All versions since v0.25.0

v0.25.0

Apr 13, 2026

[!NOTE] As always, we highly recommend making a backup of your databases and files before upgrading!

[!IMPORTANT] This release fixes CVE-2026-40196 which allowed a user removed from their default group to still access it via the API.

Big Changes

Tag Relationships: Tags can now have parents/children, and icons.
Fractional/Decimal Quantities: You can now have partial quantities like 1.2, 3.45, etc.
User Settings Stored in DB: Your user preferences are now stored in the DB, settings persist across devices and browsers.
OpenTelemetry Support: Homebox now has basic OpenTelemetry tracing, logging and error tracking. While not full and in-depth yet, it has already proven useful in finding issues and potential performance problems.
More Barcode Providers: OpenFoodFacts, OpenBeautyFacts, and OpenProductsFact have been added as providers to broaden the support for scanning product barcodes for metadata.
And plenty of other improvements and bug fixes.

What’s Changed

chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1365
chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1366
Update to go 1.26, and other various backend updates by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1364
chore(deps): bump flatted from 3.3.3 to 3.4.1 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1370
Add OpenTelemetry tracing to backend and frontend with full chain support in https://github.com/sysadminsmedia/homebox/pull/1256
chore(deps): bump google.golang.org/grpc from 1.79.2 to 1.79.3 in /backend in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1383
chore(deps): bump the npm_and_yarn group across 2 directories with 1 update by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1382
Improve tag handling by @tankerkiller125 and @tonyaellie in https://github.com/sysadminsmedia/homebox/pull/1327
chore(deps): bump flatted from 3.4.1 to 3.4.2 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1385
Add backend to store user settings in the DB by @tankerkiller125 and @tonyaellie in https://github.com/sysadminsmedia/homebox/pull/958
Add a page for tags by @tonyaellie in https://github.com/sysadminsmedia/homebox/pull/1392
feat: fractional/decimal quantity by @tankerkiller125 in https://github.com/sysadminsmedia/homebox/pull/1372
Fix incorrectly generated Swagger docs for /labelmaker/asset/{id} route by @adarshp in https://github.com/sysadminsmedia/homebox/pull/1084
chore(deps): bump brace-expansion from 1.1.12 to 1.1.13 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1399
chore(deps): bump node-forge from 1.3.3 to 1.4.0 in /frontend in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/sysadminsmedia/homebox/pull/1400
feat(frontend): Make group invitation link work when user is logged in by @mdrkrg in https://github.com/sysadminsmedia/homebox/pull/1412
fix: apply collection currency changes immediately by @IceeAn in https://github.com/sysadminsmedia/homebox/pull/1409
feat: add OpenFoodFacts as barcode lookup provider by @palini762 in https://github.com/sysadminsmedia/homebox/pull/1406
Add Open Facts barcode sources by @RobinMJD in https://github.com/sysadminsmedia/homebox/pull/1426

New Contributors

@adarshp made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1084
@mdrkrg made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1412
@palini762 made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1406
@RobinMJD made their first contribution in https://github.com/sysadminsmedia/homebox/pull/1426

Full Changelog: https://github.com/sysadminsmedia/homebox/compare/v0.24.2…v0.25.0

v0.26.0

Jun 13, 2026

[!CAUTION] We recommend skipping direct to v0.26.1, this release has an issue with attachments for docker containers.

[!NOTE] As always, we highly recommend making a backup of your databases and files before upgrading! But especially this one for it’s major architecture changes.

[!WARNING] This release requires an additional environment variable or CLI parameter to be set. HBOX_AUTH_API_KEY_PEPPER or --auth-api-key-pepper must be set to at least 32 characters random secret.

Biggest Release Yet!

This is by far the biggest, most comprehensive release of Homebox since we took over. Below are the biggest, most important changes. Please read through the warnings and notes carefully, as they contain important upgrade information.

Entity Merge

This release officially implements the entity merge, one of the most comprehensive and complex changes to the Homebox backend ever. Items and locations now share a single underlying “entity” structure, allowing them to share custom fields, attachments, entity types, and templates — and preparing Homebox to take on the features and capabilities people have been asking for.

[!WARNING] The entity merge introduces significant database re-work. You should always make a backup before updating, but a backup is especially important in this case.

[!IMPORTANT] If you are an integration/software developer, the /v1/items* and /v1/locations* endpoints have been entirely replaced by /v1/entities*. Please review our entity merge documentation for the API changes.

API Keys

Homebox can now generate static API Keys for developers/integrations. Each key takes on the access level of the user who created it. All Homebox keys are prefixed with hb_ to help prevent secrets from being accidentally committed to source code repositories.

Password Resets

Homebox now supports password resets. If the instance admin configures the SMTP environment variables, users can reset their password from the front-end quickly and easily. For those not wanting to set up SMTP, you can run homebox reset-password --email=<email>, which outputs a random new password for that user (which they can then change from the UI).

Better Export/Import (Experimental)

Thanks to the entity merge, you can now export an entire collection’s inventory (including attachments, tags, entities, etc.) into a single ZIP file. That ZIP can then be imported into a different Homebox instance (the receiving collection must be “empty”). A recurring background export task is included as well.

”AR” Scanner

Added more as a fun experiment, but we think some people will find it genuinely useful. Switch to “AR” mode and point your camera at a Homebox QR code — a hovering box appears with basic information about the entity, and if it has children, a list of those child entities.

Other Improvements

External URL attachments — attach HTTP(S) links to entities via drag-and-drop; rendered as direct hyperlinks and stored as DB records (no blob storage used).
Convert entity type — convert an item into a location (or vice versa) directly from the edit view.
Entity types UI — new entity-types management page with improved UI and page titles.
Remember selected camera in the scanner.
Nix flake for reproducible dev/build environments.
Config redaction & stronger security protections, stronger API-key pepper hashing, group/permission fixes, and extensive new tracing.
Numerous bug fixes: CSV import/export (parent relationships, location export), dark-theme styling, legacy Windows attachment paths, WebSocket auth/retry, DNS64 support, password-manager support, Swagger BaseURL, and more.