Added:
- New changelog entries were published for changedetection.io, covering releases from 0.54.10 up to a new HEAD dated 2026-09-11 13:40:09 +0200.
- HEAD (2026-09-11): UI — the 'Paused' status icon now shows a red dot instead of yellow (#4418).
- 0.60.4:
  - UI — minor cell padding tweak on the watch list; larger list status icons and fixed icon text; Restock & Price column restored to the watchlist overview (#4410).
  - UI — Groups: fixed button alignment and improved form handling (#4409); watch stats tab gained extra debug output.
  - UI — Edit watch: notification error alert moved to the 'error' tab, and less-used Page Title and Link options hidden under a foldout (#4406).
  - UI — Mobile: recheck/edit buttons centred horizontally, row padding tidied, buttons no longer hidden on mobile (light opacity on desktop).
  - Performance — watched page lister now opens links with a single eval (#4405).
  - Feature — optional override link implemented (#4290).
  - Apprise notifications updated to 1.13.1 (#4404); API — DELETE for watch history (#4403).
  - Tests — fixed TestHistoryPathTraversal on macOS and added containment check coverage (#4390).
  - UI — language selector menu-bar icon clipping fixed; toast notifications moved down slightly; left menu now folds out on top of content, with improved VisualSelector & BrowserSteps width, dark-mode transitions off, and extra sidebar modes (#4401).
  - i18n — Traditional Chinese (zh_Hant_TW) translations updated (#4264); Indonesian translation added (#4402); translations rebuilt.
- 0.60.3:
  - Security — GHSA-56fq-63vj-9992: Add-watch UI made POST/CSRF protected (#4375).
  - UI — many actions that should be POST-style (and were causing 404s) fixed (#4370).
  - Translations — support for translation overlays/local translations of existing strings (#4365).
- 0.60.2:
  - Conditions — support for zero values in condition filtering and JSON logic conversion (#4362).
  - API — accepts an existing tag UUID in the watch `tag` field, with that behaviour deprecated (#4361).
  - Watch limit — new test added (#4360); `PAGE_WATCH_LIMIT` env var enhancements (#4359).
  - Watch loading — no longer crawls the whole disk, just checks each directory for watch.json/tag.json (#4358).
  - LLM — support for Gemini flash-lite and reasoning models, stripping extra_body on 400 retry (#4342); per watch/group settings and UI tidy-up (#4354); reasoning blocks that aren't well-formed ` thinking...` pairs handled (#4349); string boolean parsing, reasoning-model think stripping, and timestamp diff annotation fixed (#4340).
  - pyppeteer-ng updated to 2.0.0rc16 (#4357); litellm dependency cap updated (#4341).
  - UTF-8/lone surrogate encoding test improvements (#4353); memory usage improved by tidying module imports (#4352); GC freeze after startup to save CPU and improve memory management (#4351).
  - Pause Queue now pauses in the watch loop so it works with very long watch lists.
  - Scheduler/API bug — an invalid timezone set via watch edit or API could crash the scheduler; `timezone` added to official API docs (#4350).
  - Python 3.10 support dropped (EOL October 2026, conflicts with jsonschema and litellm) (#4347).
  - Puppeteer/Playwright CSP bypass test refactor (#4346); Puppeteer fetcher gained a page crash handler to protect the CDP session.
  - Backup — UTF-8 encoding added when writing URL list files (#4345).
  - Browser Steps picker can now select a `<select>` nested in a `<div>` (#4336).
  - Add watch UI — logic around browser selection/visibility tidied; now shows which browsers are available and sets a default browser (#4334).
  - Restock detection — fixed inverted condition that skipped the OpenGraph availability fallback (#4262).
  - Playwright CSP bypass made configurable (#4298).
  - Ukrainian support added for 'In stock'/'Not in stock' status (#4330); Polish translation added (#4329).
  - LIBXML data integrity fix — libxml must be locked across threads for any XML parsing (#4325).
  - Security fixes: GHSA-23mp-8222-96fr reflected XSS in /diff/<uuid>/download-patch via from_version (now uses built-in plain text response); GHSA-q85w-c766-h5g8 advisory for four unprotected routes in price_data_follower, check_proxy and language handling; GHSA-gwph-fp79-379w SSRF protection bypass via CGNAT addresses, also added to `ALLOW_IANA_RESTRICTED_ADDRESSES`; GHSA-4j9m-cxq4-9c36 improved validation of stored CSS injection via the `tag_colour` field (#4317); GHSA-56fq-63vj-9992 improved URL filtering (#4315); GHSA-3v57-xv5m-v7m7 multiple front-end endpoints lacking CSRF protection; GHSA-mh42-m7cg-49fr authenticated path traversal to arbitrary file write via the watch `processor` field (enum bypassed through /imports/import).
  - RSS — pubDate was wrong on non-UTC containers (local time relabelled as UTC) (#4314).
  - Feature — a watch or group can now append to the inherited AI Change Summary prompt (#4294).
  - CSRF test fix (#4316); development tools moved out of runtime requirements (#4280).
  - Security — running version hidden from anonymous visitors when a password is set (#4306).
  - docker-compose.yml updated with an `ALLOW_IANA_RESTRICTED_ADDRESSES` description.
  - UI — 'Live' renamed to 'Running'; watchlist row rendering moved out of the main template so it can be reused by realtime update (#4305).
  - Fixes — division by zero when logging watch load rate (#4289); favicon cache invalidation when clearing watch history (#4286); content-type detection fallback for `text/html` types (#4302); sanitizing lone unicode surrogates before filtering JSON (#4293); Visual Selector rendering scraped selectors as text rather than markup (#4282); LLM token counter race condition (#4276); restock.previous_price returning the first-ever price once a watch had 3+ snapshots (#4268); watches auto-tagged by group url_match_pattern regex missing from the group tab filter (#4267); reporting the actual 1-based failed browser-step number (#4258).
  - UI full refactor/upgrade (#4183).
- 0.55.8:
  - Restock LLM fallback content limit made configurable, default raised to 15,000 chars (#4257).
  - JavaScript UI strings not covered by translations fixed (#4255); shorter Russian translations used for main watchlist UI buttons.
  - LLM timeout raised or removed when a local endpoint is detected (#4254).
  - Safe-empty restock default so restock notification tokens work for any watch (#4249).
  - Watches no longer error when Content-Type is JSON but the body isn't parsable (#4250).
  - Russian (ru) translation added (#4236); Czech translation updated and refined (#4203).
  - Fixes — gitignore the actual test-log path (#4247); URL validation rejecting valid URLs with '|' in the anchor/fragment (#4243); LLM strips sampling params and retries when the model rejects them (#4241); all RSS endpoints bypass global auth when using a token (#4235); extracting `<title>` from pages with large `<head>` sections (#4220).
  - Restock — threshold change since "first check" actually worked as "since last check"; UI, tests and field name updated.
  - docker-compose.yml gained an `LLM_FEATURES_DISABLED` example.
- 0.55.7: UI/LLM fix for settings (wtforms vs pydantic) (#4184); smarter reasoning budget logic for Gemini models.
- 0.55.6: Security — SSRF via urlparse/urllib3 parser differential; LLM settings pydantic refactor (#4181); LLM UI blueprint/code disabled when `LLM_FEATURES_DISABLED` is set (#4180); missing `raw_diff` notification token restored (#4177); `LLM_FEATURES_DISABLED` flag added to disable all LLM from UI/system (#4171); preview problem fix for extract_text/ignore_text (#4169); dennis lint bumped to `--strict` mode (#4182).
- 0.55.5: LLM master on/off switch (#4162); fix for `'str' object is not callable` when `{{ diff(...) }}` callable tokens are used with HTML/htmlcolor output (#4161); Spanish translations for 'Changed' and 'Last Changed' fixed (#4160).
- 0.55.4:
  - API security — watch GET history snapshot now returns `text/plain` so it can't be executed in the browser (#4158).
  - LLM — SSRF guard for the `api_base` setting (#4157); UI & Ollama tweaks (#4148); model name no longer read-only and provider dropdown tidied (#4115); message that 'AI Intent' triggers need a bigger model; better override of formats and rules for intent/triggers; 'format' info removed from the system prompt so custom summary formats are possible; default prompt bumped; LiteLLM config UI tweaks (#4134); self-hosted OpenAI-compatible endpoint support (vLLM, LM Studio, llama.cpp) (#4117); summary cache miss-hit fixed (#4136); LLM status made sticky (#4135).
  - Docker — INSTALLED_MARKER kept in /datastore but package installs aren't persistent; now relies on pip instead of a custom marker file (#4147).
  - Text filters — ignore text now runs before 'extract text' (#4143); subtractive_selectors processed first (#4142).
  - API — better support for watch API private/internal vars; restock config added to API /v1/watch/ JSON output (#4103); watch.link was accidentally a tuple, now enforced as string (#4104).
  - UI — "Time between check" field labels re-ordered (#4128).
  - Notifications — HTML escaping/hygiene improvements so unescaped HTML can't become real HTML; only diff variables escaped before Jinja2 renders them into the template (#4123); extra check for system default (#4122).
  - Security — GHSA-vwgh-2hvh-4xm5 substring match in shared_diff_access, with improved access control (#4130).
  - i18n — broken HTML tags fixed and dennis lint warnings enforced in CI (#4116, #4105); pre-existing dennis warnings cleared in messages.pot (#4112); dennis .pot/.po lint added (#4097); Ruff INT (flake8-gettext) (#4096).
  - Czech l10n catalog sync (#4145); LiteLLM deps improved (#4102); UI — AI/LLM "Summary" button now sets last viewed (#4095).
- 0.55.3: languages recompiled.
- 0.55.2: typo fix where `{{diff_url}}` token was mentioned twice (#4094); desktop "Last Checked"/"Last Changed" aligned with mobile (#4090); OpenRouter config UI missing correct fields fixed (#4091); POT-Creation-Date frozen at a sentinel to stop per-locale churn (#4092); languages recompiled.
- 0.55.1:
  - Security — XML parser hardened against XXE; stored XSS via Tag Name in modal dialog; arbitrary local file read via crafted backup restore.
  - Korean language updated (#4084); "Usage" tab label in AI/LLM settings disambiguated (#4088); Playwright macro removed as unused, extra translation linting