Mealie Release Notes

🍴🍴🍴🍴🍴🍴

With the popularity of agentic AI, pull requests are popping and the contributors list keeps growing! Lots of exciting features and bug fixes in this release, and it's only been a week since the last one. Thanks to all our contributors, new and old!

🎉 Highlights

• The food seed data has been overhauled. Foods now properly link to labels and are closely coupled (i.e. when you seed foods, you also get their labels). They've also been slimmed down dramatically (>2,000 down to about 500) and cleaned up (typos, nonsense foods, etc.). New instances should have a much better start. Languages which don't use plurals in recipe managers (e.g. Korean) will also not seed plural food data.

• You can now drag and drop images directly from websites into your recipe instructions. Previously you'd have to download them first, but now Mealie will handle all that for you.

• We've upgraded to Python 3.14. For all users, you should see some marginal improvements to backend performance. For embedded users (e.g. through Home Assistant): if you were having issues with auth (such as being logged out all the time) we now implement CHIPS which should help!

✨ New features

• feat: filter cookbooks by food label @Xyolyp (#8385)
• feat: shopping list condensed view @kylerk (#8402)
• feat: refactor, reduce, and repair food seed data @hay-kot (#8482) …

🍴🍴🍴🍴🍴🍴

This release contains a few critical bug fixes for the previous version, as well as new connectivity testing for AI providers for non-admins.

✨ New features

• feat: add connectivity test for AI providers @elliot-ultra (#8123)

🐛 Bug fixes

• fix: forward attributes to recipe info card image @nzyz995 (#8399)
• fix: avoid useAsyncData in recipe timeline scroll handler @nzyz995 (#8400)
• fix: prevent recipe card tags from overlapping title @vmiwa (#8416)
• fix: respect household recipeDisableComments preference on recipe page @Luna-81 (#8424)
• fix: cURL fails when IPv6 isn't supported @michael-genson (#8425)
• fix: fall back to servings for recipe yield display @Tsuji-Hub (#7881)
• fix: prevent duplicate iOS camera photos from overwriting recipe step assets @RisonG (#8111)
• fix: make TypeScript generation deterministic @justadityaraj (#8356)
• fix: replace "mealplan" with "meal plan" @michael-genson (#8427)
• fix: keep instruction section and step headings when importing @Rouzax (#8331)
• fix: keep caller-supplied id when creating a model via auto_init @chiliec (#8432)

🧰 Maintenance

<details> <summary>6 changes</summary>

• chore(l10n): New Crowdin updates @hay-kot (#8406)
• chore(l10n): New Crowdin updates @hay-kot (#8412)
• chore(l10n): New Crowdin updates @hay-kot (#8413)
• chore(l10n): New Crowdin updates @hay-kot (#8420)
• chore(l10n): New Crowdin updates @hay-kot (#8428) …

🍴🍴🍴🍴🍴🍴

Welcome to the latest release of Mealie! We have tons of new features packed into this one, as well as a large collection of bug fixes. Check them out below 👇

🚨 BREAKING CHANGE

Mealie now checks where its own outgoing requests are going. Anything the server fetches on your behalf, such as importing a recipe from a URL, downloading a recipe image, sending a webhook, or running a recipe action, is only allowed to reach addresses on the public internet.

Webhooks and recipe actions were not checked before, and the checks on recipe imports were narrower than they are now. If any of these pointed at something on your own network, they will stop working after this update.

If you need a target on your own network to keep working, allow it explicitly with HTTP_ALLOW_LIST, which accepts hostnames or CIDRs. To keep a Tailscale host reachable, for example:

HTTP_ALLOW_LIST=100.64.0.0/10

For more information, check out the docs and the in-app announcement.

🎉 Highlights

You can now add substitutions to your ingredients. We support two kinds of substitutions:

Recipe-specific substitutions:

<img width="486" height="182" alt="image" src="https://github.com/user-attachments/assets/dd005f62-3dc3-42c3-87ba-0250e6ca39cd" /> …

🍴🍴🍴🍴🍴🍴

Patch release to fix auth issues when embedding Mealie in an iframe.

🐛 Bug fixes

• fix: translate recipe time units according to locale @deeumiya-huang (#8268)
• fix: remove unsupported partitioned cookie @michael-genson (#8278)

🧰 Maintenance

• chore(l10n): New Crowdin updates @hay-kot (#8270)

⬆️ Dependency updates

• chore(deps): update dependency coverage to v7.16.0 @renovate[bot] (#8266)
• fix(deps): update dependency openai to v3.6.0 @renovate[bot] (#8267)
• chore(deps): update dependency pylint to v4.0.8 @renovate[bot] (#8279)

🙏 New Contributors

• @deeumiya-huang made their first contribution in https://github.com/mealie-recipes/mealie/pull/8268

🍴🍴🍴🍴🍴🍴

🍴🍴🍴🍴🍴🍴

This release comes with an overhaul to Mealie's internal auth, making it more inline with what you generally expect, specifically with "Remember Me" and TOKEN_TIME.

• Tokens now refresh automatically before they expire. As long as you use the app before your token expires, it will automatically be refreshed with a new token. What this means for users is that you won't be logged-out mid-session, and you shouldn't have to log-in periodically unless you haven't used the app in some time (see TOKEN_TIME changes).
• Once you close your tab/browser/session, you will be logged-out. To stay logged-in between sessions, check "Remember Me" when logging in. Since this is the opposite behavior of how logins worked before this change, "Remember Me" is checked by default to help ease the learning curve.
• TOKEN_TIME now defines how long a session will last before expiring. Many instances previously set this value arbitrarily high to prevent users from being logged-out. Now with auto-refresh this is unnecessary, and can be substantially lowered (we recommend turning this down to at most 168 hours, i.e. one week).

⚠️⚠️⚠️ IMPORTANT BREAKING CHANGE FOR APP DEVELOPERS ⚠️⚠️⚠️

GET /api/auth/refresh has been removed, and is instead now a POST API.

🎉 Highlights

• Overhauled internal auth (see above)
• You can now delete unused organizers from the data management page …

🍴🍴🍴🍴🍴🍴

🎉 Highlights

• The meal planner features a much-improved recipe selector when editing entries directly:

  <img width="1020" height="664" alt="Screenshot 2026-08-24 at 11 28 34 AM" src="https://github.com/user-attachments/assets/ac427920-2f8f-4eba-9ed2-41742d3eb876" />

• Several improvements have been made to lower idle RAM usage and speed up startup time.

✨ New features

• feat: improve meal planner editor @michael-genson (#8152)
• feat: remove share text @michael-genson (#8168)
• feat: Added support for disable services @Choromanski (#7434)
• feat: add optional linked ingredients to print view @BWagener (#7632)
• feat: lazy module loading and deferred pydantic build @michelezoncheddu (#7316)
• feat: allow user to specify cookiefile for yt-dlp @space192 (#7363)
• feat: add URL-backed cook mode for recipe pages @micsco (#7287)

🐛 Bug fixes

• fix: registration with seed data returns a 500 @justadityaraj (#8170)
• fix: return HTTP 200 for SPA fallback responses @roadhero (#7656)

🧰 Maintenance

<details> <summary>7 changes</summary>

• chore(l10n): New Crowdin updates @hay-kot (#8135)
• chore(l10n): New Crowdin updates @hay-kot (#8144)
• chore(l10n): New Crowdin updates @hay-kot (#8155)
• chore(l10n): New Crowdin updates @hay-kot (#8161)
• chore: remove unused translations and unused icons @michael-genson (#8169) …

🍴🍴🍴🍴🍴🍴

🎉 Highlights

Simplified AI Imports

Importing recipes with AI has been vastly improved. Rather than several disparate import pages, you now import recipes with AI via the universal "Import with AI" page: <img width="943" height="627" alt="image" src="https://github.com/user-attachments/assets/e31de7c0-1911-4243-91a0-2ec5100a9eb1" />

From here you can also choose several options previously only featured on a handful of pages: <img width="339" height="219" alt="image" src="https://github.com/user-attachments/assets/e3174eac-0662-4344-b714-9caf1444cac6" />

The internals of how your providers are called has been rewritten as well to break up import tasks into separate calls to your provider, shrinking context windows and producing more consistent results.

Native OIDC endpoints

We now have native OIDC endpoints for OIDC services which only work via passkey (or otherwise don't rely on the browser session), such as Pocket ID and authentik. These should now work for you out of the box (see: https://github.com/mealie-recipes/mealie/pull/7804).

✨ New features

• feat: add re-roll button to meal planner entries @smashngrabb (#7348)
• feat: add native OIDC endpoints for mobile/desktop clients @DmitriiSer (#7804)
• feat: Unified AI recipe page @michael-genson (#8043)
• feat: skip expiring share link for fully-public groups/households @bferd (#7941)
• feat: Update ingredient parsing text @michael-genson (#8066) …

🍴🍴🍴🍴🍴🍴

The previous version of Mealie (v3.21.0) introduced a ⚠️BREAKING CHANGE⚠️ for instances using OIDC: Mealie now requires your OIDC provider to confirm the user's email address before allowing the login. This prevents an unverified, self-asserted email address from being used to match (and sign in) to an existing Mealie account.

If an identity provider does not emit the email_verified claim, logins now fail. If you cannot configure your identity provider to include the email_verified claim, you can set OIDC_REQUIRES_EMAIL_VERIFICATION to false (this is not recommended per the above security concerns). See the docs for more details.

🎉 Highlights

New to this release, many improvements have been made to make importing recipes more reliable. Mealie does a better job of looking like a real browser, rotates between several browser signatures, and retries more intelligently when a site pushes back. This works out of the box, with no configuration.

For sites sitting behind extra bot protection (such as Cloudflare) server admins have two additional controls:

• Proxy support, which routes recipe and image requests through a proxy. This helps with sites that block your server's IP address. …

🍴🍴🍴🍴🍴🍴

This release brings a couple new features and a slew of bug fixes.

✨ New features

• feat: Added sitewide statistics @Choromanski (#7322)
• feat: ui fixes & backup link on onboarding screen @p0lycarpio (#7743)
• feat: floating save button when editing recipe @DeepReef11 (#7320)

🐛 Bug fixes

• fix: Manually implement nltk.downloader using cURL @michael-genson (#7817)
• fix: clear cached recipe actions on logout to prevent cross-user leak @shved270189 (#7815)
• fix: shopping list UI improvements @p0lycarpio (#7215)
• fix: Fix embedded tokens not persisting across sessions @michael-genson (#7860)
• fix: re-enable automatic merges with crowding CI @hay-kot (#7886)
• fix: preserve deep link when redirecting to login @henricook (#7876)
• fix: truncate scraped recipe slug to filesystem-safe length @TowyTowy (#7862)
• fix: handle IntegrityError with 409 conflict response @gitolicious (#7712)
• fix: prevent empty bulk add from clearing import URLs @ft4453080 (#7820)
• fix: wrap long words in timeline to prevent horizontal scroll @shved270189 (#7819)
• fix: scope bulk update/delete repository methods to caller's group/household @hay-kot (#7899)
• fix: harden LDAP and OIDC authentication providers @hay-kot (#7902)
• fix: restrict user ratings and favorites reads to the requesting user @hay-kot (#7903)
• fix: Fix flaky ratings on mobile @michael-genson (#7916)
• fix: Simplify rating logic @michael-genson (#7918) …