Welcome to the latest release of Mealie! We have tons of new features packed into this one, as well as a large collection of bug fixes. Check them out below 👇
🚨 BREAKING CHANGE
Mealie now checks where its own outgoing requests are going. Anything the server fetches on your behalf, such as importing a recipe from a URL, downloading a recipe image, sending a webhook, or running a recipe action, is only allowed to reach addresses on the public internet.
Webhooks and recipe actions were not checked before, and the checks on recipe imports were narrower than they are now. If any of these pointed at something on your own network, they will stop working after this update.
If you need a target on your own network to keep working, allow it explicitly with HTTP_ALLOW_LIST, which accepts hostnames or CIDRs. To keep a Tailscale host reachable, for example:
This release comes with an overhaul to Mealie's internal auth, making it more inline with what you generally expect, specifically with "Remember Me" and TOKEN_TIME.
Tokens now refresh automatically before they expire. As long as you use the app before your token expires, it will automatically be refreshed with a new token. What this means for users is that you won't be logged-out mid-session, and you shouldn't have to log-in periodically unless you haven't used the app in some time (see TOKEN_TIME changes).
Once you close your tab/browser/session, you will be logged-out. To stay logged-in between sessions, check "Remember Me" when logging in. Since this is the opposite behavior of how logins worked before this change, "Remember Me" is checked by default to help ease the learning curve.
TOKEN_TIME now defines how long a session will last before expiring. Many instances previously set this value arbitrarily high to prevent users from being logged-out. Now with auto-refresh this is unnecessary, and can be substantially lowered (we recommend turning this down to at most 168 hours, i.e. one week).
⚠️⚠️⚠️ IMPORTANT BREAKING CHANGE FOR APP DEVELOPERS ⚠️⚠️⚠️
GET /api/auth/refresh has been removed, and is instead now a POST API.
🎉 Highlights
Overhauled internal auth (see above)
You can now delete unused organizers from the data management page
You can now leverage a recipe's rating in meal plan rules, cookbooks, and the recipe finder
Clicking on a recipe's image or asset will show the the fully expanded image
The Meal Planner UI has been reworked to make it easier to use
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [ghcr.io/mealie-recipes/mealie](https://github.com/mealie-recipes/mealie) | minor | `v3.24.0` → `v3.26.0` |
---
### Release Notes
<details>
<summary>mealie-recipes/mealie (ghcr.io/mealie-recipes/mealie)</summary>
### [`v3.26.0`](https://github.com/mealie-recipes/mealie/releases/tag/v3.26.0)
[Compare Source](https://github.com/mealie-recipes/mealie/compare/v3.25.1...v3.26.0)
### 🍴🍴🍴🍴🍴🍴
Welcome to the latest release of Mealie! We have tons of new features packed into this one, as well as a large collection of bug fixes. Check them out below 👇
##### 🚨 BREAKING CHANGE
Mealie now checks where its own outgoing requests are going. Anything the server fetches on your behalf, such as importing a recipe from a URL, downloading a recipe image, sending a webhook, or running a recipe action, is only allowed to reach addresses on the public internet.
Webhooks and recipe actions were not checked before, and the checks on recipe imports were narrower than they are now. If any of these pointed at something on your own network, they will stop working after this update.
If you need a target on your own network to keep working, allow it explicitly with `HTTP_ALLOW_LIST`, which accepts hostnames or CIDRs. To keep a Tailscale host reachable, for example:
```
HTTP_ALLOW_LIST=100.64.0.0/10
```
For more information, [check out the docs](https://docs.mealie.io/documentation/getting-started/installation/backend-config/#security) and the in-app announcement.
#### 🎉 Highlights
You can now add substitutions to your ingredients. We support two kinds of substitutions:
##### Recipe-specific substitutions:
<img width="486" height="182" alt="image" src="https://github.com/user-attachments/assets/dd005f62-3dc3-42c3-87ba-0250e6ca39cd" />
<img width="971" height="246" alt="image" src="https://github.com/user-attachments/assets/0fdefb2b-a91e-42c0-a293-742518446a96" />
##### Common substitutions (not tied to specific recipe, edited on the data management page):
<img width="449" height="148" alt="image" src="https://github.com/user-attachments/assets/0da29c8e-7808-443f-b27e-a6e4cd1fb951" />
<img width="545" height="385" alt="image" src="https://github.com/user-attachments/assets/59b66069-e361-404d-ae44-0f63b94a1b99" />
Substitutions are (optionally) considered in the recipe finder, too! <img width="438" height="335" alt="image" src="https://github.com/user-attachments/assets/470557f0-5dd8-4546-a624-c8f63204de2b" />
***
You can now link recipe notes to individual steps: <img width="990" height="229" alt="image" src="https://github.com/user-attachments/assets/b26e51ad-b696-4a2e-94d6-b66b8d31952c" /> <img width="1389" height="587" alt="image" src="https://github.com/user-attachments/assets/2dc5087f-8890-4109-bcd8-661cda888ff8" />
#### 🚨 Breaking changes
- fix: harden server-initiated HTTP against SSRF and DNS rebinding [@​hay-kot](https://github.com/hay-kot) ([#​7914](https://github.com/mealie-recipes/mealie/issues/7914))
#### ✨ New features
- feat: use OIDC avatars [@​doenke](https://github.com/doenke) ([#​7624](https://github.com/mealie-recipes/mealie/issues/7624))
- feat: Bottom sheets [@​miah120](https://github.com/miah120) ([#​7939](https://github.com/mealie-recipes/mealie/issues/7939))
- feat: ingredient substitutions [@​michael-genson](https://github.com/michael-genson) ([#​8265](https://github.com/mealie-recipes/mealie/issues/8265))
- feat: adjust ingredient spacing [@​michael-genson](https://github.com/michael-genson) ([#​8318](https://github.com/mealie-recipes/mealie/issues/8318))
- feat: pluralize substitutions if main ingredient is pluralized [@​michael-genson](https://github.com/michael-genson) ([#​8317](https://github.com/mealie-recipes/mealie/issues/8317))
- feat: filter meal plan rules by food label [@​Xyolyp](https://github.com/Xyolyp) ([#​8126](https://github.com/mealie-recipes/mealie/issues/8126))
- feat: add recipe note linking to recipe instructions [@​jallier](https://github.com/jallier) ([#​7591](https://github.com/mealie-recipes/mealie/issues/7591))
- feat: Show calendar hint when adding to meal plan [@​miah120](https://github.com/miah120) ([#​8274](https://github.com/mealie-recipes/mealie/issues/8274))
#### 🐛 Bug fixes
- fix: shopping list entry fixes [@​michael-genson](https://github.com/michael-genson) ([#​8280](https://github.com/mealie-recipes/mealie/issues/8280))
- fix: QueryFilter improvements [@​p0lycarpio](https://github.com/p0lycarpio) ([#​8281](https://github.com/mealie-recipes/mealie/issues/8281))
- fix: cascade group deletion to households and recipes [@​derekdiliu](https://github.com/derekdiliu) ([#​8283](https://github.com/mealie-recipes/mealie/issues/8283))
- fix: correct MultiPurposeLabel.foods/shopping\_list\_items relationship cardinality [@​bferd](https://github.com/bferd) ([#​8226](https://github.com/mealie-recipes/mealie/issues/8226))
- fix: update bulk add dialog translations on locale change [@​feilongcheng](https://github.com/feilongcheng) ([#​8097](https://github.com/mealie-recipes/mealie/issues/8097))
- fix: prevent OpenAI ingredient parser from splitting plus quantities [@​roastedTomato](https://github.com/roastedTomato) ([#​8138](https://github.com/mealie-recipes/mealie/issues/8138))
- fix: harden server-initiated HTTP against SSRF and DNS rebinding [@​hay-kot](https://github.com/hay-kot) ([#​7914](https://github.com/mealie-recipes/mealie/issues/7914))
- fix: harden public filtering [@​michael-genson](https://github.com/michael-genson) ([#​8286](https://github.com/mealie-recipes/mealie/issues/8286))
- fix: show progress on ingredient parser review buttons [@​Xyolyp](https://github.com/Xyolyp) ([#​8172](https://github.com/mealie-recipes/mealie/issues/8172))
- fix: import Recipe Keeper categories and yields [@​henry1113nz](https://github.com/henry1113nz) ([#​8299](https://github.com/mealie-recipes/mealie/issues/8299))
- fix: Allow submenus to be accessed via keyboard and mobile [@​miah120](https://github.com/miah120) ([#​8300](https://github.com/mealie-recipes/mealie/issues/8300))
- fix: coerce null food/unit description to empty string [@​chiliec](https://github.com/chiliec) ([#​8309](https://github.com/mealie-recipes/mealie/issues/8309))
- fix: filter related fields with EXISTS instead of joins [@​derekdiliu](https://github.com/derekdiliu) ([#​8297](https://github.com/mealie-recipes/mealie/issues/8297))
- fix: substitution recipe ref handling [@​michael-genson](https://github.com/michael-genson) ([#​8311](https://github.com/mealie-recipes/mealie/issues/8311))
- fix: inconsistent token usage [@​michael-genson](https://github.com/michael-genson) ([#​8314](https://github.com/mealie-recipes/mealie/issues/8314))
- fix: fix missing images / keep recipes.image in sync with the images on disk [@​ImanuelBertrand](https://github.com/ImanuelBertrand) ([#​8276](https://github.com/mealie-recipes/mealie/issues/8276))
- fix: ignore blank Paprika ingredient lines [@​justadityaraj](https://github.com/justadityaraj) ([#​8213](https://github.com/mealie-recipes/mealie/issues/8213))
- fix: ingredient note spacing with swap icon [@​michael-genson](https://github.com/michael-genson) ([#​8315](https://github.com/mealie-recipes/mealie/issues/8315))
- fix: pin pnpm version for corepack [@​roastedTomato](https://github.com/roastedTomato) ([#​8322](https://github.com/mealie-recipes/mealie/issues/8322))
- fix: prevent random sort click-through [@​YibingZhang325](https://github.com/YibingZhang325) ([#​8325](https://github.com/mealie-recipes/mealie/issues/8325))
- fix: update recipe creation page translations on locale change [@​feilongcheng](https://github.com/feilongcheng) ([#​8273](https://github.com/mealie-recipes/mealie/issues/8273))
- fix: wrap long URLs in recipe card descriptions [@​feilongcheng](https://github.com/feilongcheng) ([#​8330](https://github.com/mealie-recipes/mealie/issues/8330))
- fix: auto\_init merges model\_config.exclude with default {"id"} instead of replacing it [@​blue-mtn-dog](https://github.com/blue-mtn-dog) ([#​8336](https://github.com/mealie-recipes/mealie/issues/8336))
- fix: fix notifier UI form reactivity [@​michael-genson](https://github.com/michael-genson) ([#​8341](https://github.com/mealie-recipes/mealie/issues/8341))
- fix: preserve recipe ingredient navigation state [@​roastedTomato](https://github.com/roastedTomato) ([#​8323](https://github.com/mealie-recipes/mealie/issues/8323))
- fix: apply a submitted API key when updating an AI provider [@​adman234](https://github.com/adman234) ([#​8344](https://github.com/mealie-recipes/mealie/issues/8344))
- fix: remove stacked variant on number inputs [@​p0lycarpio](https://github.com/p0lycarpio) ([#​8359](https://github.com/mealie-recipes/mealie/issues/8359))
- fix: prevent creating shopping lists with empty names and disable submit button [@​Luna-81](https://github.com/Luna-81) ([#​8363](https://github.com/mealie-recipes/mealie/issues/8363))
- fix: aggregate to-many orderings instead of joining [@​derekdiliu](https://github.com/derekdiliu) ([#​8332](https://github.com/mealie-recipes/mealie/issues/8332))
- fix: don't default to the English-only parser in other languages [@​Xyolyp](https://github.com/Xyolyp) ([#​8173](https://github.com/mealie-recipes/mealie/issues/8173))
- fix: return a 422 instead of a 500 when a recipe PUT omits the name [@​henry1113nz](https://github.com/henry1113nz) ([#​8298](https://github.com/mealie-recipes/mealie/issues/8298))
- fix: rescue markdown-fenced responses when a provider ignores strict schema output [@​lcs-crr](https://github.com/lcs-crr) ([#​8133](https://github.com/mealie-recipes/mealie/issues/8133))
- fix: Show permission error ,when food creation fails [@​Luna-81](https://github.com/Luna-81) ([#​8370](https://github.com/mealie-recipes/mealie/issues/8370))
- fix: webhooks dont fire around midnight [@​michael-genson](https://github.com/michael-genson) ([#​8379](https://github.com/mealie-recipes/mealie/issues/8379))
- fix: Add permission checks for Group & Household members, hide totalUsers card for non-managers [@​Luna-81](https://github.com/Luna-81) ([#​8348](https://github.com/mealie-recipes/mealie/issues/8348))
#### 🧰 Maintenance
<details>
<summary>14 changes</summary>
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8287](https://github.com/mealie-recipes/mealie/issues/8287))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8304](https://github.com/mealie-recipes/mealie/issues/8304))
- chore(l10n): Crowdin locale sync @​[mealie-actions\[bot\]](https://github.com/apps/mealie-actions) ([#​8305](https://github.com/mealie-recipes/mealie/issues/8305))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8307](https://github.com/mealie-recipes/mealie/issues/8307))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8316](https://github.com/mealie-recipes/mealie/issues/8316))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8328](https://github.com/mealie-recipes/mealie/issues/8328))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8335](https://github.com/mealie-recipes/mealie/issues/8335))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8340](https://github.com/mealie-recipes/mealie/issues/8340))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8347](https://github.com/mealie-recipes/mealie/issues/8347))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8371](https://github.com/mealie-recipes/mealie/issues/8371))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8374](https://github.com/mealie-recipes/mealie/issues/8374))
- chore(l10n): Crowdin locale sync @​[mealie-actions\[bot\]](https://github.com/apps/mealie-actions) ([#​8380](https://github.com/mealie-recipes/mealie/issues/8380))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8381](https://github.com/mealie-recipes/mealie/issues/8381))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8386](https://github.com/mealie-recipes/mealie/issues/8386))
</details>
#### 📚 Documentation
- docs: clarify secondary theme color usage [@​nzyz995](https://github.com/nzyz995) ([#​8310](https://github.com/mealie-recipes/mealie/issues/8310))
#### 🔨 Internal development
- dev: add docker-in-docker to dev container [@​michael-genson](https://github.com/michael-genson) ([#​8303](https://github.com/mealie-recipes/mealie/issues/8303))
- dev: publish more logs for OIDC E2E error [@​michael-genson](https://github.com/michael-genson) ([#​8313](https://github.com/mealie-recipes/mealie/issues/8313))
#### ⬆️ Dependency updates
<details>
<summary>14 changes</summary>
- fix(deps): update dependency authlib to v1.8.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8284](https://github.com/mealie-recipes/mealie/issues/8284))
- fix(deps): update dependency rapidfuzz to v3.14.6 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8288](https://github.com/mealie-recipes/mealie/issues/8288))
- fix(deps): update dependency apprise to v1.13.1 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8291](https://github.com/mealie-recipes/mealie/issues/8291))
- fix(deps): update dependency pillow-heif to v1.6.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8301](https://github.com/mealie-recipes/mealie/issues/8301))
- fix(deps): update dependency openai to v3.7.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8320](https://github.com/mealie-recipes/mealie/issues/8320))
- fix(deps): update dependency lxml to v6.1.3 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8333](https://github.com/mealie-recipes/mealie/issues/8333))
- chore(deps): update dependency ruff to v0.16.6 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8342](https://github.com/mealie-recipes/mealie/issues/8342))
- fix(deps): update dependency openai to v3.8.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8345](https://github.com/mealie-recipes/mealie/issues/8345))
- fix(deps): update dependency alembic to v1.19.2 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8351](https://github.com/mealie-recipes/mealie/issues/8351))
- chore(deps): update dependency types-requests to v2.33.0.20260906 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8365](https://github.com/mealie-recipes/mealie/issues/8365))
- fix(deps): update dependency pillow-heif to v1.7.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8366](https://github.com/mealie-recipes/mealie/issues/8366))
- fix(deps): update dependency openai to v3.9.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8390](https://github.com/mealie-recipes/mealie/issues/8390))
- fix(deps): update dependency python-slugify to v9 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8391](https://github.com/mealie-recipes/mealie/issues/8391))
- fix(deps): update dependency openai to v3.10.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8394](https://github.com/mealie-recipes/mealie/issues/8394))
</details>
#### 🙏 New Contributors
* @​doenke made their first contribution in https://github.com/mealie-recipes/mealie/pull/7624
* @​roastedTomato made their first contribution in https://github.com/mealie-recipes/mealie/pull/8138
* @​Xyolyp made their first contribution in https://github.com/mealie-recipes/mealie/pull/8172
* @​svathsa21 made their first contribution in https://github.com/mealie-recipes/mealie/pull/8296
* @​blue-mtn-dog made their first contribution in https://github.com/mealie-recipes/mealie/pull/8336
* @​adman234 made their first contribution in https://github.com/mealie-recipes/mealie/pull/8344
* @​jallier made their first contribution in https://github.com/mealie-recipes/mealie/pull/7591
### 🍴🍴🍴🍴🍴🍴
### [`v3.25.1`](https://github.com/mealie-recipes/mealie/releases/tag/v3.25.1)
[Compare Source](https://github.com/mealie-recipes/mealie/compare/v3.25.0...v3.25.1)
### 🍴🍴🍴🍴🍴🍴
Patch release to fix auth issues when embedding Mealie in an iframe.
#### 🐛 Bug fixes
- fix: translate recipe time units according to locale [@​deeumiya-huang](https://github.com/deeumiya-huang) ([#​8268](https://github.com/mealie-recipes/mealie/issues/8268))
- fix: remove unsupported partitioned cookie [@​michael-genson](https://github.com/michael-genson) ([#​8278](https://github.com/mealie-recipes/mealie/issues/8278))
#### 🧰 Maintenance
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8270](https://github.com/mealie-recipes/mealie/issues/8270))
#### ⬆️ Dependency updates
- chore(deps): update dependency coverage to v7.16.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8266](https://github.com/mealie-recipes/mealie/issues/8266))
- fix(deps): update dependency openai to v3.6.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8267](https://github.com/mealie-recipes/mealie/issues/8267))
- chore(deps): update dependency pylint to v4.0.8 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8279](https://github.com/mealie-recipes/mealie/issues/8279))
#### 🙏 New Contributors
- [@​deeumiya-huang](https://github.com/deeumiya-huang) made their first contribution in [#​8268](https://github.com/mealie-recipes/mealie/pull/8268)
### 🍴🍴🍴🍴🍴🍴
### [`v3.25.0`](https://github.com/mealie-recipes/mealie/releases/tag/v3.25.0)
[Compare Source](https://github.com/mealie-recipes/mealie/compare/v3.24.0...v3.25.0)
### 🍴🍴🍴🍴🍴🍴
This release comes with an overhaul to Mealie's internal auth, making it more inline with what you generally expect, specifically with "Remember Me" and `TOKEN_TIME`.
- Tokens now refresh automatically before they expire. As long as you use the app before your token expires, it will automatically be refreshed with a new token. What this means for users is that you won't be logged-out mid-session, and you shouldn't have to log-in periodically unless you haven't used the app in some time (see `TOKEN_TIME` changes).
- Once you close your tab/browser/session, you will be logged-out. To stay logged-in between sessions, check "Remember Me" when logging in. Since this is the *opposite* behavior of how logins worked before this change, "Remember Me" is checked by default to help ease the learning curve.
- `TOKEN_TIME` now defines how long a session will last before expiring. Many instances previously set this value arbitrarily high to prevent users from being logged-out. Now with auto-refresh this is unnecessary, and can be substantially lowered (we recommend turning this down to at most 168 hours, i.e. one week).
##### ⚠️⚠️⚠️ IMPORTANT BREAKING CHANGE FOR APP DEVELOPERS ⚠️⚠️⚠️
`GET /api/auth/refresh` has been removed, and is instead now a `POST` API.
#### 🎉 Highlights
- Overhauled internal auth (see above)
- You can now delete unused organizers from the data management page
- You can now leverage a recipe's rating in meal plan rules, cookbooks, and the recipe finder
- Clicking on a recipe's image or asset will show the the fully expanded image
- The Meal Planner UI has been reworked to make it easier to use
#### 🚨 Breaking changes
- feat: add token refresh, fix remember me, and fix Safari token expiration [@​michael-genson](https://github.com/michael-genson) ([#​8200](https://github.com/mealie-recipes/mealie/issues/8200))
#### ✨ New features
- feat: add token refresh, fix remember me, and fix Safari token expiration [@​michael-genson](https://github.com/michael-genson) ([#​8200](https://github.com/mealie-recipes/mealie/issues/8200))
- feat: organizer improvements — recipeCount, merge endpoint, delete unused UI [@​bferd](https://github.com/bferd) ([#​7829](https://github.com/mealie-recipes/mealie/issues/7829))
- feat: Shopping list focus polishes [@​miah120](https://github.com/miah120) ([#​7890](https://github.com/mealie-recipes/mealie/issues/7890))
- feat: add rating as a query filter field [@​dominikrein](https://github.com/dominikrein) ([#​7966](https://github.com/mealie-recipes/mealie/issues/7966))
- feat: click-to-expand lightbox for recipe hero image and asset images [@​bferd](https://github.com/bferd) ([#​7933](https://github.com/mealie-recipes/mealie/issues/7933))
- feat: improve registration UX by coloring Next button based on form validity [@​Luna-81](https://github.com/Luna-81) ([#​8233](https://github.com/mealie-recipes/mealie/issues/8233))
- feat: Improve recipe parsing ui [@​miah120](https://github.com/miah120) ([#​7984](https://github.com/mealie-recipes/mealie/issues/7984))
- feat: rank exact and prefix matches above substring matches in food search [@​dyllan500](https://github.com/dyllan500) ([#​7781](https://github.com/mealie-recipes/mealie/issues/7781))
- feat: Meal Planner UI Improvements [@​miah120](https://github.com/miah120) ([#​7946](https://github.com/mealie-recipes/mealie/issues/7946))
- feat: add autofocus to RecipeSelector input field [@​torbenvanassche](https://github.com/torbenvanassche) ([#​8262](https://github.com/mealie-recipes/mealie/issues/8262))
#### 🐛 Bug fixes
- fix: fallback to regular HTML if video download fails [@​michael-genson](https://github.com/michael-genson) ([#​8203](https://github.com/mealie-recipes/mealie/issues/8203))
- fix: Improve keyboard navigation of search results [@​mbianucci](https://github.com/mbianucci) ([#​7869](https://github.com/mealie-recipes/mealie/issues/7869))
- fix: allow deleting a user who both rated and favorited a recipe ([#​8121](https://github.com/mealie-recipes/mealie/issues/8121)) [@​chiliec](https://github.com/chiliec) ([#​8131](https://github.com/mealie-recipes/mealie/issues/8131))
- fix: wrap timeline event subjects [@​YibingZhang325](https://github.com/YibingZhang325) ([#​8218](https://github.com/mealie-recipes/mealie/issues/8218))
- fix: Account for on hand items when adding a recipe to a shopping list [@​miah120](https://github.com/miah120) ([#​7912](https://github.com/mealie-recipes/mealie/issues/7912))
- fix: close long-lived token auth transaction [@​stieglma](https://github.com/stieglma) ([#​7897](https://github.com/mealie-recipes/mealie/issues/7897))
- fix: stamp timeline events at request time, not process start [@​alexander-wenzel-dev](https://github.com/alexander-wenzel-dev) ([#​7896](https://github.com/mealie-recipes/mealie/issues/7896))
- fix: repoint shopping list items when merging a food or unit [@​henry1113nz](https://github.com/henry1113nz) ([#​8146](https://github.com/mealie-recipes/mealie/issues/8146))
- fix: parse day- and week-only ISO 8601 durations in recipe time cleaner [@​TowyTowy](https://github.com/TowyTowy) ([#​7895](https://github.com/mealie-recipes/mealie/issues/7895))
- fix: strip trailing footnote markers from parsed ingredient names [@​henry1113nz](https://github.com/henry1113nz) ([#​8145](https://github.com/mealie-recipes/mealie/issues/8145))
- fix: hide "No Label" heading when copying an unlabeled shopping list [@​brent20](https://github.com/brent20) ([#​7905](https://github.com/mealie-recipes/mealie/issues/7905))
- fix: Add bottom padding to prevent fab overlapping content [@​miah120](https://github.com/miah120) ([#​7940](https://github.com/mealie-recipes/mealie/issues/7940))
- fix: resize images before AI import to avoid provider size limits [@​chiliec](https://github.com/chiliec) ([#​8241](https://github.com/mealie-recipes/mealie/issues/8241))
- fix: Keep instruction sticky in ingredient linker [@​miah120](https://github.com/miah120) ([#​7925](https://github.com/mealie-recipes/mealie/issues/7925))
- fix: skip image request when a recipe has no image [@​henry1113nz](https://github.com/henry1113nz) ([#​8075](https://github.com/mealie-recipes/mealie/issues/8075))
- fix: preserve source language in AI recipe parsing [@​x0x0b](https://github.com/x0x0b) ([#​8236](https://github.com/mealie-recipes/mealie/issues/8236))
- fix: refetch organizer data pages on visit to avoid stale data [@​lotusk](https://github.com/lotusk) ([#​8260](https://github.com/mealie-recipes/mealie/issues/8260))
#### 🧰 Maintenance
<details>
<summary>14 changes</summary>
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8171](https://github.com/mealie-recipes/mealie/issues/8171))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8206](https://github.com/mealie-recipes/mealie/issues/8206))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8207](https://github.com/mealie-recipes/mealie/issues/8207))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8212](https://github.com/mealie-recipes/mealie/issues/8212))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8216](https://github.com/mealie-recipes/mealie/issues/8216))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8217](https://github.com/mealie-recipes/mealie/issues/8217))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8219](https://github.com/mealie-recipes/mealie/issues/8219))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8229](https://github.com/mealie-recipes/mealie/issues/8229))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8234](https://github.com/mealie-recipes/mealie/issues/8234))
- chore(l10n): Crowdin locale sync @​[mealie-actions\[bot\]](https://github.com/apps/mealie-actions) ([#​8244](https://github.com/mealie-recipes/mealie/issues/8244))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8237](https://github.com/mealie-recipes/mealie/issues/8237))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8253](https://github.com/mealie-recipes/mealie/issues/8253))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8257](https://github.com/mealie-recipes/mealie/issues/8257))
- chore(l10n): New Crowdin updates [@​hay-kot](https://github.com/hay-kot) ([#​8261](https://github.com/mealie-recipes/mealie/issues/8261))
</details>
#### 📚 Documentation
- docs: Add advice when backup is successful but keeps user logged out [@​qlassalle](https://github.com/qlassalle) ([#​7919](https://github.com/mealie-recipes/mealie/issues/7919))
#### 🔨 Internal development
- dev: don't clobber devEngines.packageManager.version on release bump [@​lotusk](https://github.com/lotusk) ([#​8258](https://github.com/mealie-recipes/mealie/issues/8258))
- dev: fix mangled pnpm version [@​michael-genson](https://github.com/michael-genson) ([#​8264](https://github.com/mealie-recipes/mealie/issues/8264))
#### ⬆️ Dependency updates
<details>
<summary>10 changes</summary>
- fix(deps): update dependency openai to v3.3.1 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8201](https://github.com/mealie-recipes/mealie/issues/8201))
- fix(deps): update dependency yt-dlp to v2026.8.19 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8205](https://github.com/mealie-recipes/mealie/issues/8205))
- fix(deps): update dependency apprise to v1.13.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8208](https://github.com/mealie-recipes/mealie/issues/8208))
- chore(deps): update dependency ruff to v0.16.4 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8211](https://github.com/mealie-recipes/mealie/issues/8211))
- chore(deps): lock file maintenance @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8248](https://github.com/mealie-recipes/mealie/issues/8248))
- fix(deps): update dependency openai to v3.4.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8251](https://github.com/mealie-recipes/mealie/issues/8251))
- fix(deps): update dependency openai to v3.5.0 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8252](https://github.com/mealie-recipes/mealie/issues/8252))
- chore(deps): update dependency ruff to v0.16.5 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8255](https://github.com/mealie-recipes/mealie/issues/8255))
- chore(deps): update node.js to [`be23f54`](https://github.com/mealie-recipes/mealie/commit/be23f54) @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8256](https://github.com/mealie-recipes/mealie/issues/8256))
- fix(deps): update dependency pydantic to v2.13.5 @​[renovate\[bot\]](https://github.com/apps/renovate) ([#​8263](https://github.com/mealie-recipes/mealie/issues/8263))
</details>
#### 🙏 New Contributors
- [@​mbianucci](https://github.com/mbianucci) made their first contribution in [#​7869](https://github.com/mealie-recipes/mealie/pull/7869)
- [@​chiliec](https://github.com/chiliec) made their first contribution in [#​8131](https://github.com/mealie-recipes/mealie/pull/8131)
- [@​YibingZhang325](https://github.com/YibingZhang325) made their first contribution in [#​8218](https://github.com/mealie-recipes/mealie/pull/8218)
- [@​stieglma](https://github.com/stieglma) made their first contribution in [#​7897](https://github.com/mealie-recipes/mealie/pull/7897)
- [@​qlassalle](https://github.com/qlassalle) made their first contribution in [#​7919](https://github.com/mealie-recipes/mealie/pull/7919)
- [@​henry1113nz](https://github.com/henry1113nz) made their first contribution in [#​8146](https://github.com/mealie-recipes/mealie/pull/8146)
- [@​dominikrein](https://github.com/dominikrein) made their first contribution in [#​7966](https://github.com/mealie-recipes/mealie/pull/7966)
- [@​brent20](https://github.com/brent20) made their first contribution in [#​7905](https://github.com/mealie-recipes/mealie/pull/7905)
- [@​dyllan500](https://github.com/dyllan500) made their first contribution in [#​7781](https://github.com/mealie-recipes/mealie/pull/7781)
- [@​x0x0b](https://github.com/x0x0b) made their first contribution in [#​8236](https://github.com/mealie-recipes/mealie/pull/8236)
- [@​torbenvanassche](https://github.com/torbenvanassche) made their first contribution in [#​8262](https://github.com/mealie-recipes/mealie/pull/8262)
### 🍴🍴🍴🍴🍴🍴
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41OS4zIiwidXBkYXRlZEluVmVyIjoiNDQuODMuMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
renovate
changed title from Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.0 to Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.12026-09-05 03:09:34 +00:00
renovate
changed title from Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.1 to Update ghcr.io/mealie-recipes/mealie Docker tag to v3.26.02026-09-14 03:09:57 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
v3.24.0→v3.26.0Release Notes
mealie-recipes/mealie (ghcr.io/mealie-recipes/mealie)
v3.26.0Compare Source
🍴🍴🍴🍴🍴🍴
Welcome to the latest release of Mealie! We have tons of new features packed into this one, as well as a large collection of bug fixes. Check them out below 👇
🚨 BREAKING CHANGE
Mealie now checks where its own outgoing requests are going. Anything the server fetches on your behalf, such as importing a recipe from a URL, downloading a recipe image, sending a webhook, or running a recipe action, is only allowed to reach addresses on the public internet.
Webhooks and recipe actions were not checked before, and the checks on recipe imports were narrower than they are now. If any of these pointed at something on your own network, they will stop working after this update.
If you need a target on your own network to keep working, allow it explicitly with
HTTP_ALLOW_LIST, which accepts hostnames or CIDRs. To keep a Tailscale host reachable, for example:For more information, check out the docs and the in-app announcement.
🎉 Highlights
You can now add substitutions to your ingredients. We support two kinds of substitutions:
Recipe-specific substitutions:
Common substitutions (not tied to specific recipe, edited on the data management page):
Substitutions are (optionally) considered in the recipe finder, too!
You can now link recipe notes to individual steps:

🚨 Breaking changes
✨ New features
🐛 Bug fixes
🧰 Maintenance
14 changes
📚 Documentation
🔨 Internal development
⬆️ Dependency updates
14 changes
🙏 New Contributors
🍴🍴🍴🍴🍴🍴
v3.25.1Compare Source
🍴🍴🍴🍴🍴🍴
Patch release to fix auth issues when embedding Mealie in an iframe.
🐛 Bug fixes
🧰 Maintenance
⬆️ Dependency updates
🙏 New Contributors
🍴🍴🍴🍴🍴🍴
v3.25.0Compare Source
🍴🍴🍴🍴🍴🍴
This release comes with an overhaul to Mealie's internal auth, making it more inline with what you generally expect, specifically with "Remember Me" and
TOKEN_TIME.TOKEN_TIMEchanges).TOKEN_TIMEnow defines how long a session will last before expiring. Many instances previously set this value arbitrarily high to prevent users from being logged-out. Now with auto-refresh this is unnecessary, and can be substantially lowered (we recommend turning this down to at most 168 hours, i.e. one week).⚠️⚠️⚠️ IMPORTANT BREAKING CHANGE FOR APP DEVELOPERS ⚠️⚠️⚠️
GET /api/auth/refreshhas been removed, and is instead now aPOSTAPI.🎉 Highlights
🚨 Breaking changes
✨ New features
🐛 Bug fixes
🧰 Maintenance
14 changes
📚 Documentation
🔨 Internal development
⬆️ Dependency updates
10 changes
be23f54@renovate[bot] (#8256)🙏 New Contributors
🍴🍴🍴🍴🍴🍴
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
80f133157cto887bc82512Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.0to Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.1887bc82512to2e20ea10e6Update ghcr.io/mealie-recipes/mealie Docker tag to v3.25.1to Update ghcr.io/mealie-recipes/mealie Docker tag to v3.26.0