# Your Kitchen Library v1.0.4 — Security and Automatic Update Release

Released October 23, 2026.

This is a maintenance and security release for existing v1 installations and new installations. It includes the October PHP security corrections, product fixes already verified on the hosted demo and production sites, and an Owner-controlled automatic stable update policy.

## Security updates

- PHP Apache runtime upgraded to **PHP 8.5.12**, covering the October 21, 2026 PHP security fixes. Install/upgrade Docker builds explicitly run `build --pull web` so previously cached PHP base layers do not silently remain installed.
- The official phpMyAdmin container is kept on its independently maintained patched vendor image; **do not force phpMyAdmin onto a custom PHP 8.5 image**. The published Compose file disables native `session.upload_progress.enabled` in phpMyAdmin, and the web PHP config disables it as well.
- Containers still bind public services to localhost by default, keep MariaDB off public host ports, and separate the website from Docker/root access.

## Automatic stable updates

- The existing trusted host updater now supports **Automatic stable updates**, selected by the Owner under **Admin → Software Updates** and confirmed once with `AUTO`. The default is still manual until explicitly enabled.
- A separate root-owned host timer on Linux or administrator-controlled Synology DSM Task Scheduler checks the fixed official release catalog approximately every 12 hours, and installs newer, verified stable releases without recurring approvals.
- **Safety limit:** Unattended upgrades install only if the preflight shows **zero pending database migrations**. Updates with schema changes remain available for explicit Owner approval. Failed updates stop automatic retries and preserve recovery materials.
- Host-only status, logs, and update policy are never writable by web PHP. The website queues only strictly validated requests and has no Docker socket or server shell.
- Windows Docker Desktop host scheduling is not fully validated. Do not claim Windows unattended updates are supported yet.
- Automatic runtime-only patch channels, independent cryptographic publisher signing and independent automatic disaster recovery remain future security work. New PHP security patches must be incorporated into tested numbered product releases.

## Application maintenance

- Improved **Prepare Shopping List**: first-column Skip, Bought on the live shopping checklist only, optional pantry package settings, visible pantry Skip state, and saved Skip decisions reliably applied when viewing/printing.
- New pantry staples default to Skip, with a clear option to uncheck them for restocking.
- Improved **Add/Edit Recipe** field organization, grouping seldom-used media and optional sections.
- Ingredient section headings such as `For the Filling (Savory Potato & Onion):` are now recognized correctly.
- Further targeted user-reported interface, parser and shopping reliability corrections since v1.0.3.

## Compatibility and supported upgrade

The application and tracked database schema remain at the v1 baseline. No new schema migration is introduced by v1.0.4. A new installation begins with no personal recipes or users.

- **Complete application:** `your-kitchen-library-1.0.4.zip`.
- **Easy upgrade:** `your-kitchen-library-easy-upgrade-1.0.4.zip` for existing v1.0.0–v1.0.3 Linux/Synology installations.
- **Advanced upgrade:** `your-kitchen-library-upgrade-kit-1.0.4.zip` with explicit dry-run and confirmation.
- All three ZIPs have their own SHA-256 checksum files.

The upgrader saves and verifies database/code backups and preserves the installation's `.env`, data volume, media, users and compatible site-specific configuration. Users should still keep an independent offsite backup. The v1.0.0–v1.0.3 packages and tags remain immutable. See [Software Updates and Recovery](UPDATER.md) and [Quick Start](QUICK_START.md).

The official download site is https://yourkitchenlibrary.com/download/.