{
 "schema": "bumplog.apps.v1",
 "generatedAt": "2026-07-26T13:02:49.514Z",
 "docs": "https://bumplog.org/api/v1/apps.json is a build-time snapshot; per-app: /api/v1/apps/{slug}.json; badge: /badge/{slug}.svg",
 "count": 48,
 "apps": [
  {
   "slug": "immich",
   "name": "Immich",
   "repo": "immich-app/immich",
   "latestVersion": "v3.0.3",
   "safeToUpdate": "caution",
   "rationale": "No database migrations or breaking API changes are noted, but users relying on F-Droid must switch their repo source to the FUTO repo going forward. The Live Photo thumbnail side-effect requires a manual remediation step (run the 'missing' thumbnails job) if broken thumbnails appear, making it worth reading the notes before upgrading.",
   "changelogSummary": "v3.0.3 is a bug-fix release addressing several mobile and web issues. The F-Droid distribution channel is moving to FUTO's own F-Droid repo, so users who installed via F-Droid should update their source. Live Photo background uploads are fixed, though a side-effect could leave some newly uploaded Live Photos with broken thumbnails — running the missing-thumbnails job resolves this. Additional fixes cover album owner permissions, search visibility, hardware-accelerated video encoding tags, zoom state on asset swap, and minor UI polish on Android.",
   "sourceUrl": "https://github.com/immich-app/immich/releases/tag/v3.0.3",
   "lastChecked": "2026-07-18",
   "successor": null,
   "url": "https://bumplog.org/apps/immich/",
   "badge": "https://bumplog.org/badge/immich.svg",
   "lifecycle": null
  },
  {
   "slug": "jellyfin",
   "name": "Jellyfin",
   "repo": "jellyfin/jellyfin",
   "latestVersion": "v10.11.11",
   "safeToUpdate": "safe",
   "rationale": "The v10.11.11 release notes describe a single minor bugfix (a lock helper addition to UserManager) with no breaking changes, required migrations, or manual upgrade steps called out. The release is explicitly characterized as a minor bugfix release. Standard backup precaution is advised by the Jellyfin team, as with any release.",
   "changelogSummary": "Jellyfin v10.11.11 is a minor stability release focused on bugfixes. The primary change introduces a lock helper for the UserManager component, which improves thread-safety and helps prevent race conditions when user data is accessed concurrently. Users should notice improved reliability in multi-user or high-concurrency scenarios. A full backup is recommended before upgrading.",
   "sourceUrl": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.11",
   "lastChecked": "2026-06-27",
   "successor": null,
   "url": "https://bumplog.org/apps/jellyfin/",
   "badge": "https://bumplog.org/badge/jellyfin.svg",
   "lifecycle": null
  },
  {
   "slug": "paperless-ngx",
   "name": "Paperless-ngx",
   "repo": "paperless-ngx/paperless-ngx",
   "latestVersion": "v2.20.15",
   "safeToUpdate": "safe",
   "rationale": "This release contains only bug fixes, including a recommended security patch (GHSA-8c6x-pfjq-9gr7) addressing mail account enumeration and login/logout endpoint issues. There are no breaking changes, required migrations, or manual upgrade steps noted.",
   "changelogSummary": "v2.20.15 is a security-focused patch release that all users are encouraged to apply. It closes a disclosed vulnerability (GHSA-8c6x-pfjq-9gr7) by tightening authentication flows to use only the allauth login and logout endpoints, and by correctly scoping mail account enumeration to prevent unauthorized access. Two additional bug fixes ship alongside: one eliminates a spurious change event that could fire when switching operator types on a custom field query, and another rejects malformed requests to the API notes endpoint.",
   "sourceUrl": "https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.20.15",
   "lastChecked": "2026-06-27",
   "successor": null,
   "url": "https://bumplog.org/apps/paperless-ngx/",
   "badge": "https://bumplog.org/badge/paperless-ngx.svg",
   "lifecycle": null
  },
  {
   "slug": "nextcloud",
   "name": "Nextcloud",
   "repo": "nextcloud/server",
   "latestVersion": "v34.0.1",
   "safeToUpdate": "unknown",
   "rationale": "The release notes provided contain only a changelog comparison URL and no substantive text describing changes, migrations, deprecations, or breaking changes. Without actual note content there is no basis to classify the update. The source must be fetched and read before a classification can be made.",
   "changelogSummary": "...",
   "sourceUrl": "https://github.com/nextcloud/server/releases/tag/v34.0.1",
   "lastChecked": "2026-06-28",
   "successor": null,
   "url": "https://bumplog.org/apps/nextcloud/",
   "badge": "https://bumplog.org/badge/nextcloud.svg",
   "lifecycle": {
    "product": "nextcloud",
    "link": "https://endoflife.date/nextcloud",
    "cycle": "34",
    "eol": "2027-06-30",
    "status": "eol-scheduled",
    "eolDate": "2027-06-30"
   }
  },
  {
   "slug": "home-assistant",
   "name": "Home Assistant",
   "repo": "home-assistant/core",
   "latestVersion": "2026.6.4",
   "safeToUpdate": "safe",
   "rationale": "All changes in 2026.6.4 are bug fixes, dependency bumps, and translation additions — none of the release notes mention breaking changes, required migrations, or manual upgrade steps. Notable fixes include a Growatt sensor value correction (1000× off), an Immich API key log leak, an InfluxDB URL double-slash bug, and an MQTT discovery data fix, all of which are improvements rather than behavior changes that would require user action. The notes are slightly truncated but the visible content is uniformly patch-level.",
   "changelogSummary": "Home Assistant 2026.6.4 delivers a security fix that prevents the Immich API key from appearing in error logs, and corrects a Growatt power reporting bug where total output power was reported 1,000 times too low when using the V1 API. Sonos now dynamically includes saved favorites in the media player source list, Subaru gains fourth-generation API support, and Amber Electric's configuration flow filters out closed sites to avoid setup confusion. WebDAV integration now retries setup on connection errors rather than failing outright, and the La Marzocco pre-brew time limits have been updated. A broad sweep of translation fixes across more than two dozen integrations improves the setup flow experience for non-English users.",
   "sourceUrl": "https://github.com/home-assistant/core/releases/tag/2026.6.4",
   "lastChecked": "2026-06-28",
   "successor": null,
   "url": "https://bumplog.org/apps/home-assistant/",
   "badge": "https://bumplog.org/badge/home-assistant.svg",
   "lifecycle": null
  },
  {
   "slug": "gitea",
   "name": "Gitea",
   "repo": "go-gitea/gitea",
   "latestVersion": "v1.26.4",
   "safeToUpdate": "safe",
   "rationale": "v1.26.4 contains only a security fix preventing disabled users from being auto-reactivated via OAuth2 and a single bug fix for git log context error handling. The release notes call out no breaking changes, required migrations, or manual upgrade steps.",
   "changelogSummary": "v1.26.4 is a focused patch release shipping one security fix and one bug fix. The security change closes a gap where disabled user accounts could be silently reactivated when logging in through an OAuth2 provider; disabled accounts now remain inactive after the OAuth2 callback completes. A separate bug fix improves error handling during git log traversal, preventing context errors from being silently ignored.",
   "sourceUrl": "https://github.com/go-gitea/gitea/releases/tag/v1.26.4",
   "lastChecked": "2026-06-29",
   "successor": null,
   "url": "https://bumplog.org/apps/gitea/",
   "badge": "https://bumplog.org/badge/gitea.svg",
   "lifecycle": null
  },
  {
   "slug": "vaultwarden",
   "name": "Vaultwarden",
   "repo": "dani-garcia/vaultwarden",
   "latestVersion": "1.36.0",
   "safeToUpdate": "caution",
   "rationale": "This release patches six security advisories (SSO CSRF, user/org enumeration, SSO existing-user binding, and SSRF via Icon Endpoint) and the maintainers explicitly urge updating 'as soon as possible,' making the upgrade strongly recommended. No breaking changes or required manual migration steps are called out in the notes. However, the multiple SSO-related fixes (CSRF, identifier handling, user binding) and the Web Vault bump to v2026.4.1 warrant reading the individual advisories—especially if SSO is enabled—before updating in production.",
   "changelogSummary": "Vaultwarden 1.36.0 is a security-critical release that patches multiple vulnerabilities including SSO login CSRF, user/organization enumeration, SSO existing-user binding issues, and server-side request forgery (SSRF) via the icon endpoint — an immediate upgrade is strongly advised. On the features side, vault item archiving is now supported, letting users tidy their vault without permanently deleting entries. The bundled Web Vault has been updated to v2026.4.1, and DuckDuckGo has been added as a recognized browser device type. Several SSO improvements and a fix for favicon fetching (which now checks all icon links rather than only the first) round out the release.",
   "sourceUrl": "https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0",
   "lastChecked": "2026-06-28",
   "successor": null,
   "url": "https://bumplog.org/apps/vaultwarden/",
   "badge": "https://bumplog.org/badge/vaultwarden.svg",
   "lifecycle": null
  },
  {
   "slug": "adguard-home",
   "name": "AdGuard Home",
   "repo": "AdguardTeam/AdGuardHome",
   "latestVersion": "v0.107.77",
   "safeToUpdate": "caution",
   "rationale": "This release patches a path traversal vulnerability (CVE-2026-41448) in GLiNET mode authorization, making it a security-motivated update worth applying. However, it also deprecates the `response_status` query parameter in `GET /control/querylog` in favor of a new `reason` parameter — users or integrations relying on that API endpoint should review the change before updating. No breaking migrations or manual upgrade steps are noted.",
   "changelogSummary": "v0.107.77 patches a path traversal vulnerability in authorization for GLiNET mode (CVE-2026-41448), reported by a community member. The query log API gains a new `reason` query parameter on `GET /control/querylog` that replaces the now-deprecated `response_status` parameter. No other user-facing changes are included in this release.",
   "sourceUrl": "https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.77",
   "lastChecked": "2026-06-29",
   "successor": null,
   "url": "https://bumplog.org/apps/adguard-home/",
   "badge": "https://bumplog.org/badge/adguard-home.svg",
   "lifecycle": null
  },
  {
   "slug": "uptime-kuma",
   "name": "Uptime Kuma",
   "repo": "louislam/uptime-kuma",
   "latestVersion": "2.4.0",
   "safeToUpdate": "safe",
   "rationale": "The 2.4.0 release notes list only additive new features (new notification providers, RSS incidents), optional improvements (bearer token support, gamedig token field), and bug fixes — none of which require migration or manual upgrade steps. Notably, the release patches a Remote Code Execution vulnerability in the LiquidJS dependency (GHSA-gf2q-c269-pqgc), making the update actively advisable for security. No breaking changes, deprecations, or required configuration changes are called out.",
   "changelogSummary": "Uptime Kuma 2.4.0 adds two new notification providers — EgoSMS (for Uganda-based SMS) and VKTeams bot — and now includes incidents in RSS feeds. Monitor configuration gains bearer token support across HTTP and WebSocket upgrade monitors, plus an optional token field for GameDig monitors. A critical security fix patches a Remote Code Execution vulnerability in the LiquidJS dependency used by notification templates. The release also resolves a long-standing bug where NTLM monitors over plain HTTP would fail with a 400 Bad Request error.",
   "sourceUrl": "https://github.com/louislam/uptime-kuma/releases/tag/2.4.0",
   "lastChecked": "2026-06-29",
   "successor": null,
   "url": "https://bumplog.org/apps/uptime-kuma/",
   "badge": "https://bumplog.org/badge/uptime-kuma.svg",
   "lifecycle": null
  },
  {
   "slug": "frigate",
   "name": "Frigate",
   "repo": "blakeblackshear/frigate",
   "latestVersion": "v0.17.2",
   "safeToUpdate": "caution",
   "rationale": "The release contains no breaking config changes or required migrations, making the update itself straightforward. However, the security advisories — particularly the three unresolved issues around viewer-role privilege escalation and camera ACL bypasses — mean operators with publicly exposed instances or mixed-role user setups should review the advisories carefully before and after updating to understand residual risk.",
   "changelogSummary": "v0.17.2 is a maintenance release that patches six security vulnerabilities, several of them critical — including two remote code execution issues via go2rtc stream handling, RTSP credential leaks through nginx proxy caching, and authorization bypasses affecting viewer-role users. Three additional security issues affecting viewer-role privilege escalation and camera ACL enforcement are acknowledged but deferred to future releases. On the feature side, MP4 exports can now optionally embed recording segment chapter metadata, live page preview performance has been improved, and non-admin users can now use PTZ controls for cameras they have access to.",
   "sourceUrl": "https://github.com/blakeblackshear/frigate/releases/tag/v0.17.2",
   "lastChecked": "2026-07-02",
   "successor": null,
   "url": "https://bumplog.org/apps/frigate/",
   "badge": "https://bumplog.org/badge/frigate.svg",
   "lifecycle": null
  },
  {
   "slug": "grafana",
   "name": "Grafana",
   "repo": "grafana/grafana",
   "latestVersion": "v13.0.3",
   "safeToUpdate": "safe",
   "rationale": "The release notes list only bug fixes and minor enhancements with no breaking changes, required migrations, or manual upgrade steps called out. The MySQL migration query fix is notable but is described as a bug fix, implying it corrects an existing fault rather than introducing a schema change requiring action. No deprecations or behavioral changes are flagged.",
   "changelogSummary": "v13.0.3 is a patch release focused on provisioning reliability and bug fixes. Docker images based on Alpine are bumped to a newer base version. Provisioning now correctly writes folder metadata files when dashboards are created in or moved into new folders, and several provisioning edge cases are resolved including multi-org PR comment handling and folder-rename link tracking. A bad MySQL query in a datasource type column migration is fixed, and the datasources API now correctly rejects mismatched UIDs with a 400 error.",
   "sourceUrl": "https://github.com/grafana/grafana/releases/tag/v13.0.3",
   "lastChecked": "2026-07-01",
   "successor": null,
   "url": "https://bumplog.org/apps/grafana/",
   "badge": "https://bumplog.org/badge/grafana.svg",
   "lifecycle": {
    "product": "grafana",
    "link": "https://endoflife.date/grafana",
    "cycle": "13.0",
    "eol": "2027-01-09",
    "status": "eol-scheduled",
    "eolDate": "2027-01-09"
   }
  },
  {
   "slug": "portainer",
   "name": "Portainer",
   "repo": "portainer/portainer",
   "latestVersion": "2.39.4",
   "safeToUpdate": "caution",
   "rationale": "The replacement of the Docker binary with libstack is a notable internal behavioral change that may affect environment-specific workflows, warranting review before upgrading. The security fixes — particularly the Kubernetes resource enumeration bypass and the restore endpoint admin-takeover vulnerability — make updating advisable, but the libstack substitution means the update is worth reading about rather than applying blindly. No explicit breaking changes, required migrations, or manual upgrade steps are called out in the notes.",
   "changelogSummary": "Portainer 2.39.4 is primarily a security and bug-fix release. It addresses multiple CVEs in the go-git and Go standard library dependencies, covering a broad range of vulnerabilities. Notable bug fixes include a security patch preventing users without environment access from enumerating Kubernetes resources, a fix for a restore endpoint that could allow admin takeover on uninitialised instances, and a resolution for standard users being unable to redeploy team stacks or delete registry images. The Docker binary has been replaced with libstack, and a new API endpoint for refreshing Team/Group membership has been added.",
   "sourceUrl": "https://github.com/portainer/portainer/releases/tag/2.39.4",
   "lastChecked": "2026-07-01",
   "successor": null,
   "url": "https://bumplog.org/apps/portainer/",
   "badge": "https://bumplog.org/badge/portainer.svg",
   "lifecycle": null
  },
  {
   "slug": "traefik",
   "name": "Traefik",
   "repo": "traefik/traefik",
   "latestVersion": "v3.7.6",
   "safeToUpdate": "breaking",
   "rationale": "The release notes open with an explicit directive to consult a version-specific migration guide, which is the clearest upstream signal that manual upgrade steps or breaking changes are present. The CORS wildcard and Max-Age behavioral fixes may silently alter responses for existing configurations that happened to rely on the prior (buggy) defaults. The new server options for header underscore removal and max header size may also carry default-value changes that affect running deployments.",
   "changelogSummary": "v3.7.6 patches three security CVEs related to HTTP/2 header memory exhaustion and ships a collection of bug fixes across middleware, Kubernetes integrations, and TLS. Notable corrections include CORS Max-Age defaulting incorrectly to zero, CORS wildcard handling when allow-credentials is enabled, and x-forwarded-port in forward-auth. Kubernetes users benefit from Gateway API status fixes, more deterministic EndpointSlice ordering, and ingress-nginx SSL passthrough and force-ssl-redirect corrections. Two new server-level options are introduced: one to strip request headers containing underscores, and one to configure the maximum request header size. A migration guide is explicitly required before upgrading.",
   "sourceUrl": "https://github.com/traefik/traefik/releases/tag/v3.7.6",
   "lastChecked": "2026-07-04",
   "successor": null,
   "url": "https://bumplog.org/apps/traefik/",
   "badge": "https://bumplog.org/badge/traefik.svg",
   "lifecycle": {
    "product": "traefik",
    "link": "https://endoflife.date/traefik",
    "cycle": "3.7",
    "eol": false,
    "status": "supported",
    "eolDate": null
   }
  },
  {
   "slug": "authentik",
   "name": "Authentik",
   "repo": "goauthentik/authentik",
   "latestVersion": "version/2026.5.3",
   "safeToUpdate": "safe",
   "rationale": "The release notes describe only bug fixes, a dependency security bump, and documentation improvements — no breaking changes, required migrations, or manual upgrade steps are called out. The two CVEs make applying this patch advisable promptly, but nothing in the notes indicates operator action beyond a standard update.",
   "changelogSummary": "version/2026.5.3 is a patch release focused on bug fixes and security updates. Notable repairs include a fix for SCIM's interactive OAuth incorrectly overriding refresh tokens, a panic in the RADIUS provider log, and an exception in the endpoints/connectors agent when encountering an invalid auth type. The Docker outpost integration form's CA certificate filter is corrected, blueprint application now handles integrity exceptions gracefully, and a polyfill is added for Safari versions below 17.4. Two CVEs (CVE-2026-49443 and CVE-2026-49448) are addressed, and the Django dependency is bumped to v5.2.15.",
   "sourceUrl": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.3",
   "lastChecked": "2026-07-02",
   "successor": null,
   "url": "https://bumplog.org/apps/authentik/",
   "badge": "https://bumplog.org/badge/authentik.svg",
   "lifecycle": null
  },
  {
   "slug": "sonarr",
   "name": "Sonarr",
   "repo": "Sonarr/Sonarr",
   "latestVersion": "v4.0.19.2979",
   "safeToUpdate": "safe",
   "rationale": "The release contains only one change — a bug fix for qBittorrent basic auth. The notes describe no breaking changes, required migrations, deprecations, or manual upgrade steps.",
   "changelogSummary": "v4.0.19.2979 is a minimal patch release containing a single bug fix: basic authentication for qBittorrent download clients was broken and has been corrected. No new features, configuration changes, or migrations are included. Users who use qBittorrent with basic auth will see restored connectivity after updating.",
   "sourceUrl": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.19.2979",
   "lastChecked": "2026-07-03",
   "successor": null,
   "url": "https://bumplog.org/apps/sonarr/",
   "badge": "https://bumplog.org/badge/sonarr.svg",
   "lifecycle": null
  },
  {
   "slug": "radarr",
   "name": "Radarr",
   "repo": "Radarr/Radarr",
   "latestVersion": "v6.2.1.10461",
   "safeToUpdate": "safe",
   "rationale": "The release notes contain no breaking changes, required migrations, or mandatory manual upgrade steps. The Docker guidance (update the image, do not update in-container) is standard Radarr procedure and not a new restriction introduced by this release. All changes are bug fixes, minor new integrations, and dependency bumps.",
   "changelogSummary": "v6.2.1.10461 delivers several qBittorrent reliability fixes including repaired basic auth, correct login handling for qBittorrent 5.2, API key support, reused authentication cookies, and a fix for credential-change test validation. On the database side, SQLite's busy timeout has been bumped to 1000ms and a new Postgres connection string option has been added for users preferring PostgreSQL. Other improvements include a Simkl Anime List integration, reduced data transfer when reading video streams, a quality modifier fix when augmenting quality from media info, and an upgrade to .NET 8.0.27. Docker users must update their container image rather than updating from within the container.",
   "sourceUrl": "https://github.com/Radarr/Radarr/releases/tag/v6.2.1.10461",
   "lastChecked": "2026-07-03",
   "successor": null,
   "url": "https://bumplog.org/apps/radarr/",
   "badge": "https://bumplog.org/badge/radarr.svg",
   "lifecycle": null
  },
  {
   "slug": "overseerr",
   "name": "Overseerr",
   "repo": "sct/overseerr",
   "latestVersion": "v1.35.0",
   "safeToUpdate": "unmaintained",
   "rationale": "The sct/overseerr repository is archived and read-only (last activity Feb 2026) — no further fixes or security patches. Last release was v1.35.0. Consider migrating to the actively-maintained fork Jellyseerr.",
   "changelogSummary": null,
   "sourceUrl": "https://github.com/sct/overseerr/releases/tag/v1.35.0",
   "lastChecked": "2026-07-06",
   "successor": "Jellyseerr",
   "url": "https://bumplog.org/apps/overseerr/",
   "badge": "https://bumplog.org/badge/overseerr.svg",
   "lifecycle": null
  },
  {
   "slug": "navidrome",
   "name": "Navidrome",
   "repo": "navidrome/navidrome",
   "latestVersion": "v0.62.0",
   "safeToUpdate": "caution",
   "rationale": "No hard breaking changes or mandatory migration steps are declared, but two config options are deprecated and renamed (EnableTranscodingCancellation → Transcoding.EnableCancellation; SimilarSongsMatchThreshold → Matcher.FuzzyThreshold), and the playback-reporting behavior is materially changed. Users with custom config or scrobble-dependent workflows should review the Configuration Changes table before upgrading. The security fixes are significant enough to make upgrading strongly advisable, but a quick config audit is warranted first.",
   "changelogSummary": "Navidrome v0.62.0 delivers a significant security hardening pass, fixing six reported vulnerabilities covering cross-account data disclosure, player takeover, Last.fm session hijack, JWT bypass on share streams, and unauthorized access to transcoding config and radio management endpoints. The playback reporting flow is overhauled: the UI now uses the OpenSubsonic playbackReport extension with a redesigned Now Playing panel and a configurable reporting interval, replacing the old scrobble mechanism. Two configuration options are deprecated and renamed — EnforceNonRootUser and per-user/server transcode limits are new additions, while EnableTranscodingCancellation and SimilarSongsMatchThreshold move under new namespaced sections. Smart playlists gain ReplayGain fields and new track-presence operators, and five new UI themes are included.",
   "sourceUrl": "https://github.com/navidrome/navidrome/releases/tag/v0.62.0",
   "lastChecked": "2026-07-04",
   "successor": null,
   "url": "https://bumplog.org/apps/navidrome/",
   "badge": "https://bumplog.org/badge/navidrome.svg",
   "lifecycle": null
  },
  {
   "slug": "homepage",
   "name": "Homepage",
   "repo": "gethomepage/homepage",
   "latestVersion": "v1.13.2",
   "safeToUpdate": "safe",
   "rationale": "The release notes contain no breaking changes, required migrations, or manual upgrade steps. All three fixes are narrow widget/integration corrections that improve correctness without altering configuration or behavior for unaffected users. Dependency updates are routine and internal to the build.",
   "changelogSummary": "v1.13.2 is a maintenance-focused release with three bug fixes: compatibility with the Dispatcharr v24 API, the ability to explicitly overwrite cookie headers, and a correction to the Seerr widget that was incorrectly injecting an 'available' field. The remainder of the release consists entirely of dependency bumps and CI/tooling housekeeping, with no new user-facing features introduced.",
   "sourceUrl": "https://github.com/gethomepage/homepage/releases/tag/v1.13.2",
   "lastChecked": "2026-07-05",
   "successor": null,
   "url": "https://bumplog.org/apps/homepage/",
   "badge": "https://bumplog.org/badge/homepage.svg",
   "lifecycle": null
  },
  {
   "slug": "mealie",
   "name": "Mealie",
   "repo": "mealie-recipes/mealie",
   "latestVersion": "v3.20.1",
   "safeToUpdate": "safe",
   "rationale": "The release notes describe a single UI bug fix and dependency updates only. There are no breaking changes, required migrations, or manual upgrade steps called out.",
   "changelogSummary": "v3.20.1 is a small patch release fixing a bug where ingredient quantities were invisible in number inputs until the field was interacted with. The release also includes a security-flagged update to the pydantic-settings dependency, along with routine bumps to FastAPI, Node.js, and the coverage tooling.",
   "sourceUrl": "https://github.com/mealie-recipes/mealie/releases/tag/v3.20.1",
   "lastChecked": "2026-07-08",
   "successor": null,
   "url": "https://bumplog.org/apps/mealie/",
   "badge": "https://bumplog.org/badge/mealie.svg",
   "lifecycle": null
  },
  {
   "slug": "bookstack",
   "name": "BookStack",
   "repo": "BookStackApp/BookStack",
   "latestVersion": "v26.05.2",
   "safeToUpdate": "caution",
   "rationale": "No breaking changes, schema migrations, or manual upgrade steps are mentioned, so the update itself is low-risk. However, the maintainers explicitly advise upgrading for any instance with public access or untrusted editors, and the behavioral changes to URL/srcset filtering and comment permission enforcement are security-relevant and worth verifying against any custom content policies before deploying.",
   "changelogSummary": "v26.05.2 is a security patch addressing edge-case vulnerabilities in URL filtering, redirect handling, and comment permission checks. Content allow-filtering was extended to cover protocols inside srcset attributes, and URL filtering was consolidated into a more robust centralized utility. A missing visibility-permission check on comment deletion was also corrected. The release additionally adds Serbian as a selectable language and refreshes PHP dependencies and translations.",
   "sourceUrl": "https://github.com/BookStackApp/BookStack/releases/tag/v26.05.2",
   "lastChecked": "2026-07-09",
   "successor": null,
   "url": "https://bumplog.org/apps/bookstack/",
   "badge": "https://bumplog.org/badge/bookstack.svg",
   "lifecycle": null
  },
  {
   "slug": "pi-hole",
   "name": "Pi-hole",
   "repo": "pi-hole/pi-hole",
   "latestVersion": "v6.4.2",
   "safeToUpdate": "caution",
   "rationale": "The presence of a patched security advisory (GHSA-6w8x-p785-6pm4) makes updating advisable, but users should be aware of the permission and gravity-behaviour changes that could affect custom setups. No explicit breaking changes or required manual migration steps are called out in the notes, but the security nature of the release and the permission/ownership fixes warrant reading the advisory before updating.",
   "changelogSummary": "v6.4.2 delivers a security fix alongside a set of infrastructure and reliability improvements. A published security advisory has been patched in both the core installer and the FTL component. The release also tightens file ownership and permission handling, including a fix for .etag files after gravity runs and loosened requirements for local-file gravity sources. Installer behaviour is refined: the apt cache update is skipped when pihole-meta is already current, logrotate is now a declared dependency for DEB and RPM packages, and gravity error messages now include the curl exit code for easier debugging.",
   "sourceUrl": "https://github.com/pi-hole/pi-hole/releases/tag/v6.4.2",
   "lastChecked": "2026-07-01",
   "successor": null,
   "url": "https://bumplog.org/apps/pi-hole/",
   "badge": "https://bumplog.org/badge/pi-hole.svg",
   "lifecycle": null
  },
  {
   "slug": "n8n",
   "name": "n8n",
   "repo": "n8n-io/n8n",
   "latestVersion": "n8n@2.31.5",
   "safeToUpdate": "safe",
   "rationale": "The release contains only bug fixes with no breaking changes, required migrations, or deprecations mentioned in the notes. All three fixes address defects rather than altering behavior intentionally, and there are no manual upgrade steps indicated.",
   "changelogSummary": "n8n@2.31.5 is a small patch release containing three bug fixes. AWS integrations benefit from a fix that ensures request header values are properly coerced to strings before signing, which could have caused authentication failures. AI Agent workflows now correctly detect tools connected through Human-in-the-Loop (HITL) tools, restoring expected tool visibility. The editor also received a minor UI fix to keep dropdown tooltips rendering above menus.",
   "sourceUrl": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.5",
   "lastChecked": "2026-07-22",
   "successor": null,
   "url": "https://bumplog.org/apps/n8n/",
   "badge": "https://bumplog.org/badge/n8n.svg",
   "lifecycle": null
  },
  {
   "slug": "dockge",
   "name": "Dockge",
   "repo": "louislam/dockge",
   "latestVersion": "1.5.0",
   "safeToUpdate": "caution",
   "rationale": "The release notes explicitly flag a breaking change: the Console feature is now disabled by default, requiring users who rely on it to set DOCKGE_ENABLE_CONSOLE=true before or after upgrading to restore prior behavior. Everything else — dependency bumps, bug fixes, translations — is routine and requires no migration.",
   "changelogSummary": "Dockge 1.5.0 disables the Console feature by default for security reasons; users who need it must explicitly opt in via an environment variable. The release updates the bundled Docker client and Docker Compose to recent versions, and resolves a long-standing bug where YAML comments were lost when reordering items. Additional fixes address compose version warnings, a security advisory (GHSA-7vx4-hf96-mqq6), and minor UI polish such as removing an unnecessary scrollbar. Translation coverage is expanded with contributions from dozens of community members, including a new Irish language addition.",
   "sourceUrl": "https://github.com/louislam/dockge/releases/tag/1.5.0",
   "lastChecked": "2026-07-06",
   "successor": null,
   "url": "https://bumplog.org/apps/dockge/",
   "badge": "https://bumplog.org/badge/dockge.svg",
   "lifecycle": null
  },
  {
   "slug": "wg-easy",
   "name": "wg-easy",
   "repo": "wg-easy/wg-easy",
   "latestVersion": "v15.3.0",
   "safeToUpdate": "caution",
   "rationale": "The new server-side firewall filtering feature actively enforces Allowed IP rules in a way that did not exist before, which could change traffic behavior for existing clients depending on their configuration. The release notes link to dedicated documentation on how to enable and use this feature, signaling it warrants a read-before-upgrade. No explicit breaking changes or mandatory migration steps are called out, but the behavioral shift in IP enforcement makes a configuration review prudent.",
   "changelogSummary": "v15.3.0 introduces server-side enforcement of Allowed IP rules via a new per-client firewall filtering feature, which requires review of the updated FAQ docs to configure correctly. AmneziaWG support is extended with H1–H4 range configuration. Mobile UI layout is improved, hook inputs are upgraded to textareas for easier editing, and QR codes can now be displayed via CLI, copied, or downloaded as PNG. A number of bug fixes land as well, including a fix for an error when re-enabling a disabled client and a trailing newline correction in Prometheus metrics output.",
   "sourceUrl": "https://github.com/wg-easy/wg-easy/releases/tag/v15.3.0",
   "lastChecked": "2026-07-10",
   "successor": null,
   "url": "https://bumplog.org/apps/wg-easy/",
   "badge": "https://bumplog.org/badge/wg-easy.svg",
   "lifecycle": null
  },
  {
   "slug": "karakeep",
   "name": "Karakeep",
   "repo": "karakeep-app/karakeep",
   "latestVersion": "v0.32.0",
   "safeToUpdate": "caution",
   "rationale": "No explicit breaking changes or required migration steps are documented, but the release contains meaningful behavioral shifts worth reviewing: links opened in the mobile reader now launch an in-app browser by default, the CLI received 'major improvements' including a new auth-init workflow that may affect existing automation, and the release notes reference an 'Important Security fix' whose full description is truncated in the provided text and should be read in full before upgrading.",
   "changelogSummary": "Karakeep v0.32.0 brings a major mobile app redesign with more native screens and a customizable reader toolbar, plus the long-awaited Safari extension now available on the App Store. The release makes a significant push toward AI-agent use with an official published skill, a heavily improved CLI that now supports persistent auth config via 'karakeep auth init', and new granular API key scopes to limit agent permissions. The browser extension gains experimental built-in SingleFile support for crawling authenticated pages client-side, eliminating the need for a separate extension. Additional highlights include keyboard shortcuts for the bookmark grid, new import sources (OneTab and Readwise Reader), timestamp localization, and a noted security fix.",
   "sourceUrl": "https://github.com/karakeep-app/karakeep/releases/tag/v0.32.0",
   "lastChecked": "2026-07-13",
   "successor": null,
   "url": "https://bumplog.org/apps/karakeep/",
   "badge": "https://bumplog.org/badge/karakeep.svg",
   "lifecycle": null
  },
  {
   "slug": "stirling-pdf",
   "name": "Stirling-PDF",
   "repo": "Stirling-Tools/Stirling-PDF",
   "latestVersion": "v2.14.0",
   "safeToUpdate": "unknown",
   "rationale": "Repointed from the moved Frooodle/Stirling-PDF to Stirling-Tools/Stirling-PDF; full safety assessment pending the next daily run.",
   "changelogSummary": null,
   "sourceUrl": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.14.0",
   "lastChecked": "2026-07-06",
   "successor": null,
   "url": "https://bumplog.org/apps/stirling-pdf/",
   "badge": "https://bumplog.org/badge/stirling-pdf.svg",
   "lifecycle": null
  },
  {
   "slug": "actual",
   "name": "Actual Budget",
   "repo": "actualbudget/actual",
   "latestVersion": "v26.7.0",
   "safeToUpdate": "unknown",
   "rationale": "Repointed from the archived actualbudget/actual-server to the maintained monorepo actualbudget/actual; full safety assessment pending the next daily run.",
   "changelogSummary": null,
   "sourceUrl": "https://github.com/actualbudget/actual/releases/tag/v26.7.0",
   "lastChecked": "2026-07-06",
   "successor": null,
   "url": "https://bumplog.org/apps/actual/",
   "badge": "https://bumplog.org/badge/actual.svg",
   "lifecycle": null
  },
  {
   "slug": "syncthing",
   "name": "Syncthing",
   "repo": "syncthing/syncthing",
   "latestVersion": "v2.1.1",
   "safeToUpdate": "safe",
   "rationale": "The release notes list only bug fixes and internal build/chore changes with no mention of breaking changes, required migrations, or manual upgrade steps. The new 2.1 features (grouping, proxy support, block indexing toggle, session cookie config) are additive and opt-in, requiring no action from existing users.",
   "changelogSummary": "v2.1.1 is a patch release that ships several bug fixes on top of the 2.1 feature base. Fixes include a broken REST-based upgrade path when Syncthing is running, incorrect permissions on versioner-archived directories, a mis-announced wildcard address in TCP hole-punching discovery, and a crash on zero-size protocol requests. The 2.1 series also introduced device/folder grouping in the GUI, HTTP/HTTPS CONNECT proxy support, an option to disable block indexing per folder to reduce database overhead, and configurable GUI session cookie duration and path.",
   "sourceUrl": "https://github.com/syncthing/syncthing/releases/tag/v2.1.1",
   "lastChecked": "2026-07-03",
   "successor": null,
   "url": "https://bumplog.org/apps/syncthing/",
   "badge": "https://bumplog.org/badge/syncthing.svg",
   "lifecycle": null
  },
  {
   "slug": "changedetection-io",
   "name": "Changedetection.io",
   "repo": "dgtlmoon/changedetection.io",
   "latestVersion": "0.55.7",
   "safeToUpdate": "safe",
   "rationale": "The release contains a single UI bug fix with no breaking changes, required migrations, or configuration steps called out in the notes. The fix is scoped to the LLM settings panel, making it a low-risk patch update for all users.",
   "changelogSummary": "Version 0.55.7 is a targeted bug fix addressing a settings conflict between wtforms and pydantic in the LLM UI configuration panel. This is a narrow patch with a single change and no new features or behavioral modifications for users not using the LLM integration. Users who rely on LLM-related settings will see corrected behavior in that settings interface.",
   "sourceUrl": "https://github.com/dgtlmoon/changedetection.io/releases/tag/0.55.7",
   "lastChecked": "2026-07-08",
   "successor": null,
   "url": "https://bumplog.org/apps/changedetection-io/",
   "badge": "https://bumplog.org/badge/changedetection-io.svg",
   "lifecycle": null
  },
  {
   "slug": "prowlarr",
   "name": "Prowlarr",
   "repo": "Prowlarr/Prowlarr",
   "latestVersion": "v2.4.0.5397",
   "safeToUpdate": "caution",
   "rationale": "The release introduces meaningful behavioral changes — including a new Postgres connection string option, qBittorrent authentication overhaul (API keys, basic auth, cookie handling), and a MyAnonamouse download method change — that users relying on those integrations should review before updating. Non-docker users are explicitly instructed to switch their update branch to 'master' in Settings, and docker users must update the container image rather than updating in-place. No hard migration steps or data-breaking changes are called out, but the auth and integration changes warrant a quick read.",
   "changelogSummary": "v2.4.0.5397 delivers a range of fixes and new capabilities. qBittorrent integration sees the most attention: basic auth is fixed, API key support is added, authentication cookie reuse is improved, and a bug where credential-change tests always passed is resolved. Newznab parameter handling is corrected for minage, minsize, and maxsize fields, and a limit=0 query bug is also fixed. New features include a Postgres connection string option, Basic Auth support for sync applications, and a MyAnonamouse switch to session-cookie-free downloads. The runtime is bumped to .NET 8.0.27, and several indexers (SecretCinema, MyAnonamouse, ZonaQ, SceneTime) receive fixes or updates.",
   "sourceUrl": "https://github.com/Prowlarr/Prowlarr/releases/tag/v2.4.0.5397",
   "lastChecked": "2026-07-09",
   "successor": null,
   "url": "https://bumplog.org/apps/prowlarr/",
   "badge": "https://bumplog.org/badge/prowlarr.svg",
   "lifecycle": null
  },
  {
   "slug": "bazarr",
   "name": "Bazarr",
   "repo": "morpheus65535/bazarr",
   "latestVersion": "v1.6.0",
   "safeToUpdate": "caution",
   "rationale": "The permanent removal of the Podnapisi provider is a functional breaking point for anyone who had it configured — those users must reconfigure their subtitle sources before or after upgrading. All other changes are fixes, improvements, and additions with no stated migration steps, making this otherwise a routine update.",
   "changelogSummary": "v1.6.0 removes the Podnapisi provider entirely since the service is no longer online, so any users relying on it will need to switch to an alternative source. The release adds two new Bulgarian subtitle providers (Bayflix and Vladoon) and fixes a command-injection vulnerability (CWE-78) in subtitle post-processing by switching to safer subprocess invocation. Several provider improvements land as well: better rate-limit handling for SubDL, fixed RegieLive.ro downloads, improved audio and Chinese subtitle language detection, and a dramatic Sonarr/Radarr sync performance boost. A new option lets you disable SSL verification globally for providers, and the base config file path can now be set via an environment variable.",
   "sourceUrl": "https://github.com/morpheus65535/bazarr/releases/tag/v1.6.0",
   "lastChecked": "2026-07-10",
   "successor": null,
   "url": "https://bumplog.org/apps/bazarr/",
   "badge": "https://bumplog.org/badge/bazarr.svg",
   "lifecycle": null
  },
  {
   "slug": "linkwarden",
   "name": "Linkwarden",
   "repo": "linkwarden/linkwarden",
   "latestVersion": "v2.14.1",
   "safeToUpdate": "caution",
   "rationale": "The new user content domain feature is opt-in and not required, but administrators interested in the security isolation benefit will need to follow a separate setup guide. No breaking changes or mandatory migrations are noted, but the new hostname configuration is worth reviewing before updating if you serve HTML archives.",
   "changelogSummary": "v2.14.1 introduces support for serving preserved HTML archives from a separate public hostname, isolating untrusted archived pages from the main application — a security-oriented addition that requires optional configuration via a dedicated user content domain setup. Tag selection UX has been improved, and several bug fixes are included.",
   "sourceUrl": "https://github.com/linkwarden/linkwarden/releases/tag/v2.14.1",
   "lastChecked": "2026-07-06",
   "successor": null,
   "url": "https://bumplog.org/apps/linkwarden/",
   "badge": "https://bumplog.org/badge/linkwarden.svg",
   "lifecycle": null
  },
  {
   "slug": "watchtower",
   "name": "Watchtower",
   "repo": "containrrr/watchtower",
   "latestVersion": "v1.7.1",
   "safeToUpdate": "unmaintained",
   "rationale": "This repository is archived and read-only — no further fixes or security patches.",
   "changelogSummary": "Watchtower v1.7.1: repository archived and read-only. See the linked source.",
   "sourceUrl": "https://github.com/containrrr/watchtower/releases/tag/v1.7.1",
   "lastChecked": "2026-07-09",
   "successor": "nicholas-fedor/watchtower",
   "url": "https://bumplog.org/apps/watchtower/",
   "badge": "https://bumplog.org/badge/watchtower.svg",
   "lifecycle": null
  },
  {
   "slug": "ollama",
   "name": "Ollama",
   "repo": "ollama/ollama",
   "latestVersion": "v0.32.4",
   "safeToUpdate": "safe",
   "rationale": "The release notes describe no breaking changes, required migrations, or manual upgrade steps. Changes are additive (new Apple GPU support) or targeted fixes and performance improvements to existing inference paths. Users not running Laguna GPUs or Qwen3 MoE models are unaffected by the functional changes.",
   "changelogSummary": "v0.32.4 adds Apple GPU support for the Laguna architecture via the MLX engine, enabling hardware acceleration on newer Apple silicon. Speculative decoding drafts now quantize output heads at the requested type, aligning draft model precision with user intent. Qwen3 MoE decoding receives a correctness fix for differently-quantized experts along with a ~4–9% throughput improvement on M5 Max hardware from optimized packed gate/up projection.",
   "sourceUrl": "https://github.com/ollama/ollama/releases/tag/v0.32.4",
   "lastChecked": "2026-07-26",
   "successor": null,
   "url": "https://bumplog.org/apps/ollama/",
   "badge": "https://bumplog.org/badge/ollama.svg",
   "lifecycle": null
  },
  {
   "slug": "photoprism",
   "name": "PhotoPrism",
   "repo": "photoprism/photoprism",
   "latestVersion": "260601-a7d098548",
   "safeToUpdate": "caution",
   "rationale": "No explicit breaking changes or required migration steps are called out, but the libheif upgrade (17 CVE fixes) and the VAAPI/FFmpeg 8 transcoding changes may affect video playback or transcoding behavior for users relying on hardware acceleration. The new free-disk-space threshold is opt-in but represents a behavioral change to indexing that admins should be aware of before updating.",
   "changelogSummary": "Release 260601-a7d098548 is a service release focused on security hardening and reliability fixes. Notable additions include a configurable free disk space threshold that automatically pauses indexing, importing, and uploading to prevent storage volumes from filling up, and a new option to exclude specific formats from FFmpeg processing. Security improvements include reinforced user profile authorization checks, removal of a vulnerable Pebble binary (CVE-2026-39821), and an upgrade of libheif from v1.21.2 to v1.22.2 addressing 17 CVEs. Several bugs are also resolved, including fixes for hidden stack recovery, VAAPI transcoding compatibility with FFmpeg 8, folder album deletion loops, and PNG ICC profile handling.",
   "sourceUrl": "https://github.com/photoprism/photoprism/releases/tag/260601-a7d098548",
   "lastChecked": "2026-07-08",
   "successor": null,
   "url": "https://bumplog.org/apps/photoprism/",
   "badge": "https://bumplog.org/badge/photoprism.svg",
   "lifecycle": null
  },
  {
   "slug": "memos",
   "name": "Memos",
   "repo": "usememos/memos",
   "latestVersion": "v0.29.1",
   "safeToUpdate": "safe",
   "rationale": "The release notes list only three bug fixes with no mention of breaking changes, required migrations, configuration changes, or deprecations. All changes are purely corrective and user-facing in a non-destructive way.",
   "changelogSummary": "v0.29.1 is a focused bug-fix release. Multi-line task items now stay correctly aligned within a single grid column, resolving a layout regression in task lists. Link previews gain support for standard HTML meta description tags, so sites without Open Graph metadata now surface richer preview cards. Mobile users will also see poster thumbnails rendered correctly on video attachments.",
   "sourceUrl": "https://github.com/usememos/memos/releases/tag/v0.29.1",
   "lastChecked": "2026-07-12",
   "successor": null,
   "url": "https://bumplog.org/apps/memos/",
   "badge": "https://bumplog.org/badge/memos.svg",
   "lifecycle": null
  },
  {
   "slug": "kavita",
   "name": "Kavita",
   "repo": "Kareadita/Kavita",
   "latestVersion": "v0.9.0.2",
   "safeToUpdate": "breaking",
   "rationale": "The release notes explicitly state all users are strongly advised to update immediately due to a critical security vulnerability affecting all prior versions, which constitutes a mandatory upgrade step. No data migration or config changes are required, but the severity of the CVE makes skipping this update a meaningful risk. The OIDC validation change is behavioral but unlikely to affect most deployments.",
   "changelogSummary": "v0.9.0.2 is a critical security patch that all users are urged to apply immediately, addressing a vulnerability (CVE-2026-47202) affecting all prior releases. Beyond the security fix, OIDC validation has been relaxed to no longer require strict URL formats. The release also resolves a wide range of bugs including broken bookmarks (text, image, and epub), incorrect ratings always returning zero, annotation duplication and display failures, unreliable year-based search, and issues with series/collection metadata not updating correctly.",
   "sourceUrl": "https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2",
   "lastChecked": "2026-07-12",
   "successor": null,
   "url": "https://bumplog.org/apps/kavita/",
   "badge": "https://bumplog.org/badge/kavita.svg",
   "lifecycle": null
  },
  {
   "slug": "filebrowser",
   "name": "File Browser",
   "repo": "filebrowser/filebrowser",
   "latestVersion": "v2.63.18",
   "safeToUpdate": "safe",
   "rationale": "The release contains only bug fixes, translation updates, and dependency bumps. No breaking changes, required migrations, or configuration changes are mentioned in the notes.",
   "changelogSummary": "v2.63.18 is a maintenance release delivering translation updates and a deduplication fix for the Portuguese language entry. A bug causing unnecessary recursive conflict checks during copy and move operations has been resolved, which should improve reliability and performance for those actions. The EPUB reader receives a UI fix ensuring the table-of-contents button no longer overlaps the header. Dependencies have also been updated.",
   "sourceUrl": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.18",
   "lastChecked": "2026-07-13",
   "successor": null,
   "url": "https://bumplog.org/apps/filebrowser/",
   "badge": "https://bumplog.org/badge/filebrowser.svg",
   "lifecycle": null
  },
  {
   "slug": "netdata",
   "name": "Netdata",
   "repo": "netdata/netdata",
   "latestVersion": "v2.10.3",
   "safeToUpdate": "safe",
   "rationale": "The release notes describe only bug fixes with no breaking changes, required migrations, or manual upgrade steps called out. The behavioral changes (SNMP uptime source, job-name validation) are backward-compatible by design — the existing metric name is preserved and stricter collector rules remain intact.",
   "changelogSummary": "v2.10.3 is a targeted patch release fixing four distinct bugs. Most notably, a shared-memory pool leak in the eBPF plugin has been resolved — on busy hosts this leak would exhaust a 32,768-slot pool within roughly 15 hours and then spin a CPU core at 100%, so the fix will noticeably reduce CPU consumption for affected users. The SNMP collector's uptime source has been switched to avoid a ~497-day counter wrap, while preserving the existing metric name and a fallback path. Dynamic config job-name validation was loosened for service discovery, vnode, and secret-store names to allow dots (e.g., FQDNs), and a PowerStore hardware struct field causing response-decoding errors was removed.",
   "sourceUrl": "https://github.com/netdata/netdata/releases/tag/v2.10.3",
   "lastChecked": "2026-07-10",
   "successor": null,
   "url": "https://bumplog.org/apps/netdata/",
   "badge": "https://bumplog.org/badge/netdata.svg",
   "lifecycle": null
  },
  {
   "slug": "calibre-web",
   "name": "Calibre-Web",
   "repo": "janeczku/calibre-web",
   "latestVersion": "0.6.26",
   "safeToUpdate": "caution",
   "rationale": "The rename of the CACHE_DIR environment variable to CACHE_DIRECTORY is a breaking configuration change for any deployment that sets that variable explicitly. No database migration or other manual step is called out, but users with custom env configs must update before or immediately after upgrading to avoid misconfiguration.",
   "changelogSummary": "Calibre-Web 0.6.26 introduces multi-book editing from the book list, Instapaper support in Kobo sync, and EPUB reader improvements including a page count display, a new theme, and a back-to-library button. A notable rename affects the environment variable previously called CACHE_DIR, which is now CACHE_DIRECTORY, requiring a config update for anyone who set it explicitly. The release also patches Calibre 9 compatibility, fixes OPDS downloads in Readest on iOS and macOS, resolves several Caliblur theme issues, and closes a security gap where API keys could be exposed via config_sql.py.",
   "sourceUrl": "https://github.com/janeczku/calibre-web/releases/tag/0.6.26",
   "lastChecked": "2026-07-12",
   "successor": null,
   "url": "https://bumplog.org/apps/calibre-web/",
   "badge": "https://bumplog.org/badge/calibre-web.svg",
   "lifecycle": null
  },
  {
   "slug": "grocy",
   "name": "Grocy",
   "repo": "grocy/grocy",
   "latestVersion": "v4.6.0",
   "safeToUpdate": "breaking",
   "rationale": "The release notes explicitly flag (with a ⚠️ warning) that PHP 8.5 with SQLite 3.40+ is now the only supported runtime, making this a hard infrastructure prerequisite. Self-hosters running any earlier PHP version must upgrade their runtime before updating Grocy, constituting a required manual upgrade step. All other changes in the release are additive features or bug fixes with no additional migration notes.",
   "changelogSummary": "v4.6.0 raises the minimum runtime to PHP 8.5 with SQLite 3.40+, dropping support for all earlier PHP versions. On the stock side, quantity-unit handling is significantly improved — units can now be freely changed before a product ever enters stock, and missing 1:1 conversions are auto-created, which streamlines barcode-lookup plugin workflows. A handful of long-standing bugs are fixed across stock, shopping lists, chores, userfields, and the date-shorthand input parser. FreeBSD users on SQLite 3.41+ also receive a targeted SQL workaround.",
   "sourceUrl": "https://github.com/grocy/grocy/releases/tag/v4.6.0",
   "lastChecked": "2026-07-17",
   "successor": null,
   "url": "https://bumplog.org/apps/grocy/",
   "badge": "https://bumplog.org/badge/grocy.svg",
   "lifecycle": null
  },
  {
   "slug": "miniflux",
   "name": "Miniflux",
   "repo": "miniflux/v2",
   "latestVersion": "2.3.2",
   "safeToUpdate": "caution",
   "rationale": "The FIPS-mode fix replaces MD5 with SHA-256 for enclosure uniqueness and explicitly raises the minimum supported PostgreSQL version to 11; anyone on PostgreSQL 10 or below must upgrade their database first. All other changes are additive features, performance improvements, or bug fixes with no stated migration steps.",
   "changelogSummary": "Miniflux 2.3.2 delivers a meaningful search upgrade — full-text queries now support quoted phrases, OR operators, and negation via PostgreSQL's websearch_to_tsquery. The API gains new endpoints for paginated entry ID retrieval, bulk starring, and tag-based filtering. On the security side, login timing differences that could leak valid usernames are patched, and FIPS-mode PostgreSQL installations are now supported via SHA-256 instead of MD5 — though this raises the minimum required PostgreSQL version to 11. A broad set of bug fixes addresses enclosure proxying, nil pointer dereferences, API error codes, and localization formatting.",
   "sourceUrl": "https://github.com/miniflux/v2/releases/tag/2.3.2",
   "lastChecked": "2026-07-13",
   "successor": null,
   "url": "https://bumplog.org/apps/miniflux/",
   "badge": "https://bumplog.org/badge/miniflux.svg",
   "lifecycle": null
  },
  {
   "slug": "vikunja",
   "name": "Vikunja",
   "repo": "go-vikunja/vikunja",
   "latestVersion": "v2.3.0",
   "safeToUpdate": "caution",
   "rationale": "No explicit breaking changes or required migration steps are called out in the notes, but the introduction of a plugin system and OAuth 2.0 provider mode are significant architectural additions that may affect existing integrations or configuration. The 11 security fixes make upgrading urgent, so reviewing the full changelog at the linked URL before deploying is prudent.",
   "changelogSummary": "v2.3.0 ships 11 security fixes, making prompt upgrading strongly advisable. It introduces a new plugin system, adds Vikunja itself as an OAuth 2.0 provider, and brings WeKan and CSV import options. Desktop users gain a quick-entry window for faster task capture. The release spans 277 commits, reflecting a substantial cycle of improvements alongside the security work.",
   "sourceUrl": "https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0",
   "lastChecked": "2026-07-17",
   "successor": null,
   "url": "https://bumplog.org/apps/vikunja/",
   "badge": "https://bumplog.org/badge/vikunja.svg",
   "lifecycle": null
  },
  {
   "slug": "tubearchivist",
   "name": "TubeArchivist",
   "repo": "tubearchivist/tubearchivist",
   "latestVersion": "v0.5.10",
   "safeToUpdate": "caution",
   "rationale": "Two behavioral changes warrant attention before upgrading: the stricter download error handling (bot errors now stop the entire task) may surface failures that previously passed silently, and the overhauled POT plugin installation method could affect existing setups that relied on the prior loading path. The automatic cleanup of deprecated appconfig keys is also a one-way migration step. No explicit breaking changes or manual migration steps are documented, but these behavioral shifts are worth reading before applying the update.",
   "changelogSummary": "v0.5.10 adds the ability to load secrets from a file rather than environment variables, improving deployment security for sensitive configurations. The release also cleans up deprecated app-config keys automatically on startup. Several internal improvements ship alongside: the redownload workflow now uses reindex for better metadata preservation, the POT plugin installation method has been overhauled to fix runtime loading into yt-dlp, and download error handling is stricter — a bot error now halts the task entirely rather than continuing silently. Four bug fixes round out the release, including ES9 compatibility for newer Elasticsearch alias APIs and a fix for video deletion from playlists when out of sync.",
   "sourceUrl": "https://github.com/tubearchivist/tubearchivist/releases/tag/v0.5.10",
   "lastChecked": "2026-07-17",
   "successor": null,
   "url": "https://bumplog.org/apps/tubearchivist/",
   "badge": "https://bumplog.org/badge/tubearchivist.svg",
   "lifecycle": null
  },
  {
   "slug": "ntfy",
   "name": "ntfy",
   "repo": "binwiederhier/ntfy",
   "latestVersion": "v2.26.0",
   "safeToUpdate": "safe",
   "rationale": "The release notes call out no breaking changes, required migrations, or manual upgrade steps. The security fix (template DoS timeout) and XSS-class URL-stripping fix are strictly defensive hardening — both reduce risk without altering user-visible behavior in a breaking way. All other changes are opt-in features or polish.",
   "changelogSummary": "v2.26.0 patches a CPU denial-of-service vulnerability in message template execution by introducing a hard-capped timeout, making this a security-relevant release for anyone using the `Template: yes` feature. The web app gains configurable date and time formats (ISO 8601, DMY, MDY, 12/24-hour clock) that default to the system locale and sync across devices when signed in. A web rendering bug that allowed unsafe URL protocols like `javascript:` and `data:` in Markdown messages has been fixed, closing a potential XSS vector. Additional polish includes smoother page transitions, and the account view now reads from the primary database to avoid showing stale data after changes.",
   "sourceUrl": "https://github.com/binwiederhier/ntfy/releases/tag/v2.26.0",
   "lastChecked": "2026-07-19",
   "successor": null,
   "url": "https://bumplog.org/apps/ntfy/",
   "badge": "https://bumplog.org/badge/ntfy.svg",
   "lifecycle": null
  },
  {
   "slug": "headscale",
   "name": "Headscale",
   "repo": "juanfont/headscale",
   "latestVersion": "v0.29.2",
   "safeToUpdate": "safe",
   "rationale": "The release notes describe only bug fixes with no breaking changes, required migrations, or configuration changes. The standard upgrade guide is referenced, but no manual steps specific to v0.29.2 are called out.",
   "changelogSummary": "v0.29.2 is a bug-fix release addressing three reliability issues. A concurrency fix prevents mass-reconnect storms (triggered by autogroup:self, via, or relay policies) from serializing on the policy lock and stalling clients with 'unexpected EOF' errors. The /ts2021 endpoint now correctly accepts WebSocket GET upgrade requests, restoring connectivity for Tailscale JS/WASM control clients that were previously rejected with a 405. Nodes with invalid FQDNs (empty or exceeding the hostname length limit) are now skipped gracefully during map delivery rather than causing failures, with offending names logged at startup.",
   "sourceUrl": "https://github.com/juanfont/headscale/releases/tag/v0.29.2",
   "lastChecked": "2026-07-24",
   "successor": null,
   "url": "https://bumplog.org/apps/headscale/",
   "badge": "https://bumplog.org/badge/headscale.svg",
   "lifecycle": null
  },
  {
   "slug": "beszel",
   "name": "Beszel",
   "repo": "henrygd/beszel",
   "latestVersion": "v0.18.7",
   "safeToUpdate": "caution",
   "rationale": "The restriction of the universal token API to non-superuser accounts is a behavioral security change that could affect existing integrations or automations relying on that API with superuser credentials. The replacement of the battery library with an internal implementation may also subtly change battery metric behavior. All other changes are additive features or targeted bug fixes with no noted migration steps.",
   "changelogSummary": "v0.18.7 adds richer disk I/O metrics (utilization, read/write time, await, and queue depth) and lets users copy alerts between systems. A new SENSORS_TIMEOUT environment variable gives more control over sensor polling. Several platform-specific bugs are fixed: macOS ARM64 crashes, NVMe capacity reporting for Apple SSDs, Windows root disk detection, nested virtual filesystem handling in Docker, and OPNsense installation persistence. Security-related JS dependencies are upgraded and PocketBase is bumped to its latest version.",
   "sourceUrl": "https://github.com/henrygd/beszel/releases/tag/v0.18.7",
   "lastChecked": "2026-07-25",
   "successor": null,
   "url": "https://bumplog.org/apps/beszel/",
   "badge": "https://bumplog.org/badge/beszel.svg",
   "lifecycle": null
  }
 ]
}