mealie Helm chart
geek-cookbookVerified publisherScored 14 Sept 2026
Mealie is a self hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family.
Latest 5.1.2 4 years agodeploys tag frontend-v1.0.0beta-2 2Artifact Hub
mealie 5.1.2 deploys 2 container images: hkotel/mealie. Across them, 573 findings — 2 critical, 16 high — 6 on CISA KEV. The highest contribution is GHSA-j7hp-h8jx-5ppr in pillow 8.4.0, fixed in 10.0.1. Chart.yaml declares kubeVersion >=1.16.0-0; rendered for Kubernetes 1.16.0.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Container images
| Image | Tag | Vulnerabilities | Radar Score |
|---|---|---|---|
| hkotel/ | frontend-v1.0.0beta-2 | 01272299 | 4,842 |
| hkotel/ | api-v1.0.0beta-2 | 2450133 | 2,737 |
Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.
Vulnerabilities
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Low | GHSA-3pgj-pg6c-r5p7 | oauthlib | 3.2.2 |
| Low | GHSA-mmhx-hmjr-r674 | dompurify | 2.5.4 |
| Low | GHSA-34x7-hfp2-rc4v | tar | 7.5.7 |
| Low | GHSA-44wm-f244-xhp3 | pillow | 10.3.0 |
| Low | GHSA-62p4-gmf7-7g93 | pillow | 12.3.0 |
| Low | GHSA-q4r8-xm5f-56gw | github.com/ | 0.30.0 |
| Low | GO-2023-1571 | stdlib | 1.19.6 |
| Low | GHSA-3g43-6gmg-66jw | axios | 0.31.1 |
| Low | GHSA-cxjh-pqwp-8mfp | follow-redirects | 1.15.6 |
| Low | GHSA-ph9p-34f9-6g65 | tmp | 0.2.6 |
| Low | GHSA-hfxv-24rg-xrqf | axios | 0.32.0 |
| Low | GHSA-j5f8-grm9-p9fc | axios | 0.32.0 |
| Low | DSA-5330-1 | curl | 7.74.0-1.3+deb11u5 |
| Low | GHSA-vp52-pcj8-j9qc | google.golang.org/ | 1.83.1 |
| Low | GHSA-59g5-xgcq-4qw3 | python-multipart | 0.0.18 |
| Low | GHSA-rgw5-rvv9-x895 | brace-expansion | 1.1.18 |
| Low | GHSA-vjc4-5qp5-m44j | pillow | 12.3.0 |
| Low | GHSA-pw2r-vq6v-hr8c | follow-redirects | 1.14.8 |
| Low | GHSA-f5x3-32g6-xq36 | tar | 6.2.1 |
| Low | GHSA-j8xg-fqg3-53r7 | word-wrap | 1.2.4 |
| Low | GO-2022-0288 | golang.org/ | 0.0.0-20211209124913-491a49abca63 |
| Low | DLA-3907-1 | sqlite3 | 3.34.1-3+deb11u1 |
| Low | GHSA-6g55-p6wh-862q | postcss | 8.5.12 |
| Low | GHSA-q2x7-8rv6-6q7h | jinja2 | 3.1.5 |
| Low | GHSA-pmwg-cvhr-8vh7 | axios | 0.31.1 |
| Low | GHSA-xj96-63gp-2gmr | pillow | 12.3.0 |
| Low | GO-2023-2102 | stdlib | 1.20.10 |
| Low | GHSA-qffp-2rhf-9h96 | tar | 7.5.10 |
| Low | GHSA-22p9-wv53-3rq4 | linkify-it | 5.0.1 |
| Low | GHSA-xqr8-7jwr-rhp7 | certifi | 2023.7.22 |
| Low | GHSA-5wmx-573v-2qwq | markdown | 3.8.1 |
| Low | ALPINE-CVE-2023-0465 | openssl | 1.1.1t-r2 |
| Low | GHSA-23hp-3jrh-7fpw | tar | 7.5.19 |
| Low | GHSA-52cp-r559-cp3m | js-yaml | 3.15.0 |
| Low | GHSA-q6wq-5p59-983w | parse-url | 6.0.1 |
| Low | GHSA-hmw2-7cc7-3qxx | form-data | 4.0.6 |
| Low | GHSA-2wc2-fm75-p42x | soupsieve | 2.8.4 |
| Low | GHSA-836r-79rf-4m37 | soupsieve | 2.8.4 |
| Low | GHSA-7r86-cg39-jmmj | minimatch | 5.1.8 |
| Low | GHSA-c27g-q93r-2cwf | launch-editor | 2.9.0 |
| Low | GHSA-3jp5-5f8r-q2wg | vuetify | 3.0.0-alpha.10 |
| Low | GHSA-x9w5-v3q2-3rhw | browserify-sign | 4.2.2 |
| Low | GHSA-952p-6rrq-rcjv | micromatch | 4.0.8 |
| Low | GHSA-8qq5-rm4j-mr97 | tar | 7.5.3 |
| Low | GO-2022-0969 | stdlib | 1.18.6 |
| Low | GHSA-gmj6-6f8f-6699 | jinja2 | 3.1.5 |
| Low | GHSA-fvcv-3m26-pcqx | axios | 0.31.0 |
| Low | GHSA-6v7p-g79w-8964 | msgpack | 1.2.1 |
| Low | GHSA-jpp7-7chh-cf67 | parse-url | 6.0.1 |
| Low | GHSA-q4h4-gmj2-qvw2 | golang.org/ | 0.52.0 |
Indexed versions
| Version | Published | App version | Vulnerabilities | Radar Score |
|---|---|---|---|---|
| 5.1.2latest | 4 years ago | frontend-v1.0.0beta-2 | 216122432 | 7,579 |
The latest version and the previous major, as selected nightly from the repository’s index.
README badge
Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.