**Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.55.2...0.55.3

## What's Changed CVE-2026-35490 - Authentication Bypass via Decorator Ordering * Extendable theme pluggy implementation by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/4011 * CI - Ensure all unit tests are run by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/4022 * Update openapi-core requirement from ~=0.22 to ~=0.23 by @dependabot[bot] in https://github.com/dgtlmoon/changedetection.io/pull/4009 **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.54.7...0.54.8

## What's Changed * Update messages.po in French translation by @RithyNicolasTAN in https://github.com/dgtlmoon/changedetection.io/pull/3926 * Adding Ukrainian (uk) translations, rebuilding translations. by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3936 * CVE-2026-27696 Small fix - Restricted hostnames can still be added but are only checked at fetch-time (not when rendering lists etc) by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3938 ## New Contributors * @RithyNicolasTAN made their first contribution in https://github.com/dgtlmoon/changedetection.io/pull/3926 **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.54.2...0.54.3

## What's Changed * Fixing `change_datetime` notification token (and adding test) by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3922 * Notification Token {{diff}} can accept arguments like `{{diff_added(lines=5, context=2)}}` by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3923 * Processor extensible API for updating by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3902 * Update jsonpath-ng requirement from ~=1.7.0 to ~=1.8.0 by @dependabot[bot] in https://github.com/dgtlmoon/changedetection.io/pull/3929 * Bump the all group with 2 updates by @dependabot[bot] in https://github.com/dgtlmoon/changedetection.io/pull/3931 * Unresolvable hostnames should still be added, they are security checked at fetch time by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3933 **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.54.1...0.54.2

- CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var `ALLOW_IANA_RESTRICTED_ADDRESSES` to `true` to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc. - CVE-2026-27645 - Reflected XSS in RSS Single Watch request **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.53.7...0.54.1

## What's Changed * Pip installs - remove flask patch and pin library versions by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3912 https://github.com/dgtlmoon/changedetection.io/issues/3910 * Fixing exclude compression (which has some kind of memory leak with flask-socketio) **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.53.5...0.53.6

## What's Changed * Backup restore by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3899 * Fixing bad replacement of metadata causing possible content removal #3906 by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3908 **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.53.4...0.53.5

## What's Changed * API - Skip validation errors about server path (allows use on sub-paths/reverse proxy etc) by @dgtlmoon in https://github.com/dgtlmoon/changedetection.io/pull/3886 **Full Changelog**: https://github.com/dgtlmoon/changedetection.io/compare/0.53.2...0.53.3