196)

🙏 New Contributors

• @lcs-crr made their first contribution in #8134
• @BWagener made their first contribution in #7632
• @justadityaraj made their first contribution in #8170
• @space192 made their first contribution in #7363
• @micsco made their first contribution in #7287
• @roadhero made their first contribution in #7656

Original source

🎉 Highlights

Simplified AI Imports

Importing recipes with AI has been vastly improved. Rather than several disparate import pages, you now import recipes with AI via the universal "Import with AI" page:

From here you can also choose several options previously only featured on a handful of pages:

The internals of how your providers are called has been rewritten as well to break up import tasks into separate calls to your provider, shrinking context windows and producing more consistent results.

Native OIDC endpoints

We now have native OIDC endpoints for OIDC services which only work via passkey (or otherwise don't rely on the browser session), such as Pocket ID and authentik. These should now work for you out of the box (see: #7804).

✨ New features

• feat: add re-roll button to meal planner entries @smashngrabb (#7348)
• feat: add native OIDC endpoints for mobile/desktop clients @DmitriiSer (#7804)
• feat: Unified AI recipe page @michael-genson (#8043)
• feat: skip expiring share link for fully-public groups/households @bferd (#7941)
• feat: Update ingredient parsing text @michael-genson (#8066)
• feat: Refine AI import page @michael-genson (#8067)
• feat: Jump from toast @miah120 (#7986)

🐛 Bug fixes

• fix: handle HowToSection missing itemListElement in clean_instructions @ishirbhan (#7616)
• fix: typo in en-US food seed data @sevmonster (#7750)
• fix: recipe image lost after using "Get" (fetch by URL) then saving @bferd (#8021)
• fix: revalidate stale group/household preferences cache and settings forms @bferd (#8022)
• fix: fix public check for recipe sharing @michael-genson (#8055)
• fix: improve IntegrityError message for unique constraint violations @nzyz995 (#8050)
• fix: Allow psycopg2-binary to be optional again @michael-genson (#8065)
• fix: prevent recipe tags from hiding card actions @feilongcheng (#8028)
• fix: keep the whole image visible after rotating it in the image cropper @derekdiliu (#8016)
• fix: prevent registration with empty group name @Luna-81 (#8105)
• fix: reset ingredient parser dialog state when reopening @derekdiliu (#8106)
• fix: cascade delete a user's meal plans and shopping lists @lotusk (#8120)
• fix: prevent meal planner recipe card menu from being clipped in narrow columns @elliot-ultra (#8117)
• fix: await validation before creating admin user @ARYA8532 (#8118)

🧰 Maintenance

28 changes

• chore(l10n): New Crowdin updates @hay-kot (#7970)
• chore(l10n): New Crowdin updates @hay-kot (#7978)
• chore(l10n): New Crowdin updates @hay-kot (#7982)
• chore(l10n): New Crowdin updates @hay-kot (#7987)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7993)
• chore(l10n): New Crowdin updates @hay-kot (#7995)
• chore(l10n): New Crowdin updates @hay-kot (#8002)
• chore(l10n): New Crowdin updates @hay-kot (#8009)
• chore(l10n): New Crowdin updates @hay-kot (#8015)
• chore(l10n): New Crowdin updates @hay-kot (#8025)
• chore(l10n): New Crowdin updates @hay-kot (#8029)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#8037)
• chore(l10n): New Crowdin updates @hay-kot (#8039)
• chore(l10n): New Crowdin updates @hay-kot (#8048)
• chore(l10n): New Crowdin updates @hay-kot (#8056)
• chore(l10n): New Crowdin updates @hay-kot (#8061)
• chore(l10n): New Crowdin updates @hay-kot (#8069)
• chore(l10n): New Crowdin updates @hay-kot (#8073)
• chore(l10n): New Crowdin updates @hay-kot (#8077)
• chore(l10n): New Crowdin updates @hay-kot (#8079)
• chore(l10n): New Crowdin updates @hay-kot (#8086)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#8101)
• chore(l10n): New Crowdin updates @hay-kot (#8104)
• chore(l10n): New Crowdin updates @hay-kot (#8107)
• chore: treat all warnings as errors in pytest unless explicitly ignored. @bestxmg (#8094)
• chore: fix frontend lint @michael-genson (#8112)
• chore(l10n): New Crowdin updates @hay-kot (#8122)
• chore(l10n): New Crowdin updates @hay-kot (#8128)

🔨 Internal development

• dev: bump dev image to trixie @michael-genson (#7968)
• dev: fix all the warning in pytest @bestxmg (#8033)
• dev: bind-mount dev postgres data to dev/data/postgres @lotusk (#8046)
• dev: Shopping list unit test @miah120 (#7969)

⬆️ Dependency updates

42 changes

• fix(deps): update dependency openai to v2.48.0 @renovate[bot] (#7972)
• chore(deps): update dependency types-pyyaml to v6.0.12.20260724 @renovate[bot] (#7975)
• fix(deps): update dependency fastapi to v0.140.0 @renovate[bot] (#7981)
• chore(deps): update dependency ruff to v0.16.0 @michael-genson (#7983)
• fix(deps): update dependency fastapi to v0.140.7 @renovate[bot] (#7989)
• fix(deps): update dependency openai to v2.49.0 @renovate[bot] (#7992)
• fix(deps): update dependency fastapi to v0.140.8 @renovate[bot] (#7996)
• fix(deps): update dependency fastapi to v0.140.9 @renovate[bot] (#7997)
• fix(deps): update dependency fastapi to v0.140.13 @renovate[bot] (#7998)
• fix(deps): update dependency openai to v2.50.0 @renovate[bot] (#7999)
• chore(deps): lock file maintenance @renovate[bot] (#8000)
• fix(deps): update dependency fastapi to v0.141.0 @renovate[bot] (#8004)
• fix(deps): update dependency uvicorn to v0.52.0 @renovate[bot] (#8005)
• fix(deps): update dependency fastapi to v0.141.1 @renovate[bot] (#8006)
• chore(deps): update dependency ruff to v0.16.1 @renovate[bot] (#7971)
• fix(deps): update dependency openai to v2.51.0 @renovate[bot] (#8008)
• fix(deps): update dependency openai to v2.52.0 @renovate[bot] (#8017)
• fix(deps): update dependency uvicorn to v0.52.1 @renovate[bot] (#8023)
• chore(deps): update dependency coverage to v7.15.3 @renovate[bot] (#8031)
• chore(deps): update dependency dompurify to v3.4.13 [security] @renovate[bot] (#8032)
• fix(deps): update dependency openai to v2.52.1 @renovate[bot] (#8035)
• fix(deps): update dependency openai to v2.53.0 @renovate[bot] (#8036)
• chore(deps): update dependency httpx2 to v2.9.1 @renovate[bot] (#8038)
• fix(deps): update dependency alembic to v1.19.0 @renovate[bot] (#8041)
• chore(deps): update node.js to 934240a @renovate[bot] (#8054)
• chore(deps): lock file maintenance @renovate[bot] (#8042)
• chore(deps): update dependency coverage to v7.15.4 @renovate[bot] (#8062)
• chore(deps): update dependency types-python-dateutil to v2.9.0.20260807 @renovate[bot] (#8070)
• fix(deps): update dependency pydantic-settings to v2.15.0 @renovate[bot] (#8071)
• chore(deps): update dependency ruff to v0.16.2 @renovate[bot] (#8072)
• fix(deps): update dependency alembic to v1.19.1 @renovate[bot] (#8080)
• chore(deps): update dependency setuptools to v84 @renovate[bot] (#8081)
• fix(deps): update dependency recipe-scrapers to v15.12.0 @renovate[bot] (#8082)
• chore(deps): update dependency httpx2 to v2.10.0 @renovate[bot] (#8085)
• chore(deps): update dependency pylint to v4.0.7 @renovate[bot] (#8090)
• chore(deps): update dependency pre-commit to v4.6.2 @renovate[bot] (#8099)
• fix(deps): update dependency openai to v2.54.0 @renovate[bot] (#8108)
• fix(deps): update dependency sqlalchemy to v2.0.52 @renovate[bot] (#8109)
• chore(deps): lock file maintenance @renovate[bot] (#8110)
• chore(deps): lock file maintenance @renovate[bot] (#8114)
• fix(deps): update dependency openai to v3 @renovate[bot] (#8113)
• fix(deps): update dependency uvicorn to v0.52.2 @renovate[bot] (#8129)

🙏 New Contributors

• @smashngrabb made their first contribution in #7348
• @ishirbhan made their first contribution in #7616
• @sevmonster made their first contribution in #7750
• @bestxmg made their first contribution in #8033
• @DmitriiSer made their first contribution in #7804
• @lotusk made their first contribution in #8046
• @nzyz995 made their first contribution in #8050
• @feilongcheng made their first contribution in #8028
• @derekdiliu made their first contribution in #8016
• @Luna-81 made their first contribution in #8105
• @elliot-ultra made their first contribution in #8117
• @ARYA8532 made their first contribution in #8118

Original source

🍴🍴🍴🍴🍴🍴

The previous version of Mealie (v3.21.0) introduced a ⚠️BREAKING CHANGE⚠️ for instances using OIDC: Mealie now requires your OIDC provider to confirm the user's email address before allowing the login. This prevents an unverified, self-asserted email address from being used to match (and sign in) to an existing Mealie account.

If an identity provider does not emit the email_verified claim, logins now fail. If you cannot configure your identity provider to include the email_verified claim, you can set OIDC_REQUIRES_EMAIL_VERIFICATION to false (this is not recommended per the above security concerns). See the docs for more details.

🎉 Highlights

New to this release, many improvements have been made to make importing recipes more reliable. Mealie does a better job of looking like a real browser, rotates between several browser signatures, and retries more intelligently when a site pushes back. This works out of the box, with no configuration.

For sites sitting behind extra bot protection (such as Cloudflare) server admins have two additional controls:

• Proxy support, which routes recipe and image requests through a proxy. This helps with sites that block your server's IP address.
• FlareSolverr support, which hands the page to a real headless browser as a last resort. This helps with challenges that Mealie can't get past on its own.

Both require additional configuration to work. Mealie does not ship or manage either one. You supply the proxy, and host FlareSolverr yourself (it runs nicely as a sidecar container). See the configuration docs for the settings, setup details, and an example compose file.

✨ New features

• feat: Improve scraper resiliency and add both proxy and FlareSolverr support @michael-genson (#7953)
• feat: Add feedback for bad JSON in HTML-JSON page @michael-genson (#7956)
• feat: Announce OIDC email change and announce new scraper capabilities @michael-genson (#7963)

🐛 Bug fixes

• fix: Clear InputLabelType item-id as null instead of empty string @lehnerpat (#7950)

🧰 Maintenance

5 changes

• chore(l10n): New Crowdin updates @hay-kot (#7943)
• chore(l10n): New Crowdin updates @hay-kot (#7945)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7948)
• chore(l10n): New Crowdin updates @hay-kot (#7952)
• chore(l10n): New Crowdin updates @hay-kot (#7960)

🔨 Internal development

• dev: Update front end unit test dependencies @miah120 (#7949)

⬆️ Dependency updates

5 changes

• chore(deps): update dependency js-yaml to v5.2.2 [security] @renovate[bot] (#7951)
• chore(deps): update dependency pre-commit to v4.6.1 @renovate[bot] (#7955)
• chore(deps): lock file maintenance @renovate[bot] (#7958)
• fix(deps): update dependency pillow-heif to v1.5.0 @renovate[bot] (#7959)
• fix(deps): update dependency openai to v2.47.0 @renovate[bot] (#7962)

🍴🍴🍴🍴🍴🍴

Original source

This release brings a couple new features and a slew of bug fixes.

New features

• feat: Added sitewide statistics @Choromanski (#7322)
• feat: ui fixes & backup link on onboarding screen @p0lycarpio (#7743)
• feat: floating save button when editing recipe @DeepReef11 (#7320)

Bug fixes

• fix: Manually implement nltk.downloader using cURL @michael-genson (#7817)
• fix: clear cached recipe actions on logout to prevent cross-user leak @shved270189 (#7815)
• fix: shopping list UI improvements @p0lycarpio (#7215)
• fix: Fix embedded tokens not persisting across sessions @michael-genson (#7860)
• fix: re-enable automatic merges with crowding CI @hay-kot (#7886)
• fix: preserve deep link when redirecting to login @henricook (#7876)
• fix: truncate scraped recipe slug to filesystem-safe length @TowyTowy (#7862)
• fix: handle IntegrityError with 409 conflict response @gitolicious (#7712)
• fix: prevent empty bulk add from clearing import URLs @ft4453080 (#7820)
• fix: wrap long words in timeline to prevent horizontal scroll @shved270189 (#7819)
• fix: scope bulk update/delete repository methods to caller's group/household @hay-kot (#7899)
• fix: harden LDAP and OIDC authentication providers @hay-kot (#7902)
• fix: restrict user ratings and favorites reads to the requesting user @hay-kot (#7903)
• fix: Fix flaky ratings on mobile @michael-genson (#7916)
• fix: Simplify rating logic @michael-genson (#7918)
• fix: New Asset dialog Type dropdown broken by Vuetify 4.1.2 item slot… @bferd (#7931)
• fix: Replace shadowed ref var name when adding recipe to shopping list @michael-genson (#7937)

Maintenance

20 changes

• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7818)
• chore(l10n): New Crowdin updates @hay-kot (#7805)
• chore(l10n): New Crowdin updates @hay-kot (#7824)
• chore(l10n): New Crowdin updates @hay-kot (#7836)
• chore(l10n): New Crowdin updates @hay-kot (#7837)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7842)
• chore(l10n): New Crowdin updates @hay-kot (#7839)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7870)
• chore(l10n): New Crowdin updates @hay-kot (#7853)
• chore(l10n): New Crowdin updates @hay-kot (#7871)
• chore(l10n): New Crowdin updates @hay-kot (#7891)
• chore(l10n): New Crowdin updates @hay-kot (#7894)
• chore(l10n): New Crowdin updates @hay-kot (#7904)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7906)
• chore(l10n): New Crowdin updates @hay-kot (#7908)
• chore(l10n): New Crowdin updates @hay-kot (#7911)
• chore(l10n): New Crowdin updates @hay-kot (#7915)
• chore(l10n): New Crowdin updates @hay-kot (#7920)
• chore(l10n): New Crowdin updates @hay-kot (#7923)
• chore(l10n): New Crowdin updates @hay-kot (#7930)

Documentation

• docs: clarify manage and organize permissions @archit-goyal (#7823)

Internal development

• dev: Skip template check on Crowdin PRs @michael-genson (#7854)
• dev: Add GH CLI to devcontainer @michael-genson (#7857)

Dependency updates

39 changes

• chore(deps): remove unused aiofiles dependency @lukehsiao (#7872)
• chore(deps): update nltk to 3.10.0 @hay-kot (#7901)
• chore(deps): update dependency coverage to v7.14.3 @renovate[bot] (#7816)
• chore(deps): lock file maintenance @renovate[bot] (#7822)
• chore(deps): update dependency ruff to v0.15.19 @renovate[bot] (#7821)
• fix(deps): update dependency openai to v2.44.0 @renovate[bot] (#7830)
• chore(deps): update dependency ruff to v0.15.20 @renovate[bot] (#7832)
• fix(deps): update dependency alembic to v1.18.5 @renovate[bot] (#7833)
• fix(deps): update dependency fastapi to v0.138.1 @renovate[bot] (#7834)
• fix(deps): update dependency fastapi to v0.138.2 @renovate[bot] (#7841)
• chore(deps): lock file maintenance @renovate[bot] (#7846)
• fix(deps): update dependency pillow to v12.3.0 @renovate[bot] (#7848)
• fix(deps): update dependency fastapi to v0.139.0 @renovate[bot] (#7849)
• chore(deps): update dependency coverage to v7.15.0 @renovate[bot] (#7855)
• fix(deps): update dependency typing-extensions to v4.16.0 @renovate[bot] (#7856)
• chore(deps): update node.js to 392e1e2 @renovate[bot] (#7858)
• fix(deps): update dependency uvicorn to v0.50.0 @renovate[bot] (#7861)
• chore(deps): update dependency setuptools to v83 @renovate[bot] (#7865)
• fix(deps): update dependency apprise to v1.12.0 @renovate[bot] (#7864)
• fix(deps): update dependency yt-dlp to v2026.7.4 @renovate[bot] (#7866)
• fix(deps): update dependency uvicorn to v0.50.1 @renovate[bot] (#7867)
• fix(deps): update dependency uvicorn to v0.50.2 @renovate[bot] (#7868)
• chore(deps): lock file maintenance @renovate[bot] (#7874)
• chore(deps): update dependency mypy to v2.2.0 @renovate[bot] (#7873)
• fix(deps): update dependency uvicorn to v0.51.0 @renovate[bot] (#7875)
• chore(deps): update node.js to d5adb04 @renovate[bot] (#7878)
• fix(deps): update dependency openai to v2.45.0 @renovate[bot] (#7882)
• chore(deps): update dependency ruff to v0.15.21 @renovate[bot] (#7884)
• chore(deps): update node.js to 5711a0d @renovate[bot] (#7883)
• fix(deps): update dependency tzdata to v2026.3 @renovate[bot] (#7887)
• chore(deps): update dependency types-requests to v2.33.0.20260712 @renovate[bot] (#7889)
• chore(deps): update dependency coverage to v7.15.1 @renovate[bot] (#7892)
• chore(deps): update dependency mypy to v2.3.0 @renovate[bot] (#7898)
• chore(deps): lock file maintenance @renovate[bot] (#7913)
• chore(deps): update dependency coverage to v7.15.2 @renovate[bot] (#7917)
• chore(deps): update dependency types-python-dateutil to v2.9.0.20260716 @renovate[bot] (#7921)
• fix(deps): update dependency fastapi to v0.139.1 @renovate[bot] (#7922)
• fix(deps): update dependency fastapi to v0.139.2 @renovate[bot] (#7927)
• chore(deps): update dependency ruff to v0.15.22 @renovate[bot] (#7926)
• fix(deps): update dependency openai to v2.46.0 @renovate[bot] (#7928)
• chore(deps): update dependency mkdocs-material to v9.7.7 @renovate[bot] (#7932)

New Contributors

• @shved270189 made their first contribution in #7815
• @archit-goyal made their first contribution in #7823
• @lukehsiao made their first contribution in #7872
• @TowyTowy made their first contribution in #7862
• @ft4453080 made their first contribution in #7820
• @bferd made their first contribution in #7931

Original source

Patch release to fix a bug with the number inputs not rendering its value until the value changes.

Bug fixes

fix: Invisible quantities @michael-genson (#7811)

Dependency updates

4 changes

fix(deps): update dependency pydantic-settings to v2.14.2 [security] @renovate[bot] (#7782)

chore(deps): update node.js to fdddfb3 @renovate[bot] (#7803)

fix(deps): update dependency fastapi to v0.138.0 @renovate[bot] (#7806)

chore(deps): update dependency coverage to v7.14.2 @renovate[bot] (#7807)

Original source

New features

feat: Enhanced PR Lint/Validation @Choromanski (#7329)

feat: warn when deleting foods used in recipes @ZacharySchaffter (#7117)

feat: Added version info to backup file @Choromanski (#7416)

Bug fixes

fix: add missing dependencies in package.json @p0lycarpio (#7709)

fix: support CSV/TXT upload and add validation for Plan to Eat import (#6360) @hay-kot (#7622)

fix: harden recipe content against stored XSS (chips, instructions, asset media) @hay-kot (#7719)

fix: default ingredient_references on RecipeInstruction init @alexander-wenzel-dev (#7732)

fix: Upgrade pytest-asyncio @michael-genson (#7746)

fix: refactor cookie settings for Home Assistant i-frame login @cheebreezee (#7741)

fix: Various lint issues @michael-genson (#7766)

fix: send default_headers with curl_cffi impersonation (fixes 403 on WAF sites) @xenoputtss (#7792)

Maintenance

11 changes

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7713)

chore: add 5-day dependency cooling period for supply-chain hardening @hay-kot (#7718)

chore: drop unused python dependencies aniso8601 and appdirs @hay-kot (#7717)

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7734)

chore(l10n): New Crowdin updates @hay-kot (#7747)

chore(l10n): New Crowdin updates @hay-kot (#7749)

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7757)

chore(l10n): New Crowdin updates @hay-kot (#7756)

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7784)

chore(l10n): New Crowdin updates @hay-kot (#7765)

chore(l10n): New Crowdin updates @hay-kot (#7791)

Documentation

docs: fix broken link to backend configuration in AI providers page @BuildmodeOne (#7793)

Internal development

dev: Improve support for front end unit tests @miah120 (#7163)

Dependency updates

30 changes

chore(deps): update dependency pytest-asyncio to v1.4.0 @renovate[bot] (#7694)

chore(deps): update dependency vitest to v4 [security] @renovate[bot] (#7723)

chore(deps): lock file maintenance @renovate[bot] (#7742)

fix(deps): update dependency python-multipart to v0.0.32 @renovate[bot] (#7729)

fix(deps): update dependency apprise to v1.11.0 @renovate[bot] (#7728)

fix(deps): update dependency uvicorn to v0.49.0 @renovate[bot] (#7744)

chore(deps): update dependency ruff to v0.15.16 @renovate[bot] (#7726)

fix(deps): update dependency openai to v2.41.0 @renovate[bot] (#7733)

chore(deps): update node.js to 9c1d881 @renovate[bot] (#7748)

chore(deps): update node.js to 40ad9f3 @renovate[bot] (#7752)

fix(deps): update dependency beautifulsoup4 to v4.15.0 @renovate[bot] (#7753)

chore(deps): lock file maintenance @renovate[bot] (#7759)

fix(deps): update dependency yt-dlp to v2026.6.9 @renovate[bot] (#7758)

fix(deps): update dependency openai to v2.41.1 @renovate[bot] (#7761)

fix(deps): update dependency pillow-heif to v1.4.0 @renovate[bot] (#7762)

chore(deps): update dependency ruff to v0.15.17 @renovate[bot] (#7763)

chore(deps): update dependency dompurify to v3.4.11 [security] @renovate[bot] (#7772)

chore(deps): update node.js to 032e78d @renovate[bot] (#7773)

chore(deps): update dependency pytest to v9.1.0 @renovate[bot] (#7776)

chore(deps): update dependency pylint to v4.0.6 @renovate[bot] (#7777)

fix(deps): update dependency fastapi to v0.137.1 @renovate[bot] (#7778)

fix(deps): update dependency sqlalchemy to v2.0.51 @renovate[bot] (#7783)

chore(deps): lock file maintenance @renovate[bot] (#7788)

fix(deps): update dependency openai to v2.42.0 @renovate[bot] (#7787)

fix(deps): update dependency openai to v2.43.0 @renovate[bot] (#7794)

fix(deps): update dependency fastapi to v0.137.2 @renovate[bot] (#7796)

chore(deps): update dependency ruff to v0.15.18 @renovate[bot] (#7797)

chore(deps): update node.js to 012c19a @renovate[bot] (#7799)

chore(deps): update node.js to 733e1c0 @renovate[bot] (#7800)

chore(deps): update dependency pytest to v9.1.1 @renovate[bot] (#7801)

New Contributors

@alexander-wenzel-dev made their first contribution in #7732

@cheebreezee made their first contribution in #7741

@xenoputtss made their first contribution in #7792

@BuildmodeOne made their first contribution in #7793

Original source

This release contains a fix for users with an empty .secret file not being able to log-in with local auth. Your .secret file will be regenerated with a valid value. Note that this will invalidate existing tokens, including API keys.

Bug fixes

• fix: Ensure secret key is not empty @michael-genson (#7701)

Internal development

• dev: Set renovarte bot PRs to "immediate" @michael-genson (#7690)

Dependency updates

6 changes

• fix(deps): update dependency fastapi to v0.136.3 @renovate[bot] (#7692)
• chore(deps): update dependency coverage to v7.14.1 @renovate[bot] (#7691)
• fix(deps): update dependency uvicorn to v0.48.0 @renovate[bot] (#7696)
• fix(deps): update dependency sqlalchemy to v2.0.50 @renovate[bot] (#7693)
• fix(deps): update dependency ingredient-parser-nlp to v2.7.0 @renovate[bot] (#7695)
• chore(deps): lock file maintenance @renovate[bot] (#7697)

Original source

🍴🍴🍴🍴🍴🍴

This update fixes a bug with recipe actions not loading. Also included are several dependency updates.

Bug fixes

fix: Make most recipe action columns filterable @michael-genson (#7689)

Maintenance

chore(l10n): New Crowdin updates @hay-kot (#7660)

chore(l10n): New Crowdin updates @hay-kot (#7661)

chore(l10n): New Crowdin updates @hay-kot (#7687)

Internal development

dev: Disable approvals for lockfile maintenance PR creation @michael-genson (#7666)

Dependency updates

19 changes

chore(deps): update dependency nuxt to v4.4.6 [security] @renovate[bot] (#7667)

chore(deps): update dependency types-pyyaml to v6.0.12.20260518 @renovate[bot] (#7670)

fix(deps): update dependency pydantic-settings to v2.14.1 @renovate[bot] (#7674)

fix(deps): update dependency lxml to v6.1.1 @renovate[bot] (#7679)

fix(deps): update dependency python-multipart to v0.0.29 @renovate[bot] (#7675)

fix(deps): update dependency uvicorn to v0.47.0 @renovate[bot] (#7684)

fix(deps): update dependency requests to v2.34.2 @renovate[bot] (#7683)

chore(deps): update dependency coverage to v7.14.0 @renovate[bot] (#7676)

chore(deps): update dependency mypy to v2.1.0 @renovate[bot] (#7681)

fix(deps): update dependency pyjwt to v2.13.0 @renovate[bot] (#7682)

chore(deps): lock file maintenance @renovate[bot] (#7685)

fix(deps): update dependency pydantic to v2.13.4 @renovate[bot] (#7673)

chore(deps): update node.js to 8530f76 @renovate[bot] (#7668)

fix(deps): update dependency openai to v2.38.0 @renovate[bot] (#7677)

chore(deps): update dependency types-requests to v2.33.0.20260518 @renovate[bot] (#7671)

chore(deps): update dependency types-python-dateutil to v2.9.0.20260518 @renovate[bot] (#7669)

fix(deps): update dependency orjson to v3.11.9 @renovate[bot] (#7672)

fix(deps): update dependency python-ldap to v3.4.7 @renovate[bot] (#7680)

chore(deps): update dependency ruff to v0.15.14 @renovate[bot] (#7678)

🍴🍴🍴🍴🍴🍴

Original source

❗❗❗This release contains important security fixes in the query filter API. For more information, see: #7629

Highlights

This release adds more flexible, in-app management of AI providers. You can now add multiple AI providers for different tasks (e.g. one provider for general use, and one provider for importing recipes from videos). These providers can be mixed between completely unrelated services (e.g. OpenAI, Azure, locally-hosted via Ollama, etc.).

Existing settings configured via environment variables (e.g. OPENAI_API_KEY) will automatically be imported one time upon upgrading your instance. For more information, check out the PR or the in-app announcement!

New features

• feat: In-app AI Provider Configuration @michael-genson (#7650)

Bug fixes

• fix: Inconsistent "from an image" vs "from images" translation @michael-genson (#7642)
• fix: Protect sensitive data in query filter API (GHSA-8m57-7cv5-rjp8) @michael-genson (#7629)
• fix: enforce organize-group-data permission on food/tag/category mutations @hay-kot (#7651)
• fix: Prevent swiping AND scrolling on shopping list @michael-genson (#7659)

Maintenance

6 changes

• chore(l10n): New Crowdin updates @hay-kot (#7643)
• chore(l10n): New Crowdin updates @hay-kot (#7646)
• chore(l10n): New Crowdin updates @hay-kot (#7649)
• chore(l10n): New Crowdin updates @hay-kot (#7652)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7655)
• chore(l10n): New Crowdin updates @hay-kot (#7653)

Original source

🍴🍴🍴🍴🍴🍴

✨ New features

• feat: Improve new shopping list UI @michael-genson (#7600)
• feat: Remember screen lock preference @michael-genson (#7609)

🐛 Bug fixes

• fix: Query Filter Builder "Advanced" bug @michael-genson (#7599)
• fix: make PWA share target functional on Android Chrome @zdenek-stursa (#7468)
• fix: redirect to login and validate input on password reset flow @zdenek-stursa (#7521)
• fix: Update backend normalization to match search normalization logic @michael-genson (#7603)
• fix: Update OpenAI recipe parse prompt to return the same number of ingredients as given @michael-genson (#7604)
• fix: redirect to new slug URL after recipe rename @zdenek-stursa (#7522)
• fix: prevent double-scaling of sub-recipe ingredients in shopping list @zdenek-stursa (#7537)
• fix: Infinite API request loop on empty stores @michael-genson (#7613)
• fix: downgrade OIDC missing-claims log from ERROR to DEBUG (#6801) @hay-kot (#7620)
• fix: use locale for Recipe Created timeline event (#4497) @hay-kot (#7623)
• fix: block scriptable asset extensions and force Content-Disposition: attachment (GHSA-gfwc-pjx4-mg9p) @hay-kot (#7626)
• fix: enforce ownership check on recipe deletion (GHSA-x5v9-9jvh-7c7q) @hay-kot (#7625)

🧰 Maintenance

8 changes

• chore(l10n): New Crowdin updates @hay-kot (#7571)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7595)
• chore(l10n): New Crowdin updates @hay-kot (#7589)
• chore(l10n): New Crowdin updates @hay-kot (#7605)
• chore(l10n): New Crowdin updates @hay-kot (#7608)
• chore: update SECURITY.md for GitHub private vulnerability reporting @hay-kot (#7612)
• chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7637)
• chore(l10n): New Crowdin updates @hay-kot (#7617)

⬆️ Dependency updates

7 changes

• chore(deps): update dependency mypy to v2 @renovate[bot] (#7584)
• chore(deps): update dependency types-requests to v2.33.0.20260503 @renovate[bot] (#7587)
• chore(deps): update node.js to 34f0eb9 @renovate[bot] (#7590)
• chore(deps): update node.js to 050bf2b @renovate[bot] (#7592)
• fix(deps): update dependency authlib to v1.7.1 @renovate[bot] (#7593)
• fix(deps): update dependency openai to v2.34.0 @renovate[bot] (#7594)
• fix(deps): update dependency authlib to v1.7.2 @renovate[bot] (#7606)

🍴🍴🍴🍴🍴🍴

Original source

🎉 Highlights

The shopping list experience has been improved, especially for mobile users, including:

a new create menu for new items

swipe controls to check off an item (for mobile users)

✨ New features

feat: Improve add shopping list item form @miah120 (#7091)

feat: Shopping list / Swipe to check off @miah120 (#7118)

🐛 Bug fixes

fix: prevent delete-image dialog from reopening in a loop inside v-menu @zdenek-stursa (#7469)

fix: use correct title and icon on Recipe Actions data page @zdenek-stursa (#7498)

fix: Allow user-configurable OIDC timeout @t0xicCode (#7496)

fix: pressing Enter in dialogs now confirms instead of silently closing @zdenek-stursa (#7503)

fix: add missing search bar to Recipe Data management page @zdenek-stursa (#7504)

fix: Don't hit authenticated endpoints when logged out @garlic-hub (#7563)

fix: restore create-item button in recipe dropdowns (categories, tags, tools) @zdenek-stursa (#7564)

fix: Adjust ingredient section spacing @michael-genson (#7580)

🧰 Maintenance

13 changes

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7497)

chore(l10n): New Crowdin updates @hay-kot (#7500)

chore(l10n): New Crowdin updates @hay-kot (#7502)

chore(l10n): New Crowdin updates @hay-kot (#7506)

chore(l10n): New Crowdin updates @hay-kot (#7509)

chore(l10n): New Crowdin updates @hay-kot (#7515)

chore(l10n): New Crowdin updates @hay-kot (#7523)

chore(l10n): New Crowdin updates @hay-kot (#7526)

chore(l10n): New Crowdin updates @hay-kot (#7536)

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7541)

chore(l10n): New Crowdin updates @hay-kot (#7546)

chore(l10n): Crowdin locale sync @mealie-actions[bot] (#7569)

chore(l10n): New Crowdin updates @hay-kot (#7558)

📚 Documentation

docs: Update recipe creation docs @michael-genson (#7494)

docs: Enhance BASE_URL description in backend config @BadCo-NZ (#7449)

docs: document necessity of forwarded-allow-ips with OIDC behind reverse-proxy https in oidc-v2.md @aristaeus (#7424)

⬆️ Dependency updates

26 changes

chore(deps): update dependency mypy to v1.20.1 @renovate[bot] (#7490)

fix(deps): update dependency pydantic to v2.13.0 @renovate[bot] (#7492)

fix(deps): update dependency pydantic to v2.13.1 @renovate[bot] (#7505)

fix(deps): update dependency openai to v2.32.0 @renovate[bot] (#7507)

fix(deps): update dependency fastapi to v0.136.0 @renovate[bot] (#7511)

chore(deps): update dependency ruff to v0.15.11 @renovate[bot] (#7514)

fix(deps): update dependency lxml to v6.1.0 [security] @renovate[bot] (#7513)

chore(deps): update node.js to 807109d @renovate[bot] (#7516)

fix(deps): update dependency pydantic to v2.13.2 @renovate[bot] (#7517)

chore(deps): update node.js to 91447bc @renovate[bot] (#7519)

chore(deps): update node.js to e989123 @renovate[bot] (#7520)

fix(deps): update dependency authlib to v1.7.0 @renovate[bot] (#7525)

fix(deps): update dependency pydantic to v2.13.3 @renovate[bot] (#7533)

fix(deps): update dependency psycopg2-binary to v2.9.12 @renovate[bot] (#7539)

fix(deps): update dependency uvicorn to v0.45.0 @renovate[bot] (#7543)

chore(deps): update dependency mypy to v1.20.2 @renovate[bot] (#7544)

chore(deps): update dependency pre-commit to v4.6.0 @renovate[bot] (#7547)

fix(deps): update dependency uvicorn to v0.46.0 @renovate[bot] (#7553)

fix(deps): update dependency fastapi to v0.136.1 @renovate[bot] (#7556)

chore(deps): update dependency ruff to v0.15.12 @renovate[bot] (#7559)

fix(deps): update dependency tzdata to v2026.2 @renovate[bot] (#7560)

fix(deps): update dependency apprise to v1.10.0 @renovate[bot] (#7566)

fix(deps): update dependency python-multipart to v0.0.27 @renovate[bot] (#7567)

fix(deps): update dependency openai to v2.33.0 @renovate[bot] (#7570)

fix(deps): update dependency pydantic-settings to v2.14.0 @renovate[bot] (#7534)

chore(deps): update dependency axios to v1.15.2 [security] @renovate[bot] (#7579)

🙏 New Contributors

@BadCo-NZ made their first contribution in #7449

@aristaeus made their first contribution in #7424

@garlic-hub made their first contribution in #7563

Original source

This release contains a few fixes, and migrates our PWA manifest to the backend. Among other things, this fixes a bug with the PWA where it doesn't respect your custom theme color if you have it set.

New features

• feat: Migrate PWA manifest to backend @Choromanski (#7331)

Bug fixes

• fix: Blank query filter builder fields @michael-genson (#7480)
• fix: preserve ingredient section titles when parsing recipe ingredients @zdenek-stursa (#7483)
• fix: Misc frontend layout fixes @michael-genson (#7487)

Maintenance

• chore: Update yarn deps @michael-genson (#7486)

Documentation

• docs: Added copy button to codeblocks @Choromanski (#7343)

Internal development

• dev: Enable lockfile maintenance and update deps @michael-genson (#7484)

Dependency updates

• chore(deps): update node.js to 33cf7f0 @renovate[bot] (#7478)
• fix(deps): update dependency authlib to v1.6.11 [security] @renovate[bot] (#7481)
• fix(deps): update dependency lxml to v6.0.4 @renovate[bot] (#7485)

New Contributors

@zdenek-stursa made their first contribution in #7483

Original source