CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var ALLOW_IANA_RESTRICTED_ADDRESSES to true to access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.
CVE-2026-27645 - Reflected XSS in RSS Single Watch request
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [ghcr.io/dgtlmoon/changedetection.io](https://github.com/dgtlmoon/changedetection.io) | minor | `0.53.7` → `0.54.1` |
---
### Release Notes
<details>
<summary>dgtlmoon/changedetection.io (ghcr.io/dgtlmoon/changedetection.io)</summary>
### [`v0.54.1`](https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.1)
[Compare Source](https://github.com/dgtlmoon/changedetection.io/compare/0.53.7...0.54.1)
- CVE-2026-27696 - Server-Side Request Forgery (SSRF) via Watch URLs, set env var `ALLOW_IANA_RESTRICTED_ADDRESSES` to `true` to access IANA reserved URLs such as <http://169.254.169.254>, <http://10.0.0.1/>, <http://127.0.0.1/>, etc.
- CVE-2026-27645 - Reflected XSS in RSS Single Watch request
**Full Changelog**: <https://github.com/dgtlmoon/changedetection.io/compare/0.53.7...0.54.1>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zMS45IiwidXBkYXRlZEluVmVyIjoiNDMuMzEuOSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
0.53.7→0.54.1Release Notes
dgtlmoon/changedetection.io (ghcr.io/dgtlmoon/changedetection.io)
v0.54.1Compare Source
ALLOW_IANA_RESTRICTED_ADDRESSEStotrueto access IANA reserved URLs such as http://169.254.169.254, http://10.0.0.1/, http://127.0.0.1/, etc.Full Changelog: https://github.com/dgtlmoon/changedetection.io/compare/0.53.7...0.54.1
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.