v0.25.0

Note

As always, we highly recommend making a backup of your databases and files before upgrading!

Important

This release fixes CVE-2026-40196 which allowed a user removed from their default group to still access it via the API.

Big Changes

• Tag Relationships: Tags can now have parents/children, and icons.
• Fractional/Decimal Quantities: You can now have partial quantities like 1.2, 3.45, etc.
• User Settings Stored in DB: Your user preferences are now stored in the DB, settings persist across devices and browsers.
• OpenTelemetry Support: Homebox now has basic OpenTelemetry tracing, logging and error tracking. While not full and in-depth yet, it has already proven useful in finding issues and potential performance problems.
• More Barcode Providers: OpenFoodFacts, OpenBeautyFacts, and OpenProductsFact have been added as providers to broaden the support for scanning product barcodes for metadata.
• And plenty of other improvements and bug fixes.

What's Changed

• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1365
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1366
• Update to go 1.26, and other various backend updates by @tankerkiller125 in #1364
• chore(deps): bump flatted from 3.3.3 to 3.4.1 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1370
• Add OpenTelemetry tracing to backend and frontend with full chain support in #1256
• chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 in /backend in the go_modules group across 1 directory by @dependabot[bot] in #1383
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1382
• Improve tag handling by @tankerkiller125 and @tonyaellie in #1327
• chore(deps): bump flatted from 3.4.1 to 3.4.2 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1385
• Add backend to store user settings in the DB by @tankerkiller125 and @tonyaellie in #958
• Add a page for tags by @tonyaellie in #1392
• feat: fractional/decimal quantity by @tankerkiller125 in #1372
• Fix incorrectly generated Swagger docs for /labelmaker/asset/{id} route by @adarshp in #1084
• chore(deps): bump brace-expansion from 1.1.12 to 1.1.13 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1399
• chore(deps): bump node-forge from 1.3.3 to 1.4.0 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1400
• feat(frontend): Make group invitation link work when user is logged in by @mdrkrg in #1412
• fix: apply collection currency changes immediately by @IceeAn in #1409
• feat: add OpenFoodFacts as barcode lookup provider by @palini762 in #1406
• Add Open Facts barcode sources by @RobinMJD in #1426

New Contributors

• @adarshp made their first contribution in #1084
• @mdrkrg made their first contribution in #1412
• @palini762 made their first contribution in #1406
• @RobinMJD made their first contribution in #1426

Full Changelog: v0.24.2...v0.25.0

v0.25.0-rc.1

What's Changed

• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1365
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1366
• Update to go 1.26, and other various backend updates by @tankerkiller125 in #1364
• chore(deps): bump flatted from 3.3.3 to 3.4.1 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1370
• Add agentic workflow daily-doc-updater by @tankerkiller125 in #1373
• Add OpenTelemetry tracing to backend and frontend with full chain support in #1256
• chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 in /backend in the go_modules group across 1 directory by @dependabot[bot] in #1383
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1382
• Improve tag handling by @tankerkiller125 and @tonyaelli in #1327
• chore(deps): bump flatted from 3.4.1 to 3.4.2 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1385
• Add backend to store user settings in the DB by @tankerkiller125 and @tonyaelli in #958
• Add a page for tags by @tonyaellie in #1392
• feat: fractional/decimal quantity by @tankerkiller125 in #1372
• Fix incorrectly generated Swagger docs for /labelmaker/asset/{id} route by @adarshp in #1084

New Contributors

• @adarshp made their first contribution in #1084

Full Changelog: v0.24.2...v0.25.0-rc.1

v0.24.2

• Actually fixes the item page crash (multiple validated reports and tests)

Full Changelog: v0.24.1...v0.24.2

v0.24.1

What's Changed

• fix: stop the items page crashing when attachments connected
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1355
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in #1357

Full Changelog: v0.24.0...v0.24.1

v0.24.0

Important

This release includes 3 security vulnerability patches. These include issues with CVE scores ranging from 4.6 to 7.4 scores.

• 7.4 CVE-2026-27981
• 5.0 CVE-2026-27600
• 4.6 CVE-2026-26272

Thank you to @G3XAR and @djnnvx for their responsible disclosures of these issues.

What's Changed

• Add Documentation Detailing Websocket Requirement for Reverse Proxies by @KevinFumbles in #1297
• Add a tenant get param when generating labels on the item page. by @cdjk in #1303
• Migrate to Startlight Documentation by @tankerkiller125 in #1304
• docs: update links in README.md by @IceeAn in #1314
• feat: add new field types to template_fields schema by @tankerkiller125 in #1315
• fix: tenant miss in export download URLs by @IceeAn in #1313
• fix: hardcoded frontend strings by @IceeAn in #1311
• chore(deps): bump nanotar from 0.2.0 to 0.2.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1317
• Update incorrect env variables in quick-start/configure/database by @KillerOfPie in #1320
• fix: improve mobile image popup sizing by @IceeAn in #1321
• feat: add skip-first-labels and location-row toggle to label generator by @max2697 in #1306
• chore(deps): bump markdown-it from 14.1.0 to 14.1.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1324
• implement show/hide items for locations tree by @tonyaellie in #1328
• chore(deps): bump ajv from 8.17.1 to 8.18.0 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1330
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1331
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in #1334
• feat: add configurable security options for generic notifiers by @tankerkiller125 in #1335
• Update currencies.json by @github-actions[bot] in #1329
• fix(currencies): update CLP decimals to 0 to comply with ISO 4217 by @sRamosDev in #1342
• chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1347

New Contributors

• @KevinFumbles made their first contribution in #1297
• @cdjk made their first contribution in #1303
• @IceeAn made their first contribution in #1314
• @KillerOfPie made their first contribution in #1320
• @max2697 made their first contribution in #1306
• @sRamosDev made their first contribution in #1342

Full Changelog: v0.23.1...v0.24.0

v0.24.0-rc.1

What's Changed

• Add Documentation Detailing Websocket Requirement for Reverse Proxies by @KevinFumbles in #1297
• Comprehensive backend cleanup with github.com/samber/lo helpers by @Copilot in #1301
• Add a tenant get param when generating labels on the item page. by @cdjk in #1303
• Migrate to Startlight Documentation by @tankerkiller125 and @tonyaellie in #1304
• docs: update links in README.md by @IceeAn in #1314
• feat: add new field types to template_fields schema by @tankerkiller125 in #1315
• fix: tenant miss in export download URLs by @IceeAn in #1313
• fix: hardcoded frontend strings by @IceeAn in #1311
• chore(deps): bump nanotar from 0.2.0 to 0.2.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1317
• Update incorrect env variables in quick-start/configure/database by @KillerOfPie in #1320
• fix: improve mobile image popup sizing by @IceeAn in #1321
• feat: add skip-first-labels and location-row toggle to label generator by @max2697 in #1306
• chore(deps): bump markdown-it from 14.1.0 to 14.1.1 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1324
• implement show/hide items for locations tree by @tonyaellie in #1328
• chore(deps): bump ajv from 8.17.1 to 8.18.0 in /docs in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1330
• chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1331
• chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by @dependabot[bot] in #1334
• feat: add configurable security options for generic notifiers by @tankerkiller125 in #1335

New Contributors

• @KevinFumbles made their first contribution in #1297
• @cdjk made their first contribution in #1303
• @IceeAn made their first contribution in #1314
• @KillerOfPie made their first contribution in #1320
• @max2697 made their first contribution in #1306

Full Changelog: v0.23.1...v0.24.0-rc.1

v0.23.1

Changes

• Fixes attachments not appearing
• Fixes QR Codes missing URL portion
• Fixes Tag Dropdown not closing
• Fixes version link in bottom of page

Full Changelog: v0.23.0...v0.23.1

v0.23.0

Caution

You can not revert back to a previous version of Homebox after upgrading to this release due to SQL > schema changes. Always ensure that you have functioning backups before upgrading.

Big New Changes

Removal of 32-bit Support

Starting with this release, Homebox is no longer available in 32bit forms, this include ARMv7 and older, and x86 processors.

Collections

Users can now be part of multiple collections; each collection is entirely separate and unique. This gives users more flexibility than ever when managing inventories, especially across different homes or shared spaces.

User Management

Along with collections, we've added some basic user management capabilities for collections. This is not yet full blown "Super User" type management, but it does make things a little bit easier.

Authentication Rate Limiting

We've also introduced a new rate limiting middleware for authentication requests, helping to further secure Homebox against brute force attacks.

Better Memory Management

Attachment uploads now use less memory thanks to improved optimizations in handling. Additionally, CSV imports no longer read the entire file just to determine a delimitator (which caused both memory and performance issues)

MQTT Client Now Available in Docker Containers

The MQTT client is now available in the regular and rootless docker containers, Hardened docker containers do not have the MQTT client due to the distroless nature of that container image.

What's Changed

• Add CI/CD workflow for upgrade testing with data integrity verification by @Copilot in #1178
• refactor(backend): use constants for database driver names by @harrisony in #1177
• Remove 32bit builds by @tankerkiller125 in #1000
• Add Wipe Inventory action with demo mode protection, owner restriction, and optional wipe of labels/locations/maintenance by @Copilot in #1179
• Fix wipe inventory action: dialog callback and deletion order by @Copilot in #1185
• fix(items): update quantity display immediately on increment/decrement by @Wrr2216 in #1181
• Add repository onboarding instructions for Copilot coding agents by @Copilot in #1187
• Fix wipe inventory confirm button, publish mutation events, and add E2E tests by @Copilot in #1186
• Refactor Wipe Inventory E2E tests by @katosdev in #1198
• Bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1203
• chore(deps): bump preact from 10.28.1 to 10.28.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1221
• Add MQTT to Docker by @FuzzyMistborn in #1228
• feat(label-generator): Allow hiding "Homebox" text on labels by @tturnerdev in #1150
• Fix unable to change password in password modal due to missing component import by @Billiam in #1240
• M:M User and Group Relationship by @tankerkiller125 in #1174
• Optimize RAM usage in attachment upload and thumbnail processing by @Copilot in #1243
• Convert labels to tags by @tonyaellie in #1192
• fix(items page): watch search query from navbar search by @duckimann in #1236
• Add Create Item button on location page by @mesab0ogie in #1189

New Contributors

• @FuzzyMistborn made their first contribution in #1228
• @tturnerdev made their first contribution in #1150
• @Billiam made their first contribution in #1240
• @duckimann made their first contribution in #1236
• @mesab0ogie made their first contribution in #1189

Full Changelog: v0.22.3...v0.23.0

v0.23.0-rc.1

What's Changed

• Add CI/CD workflow for upgrade testing with data integrity verification by @Copilot in #1178
• refactor(backend): use constants for database driver names by @harrisony in #1177
• Remove 32bit builds by @tankerkiller125 in #1000
• Add Wipe Inventory action with demo mode protection, owner restriction, and optional wipe of labels/locations/maintenance by @Copilot in #1179
• Fix wipe inventory action: dialog callback and deletion order by @Copilot in #1185
• fix(items): update quantity display immediately on increment/decrement by @Wrr2216 in #1181
• Add repository onboarding instructions for Copilot coding agents by @Copilot in #1187
• Fix wipe inventory confirm button, publish mutation events, and add E2E tests by @Copilot in #1186
• Refactor Wipe Inventory E2E tests by @katosdev in #1198
• Bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in #1203
• chore(deps): bump preact from 10.28.1 to 10.28.2 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1221
• Add MQTT to Docker by @FuzzyMistborn in #1228
• feat(label-generator): Allow hiding "Homebox" text on labels by @tturnerdev in #1150
• Fix unable to change password in password modal due to missing component import by @Billiam in #1240
• M:M User and Group Relationship by @tankerkiller125 and @tonyaellie in #1174
• Optimize RAM usage in attachment upload and thumbnail processing by @Copilot in #1243
• Convert labels to tags by @tonyaellie in #1192
• fix(items page): watch search query from navbar search by @duckimann in #1236
• Add Create Item button on location page by @mesab0ogie in #1189

New Contributors

• @FuzzyMistborn made their first contribution in #1228
• @tturnerdev made their first contribution in #1150
• @Billiam made their first contribution in #1240
• @duckimann made their first contribution in #1236
• @mesab0ogie made their first contribution in #1189

Full Changelog: v0.22.3...v0.23.0-rc.1

v0.22.3

What's New

• Fix notifiers getting wiped on upgrade

(If you've been impacted by this bug, restore from backup, and then upgrade to v0.22.3)

Full Changelog: v0.22.2...v0.22.3