Release 1.8 - #161
Merged
Merged
Conversation
Splits the changelog, which had been filing 1.8 work under the 1.7 heading. Everything from the Security section down to the Plugin Platform entry landed after the v1.7 tag: the TLS scoping (#139), the credential re-encryption, chore icons (#141), the completion celebration (#140) and Home Assistant weather (#57). Those move into a new 1.8 section; the restored 1.7 section is now byte-identical to what v1.7 actually shipped. Adds the 1.8 work that had no entry yet: the @fastify/static CVE upgrade (#136), Spanish and the i18n groundwork (#137/#138), plugin descriptions and previews (#147), user ordering (#134), the calendar Today control (#144), per-device user visibility in chores (#145), the plugin data-changed channel (#148/#149), and the community fixes from @Leesam, @cosmosified, @mrramam and @anupamme. Deployment guide: the .env recipe still told operators to generate an ENCRYPTION_KEY and the note below it still said to add one to the backend service. Neither has been true since credentials moved to the auto-generated key -- the compose file passes it through already, and one is generated on first start. Replaced with what to actually do, which is back up homeglow/data. Versions bumped to 1.8.0 in both package.json files and their lockfiles. Note the About tab reads its version from the git tag at build time, so the tag is what users will see; these keep local runs honest. Deliberately not touched: the LICENSE. A commit in this cycle reads "Change license from APGLv3 to MIT", but it edited a single comment line in the Proxmox community-scripts installer, whose header points at the ProxmoxVE project's licence by convention. HomeGlow itself is still AGPLv3, so the release notes do not claim otherwise. Verified: client 167/167, server 216/216, translation parity check passes, production build clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the 1.8 release: changelog, package versions, deployment notes.
The changelog needed splitting, not just extending
The top section was headed v 1.7 but had been collecting 1.8 work. Comparing against the
v1.7tag settles which is which — everything from## Securitydown to the Plugin Platform entry landed after the tag:Those move into a new 1.8 section. The restored 1.7 section is now byte-identical to what
v1.7actually shipped (verified withdiffagainst the tag).Added the 1.8 work that had no entry
@fastify/staticCVE upgrade (fix: upgrade @fastify/static to 10.1.3 with setHeaders API migration (CVE-2026-15074) #136) — CVE-2026-15074 route-guard bypass, no 9.x backport — @anupammeDeployment notes were actively wrong
The
.envrecipe told operators to generate anENCRYPTION_KEY, and the note below it said to add one to the backend service. Neither has been true since credentials moved to the auto-generated key — compose already passes it through, and one is generated on first start. Replaced with what to actually do: back uphomeglow/data.Versions
1.7.0→1.8.0in bothpackage.jsonfiles and their lockfiles (version fields only — no dependency churn).Worth knowing: the About tab reads
VITE_APP_VERSION/BACKEND_VERSIONfrom the git tag at build time, so the tag is what users actually see. These bumps keep local and source runs honest.One thing deliberately not done
A commit in this cycle reads "Change license from APGLv3 to MIT". It edited a single comment line in the Proxmox community-scripts installer, whose header points at the ProxmoxVE project's licence by convention.
LICENSEis still AGPLv3 and no other file claims otherwise, so the release notes don't say the project was relicensed. Flagging it in case the intent was actually to relicense — that's your call, not a release-prep edit.Verification
npm run check:i18n— translation parity passesv1.7tag: identicalWhat happens next
Merging this does not release anything. Publishing is triggered by pushing a
v1.8tag, which builds both images and moves:latest— that's the irreversible step, so I've stopped here.🤖 Generated with Claude Code