diff --git a/apps/grocy/4.6.0/.env.sample b/apps/grocy/4.6.0/.env.sample
deleted file mode 100644
index 755b4b6df..000000000
--- a/apps/grocy/4.6.0/.env.sample
+++ /dev/null
@@ -1,6 +0,0 @@
-CONTAINER_NAME="grocy"
-APP_DATA_DIR="./data"
-PANEL_APP_PORT_HTTP=80
-TZ="Asia/Shanghai"
-PUID="1000"
-PGID="1000"
diff --git a/apps/grocy/4.6.0/data.yml b/apps/grocy/4.6.0/data.yml
deleted file mode 100644
index 50d714c44..000000000
--- a/apps/grocy/4.6.0/data.yml
+++ /dev/null
@@ -1,83 +0,0 @@
-additionalProperties:
-  formFields:
-    - default: 80
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: Port
-      labelZh: 端口
-      label:
-        en: Port
-        zh: 端口
-        zh-Hant: 埠
-        ja: ポート
-        ko: 포트
-        ru: Порт
-        ms: Port
-        pt-br: Porta
-      required: true
-      rule: paramPort
-      type: number
-    - default: "./data"
-      edit: true
-      envKey: APP_DATA_DIR
-      labelEn: Data Directory
-      labelZh: 数据目录
-      label:
-        en: Data Directory
-        zh: 数据目录
-        zh-Hant: 資料目錄
-        ja: データディレクトリ
-        ko: 데이터 디렉터리
-        ru: Каталог данных
-        ms: Direktori data
-        pt-br: Diretório de dados
-      required: true
-      type: text
-    - default: "1000"
-      edit: true
-      envKey: PUID
-      labelEn: User ID
-      labelZh: 用户 ID
-      label:
-        en: User ID
-        zh: 用户 ID
-        zh-Hant: 使用者 ID
-        ja: ユーザー ID
-        ko: 사용자 ID
-        ru: ID пользователя
-        ms: ID Pengguna
-        pt-br: ID do usuário
-      required: true
-      type: number
-    - default: "1000"
-      edit: true
-      envKey: PGID
-      labelEn: Group ID
-      labelZh: 用户组 ID
-      label:
-        en: Group ID
-        zh: 用户组 ID
-        zh-Hant: 使用者群組 ID
-        ja: グループ ID
-        ko: 그룹 ID
-        ru: ID группы
-        ms: ID Kumpulan
-        pt-br: ID do grupo
-      required: true
-      type: number
-    - default: Asia/Shanghai
-      edit: true
-      envKey: TZ
-      labelEn: Timezone
-      labelZh: 时区
-      label:
-        en: Timezone
-        zh: 时区
-        zh-Hant: 時區
-        ja: タイムゾーン
-        ko: 시간대
-        ru: Часовой пояс
-        ms: Zon waktu
-        pt-br: Fuso horário
-      required: true
-      type: text
diff --git a/apps/grocy/4.6.0/scripts/init.sh b/apps/grocy/4.6.0/scripts/init.sh
deleted file mode 100755
index 84e0d148d..000000000
--- a/apps/grocy/4.6.0/scripts/init.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
-
-DATA_DIR="${APP_DATA_DIR:-./data}"
-PUID="${PUID:-1000}"
-PGID="${PGID:-1000}"
-
-# Strip matching single or double quotes from .env values if present
-if [[ -f "$ENV_FILE" ]]; then
-  while IFS='=' read -r key value; do
-    [[ -z "$key" || "$key" =~ ^# ]] && continue
-    value="${value#\"}"
-    value="${value%\"}"
-    value="${value#\'}"
-    value="${value%\'}"
-    case "$key" in
-      APP_DATA_DIR) DATA_DIR="$value" ;;
-      PUID) PUID="$value" ;;
-      PGID) PGID="$value" ;;
-    esac
-  done < "$ENV_FILE"
-fi
-
-# Resolve relative path against app version root
-if [[ ! "$DATA_DIR" = /* ]]; then
-  DATA_DIR="$ROOT_DIR/$DATA_DIR"
-fi
-
-mkdir -p "$DATA_DIR"
-chown -R "${PUID}:${PGID}" "$DATA_DIR"
diff --git a/apps/grocy/4.7.0/.env.sample b/apps/grocy/4.7.0/.env.sample
new file mode 100644
index 000000000..5acf43ec7
--- /dev/null
+++ b/apps/grocy/4.7.0/.env.sample
@@ -0,0 +1,6 @@
+CONTAINER_NAME=grocy-compose-check
+PANEL_APP_PORT_HTTP=80
+APP_DATA_DIR=./data
+PUID=1000
+PGID=1000
+TZ=Asia/Shanghai
diff --git a/apps/grocy/4.7.0/data.yml b/apps/grocy/4.7.0/data.yml
new file mode 100644
index 000000000..d9c7c6e69
--- /dev/null
+++ b/apps/grocy/4.7.0/data.yml
@@ -0,0 +1,83 @@
+additionalProperties:
+  formFields:
+  - default: 80
+    edit: true
+    envKey: PANEL_APP_PORT_HTTP
+    labelEn: Port
+    labelZh: 端口
+    label:
+      en: Port
+      zh: 端口
+      zh-Hant: 埠
+      ja: ポート
+      ko: 포트
+      ru: Порт
+      ms: Port
+      pt-br: Porta
+    required: true
+    rule: paramPort
+    type: number
+  - default: ./data
+    edit: true
+    envKey: APP_DATA_DIR
+    labelEn: Data Directory
+    labelZh: 数据目录
+    label:
+      en: Data Directory
+      zh: 数据目录
+      zh-Hant: 資料目錄
+      ja: データディレクトリ
+      ko: 데이터 디렉터리
+      ru: Каталог данных
+      ms: Direktori data
+      pt-br: Diretório de dados
+    required: true
+    type: text
+  - default: '1000'
+    edit: true
+    envKey: PUID
+    labelEn: User ID
+    labelZh: 用户 ID
+    label:
+      en: User ID
+      zh: 用户 ID
+      zh-Hant: 使用者 ID
+      ja: ユーザー ID
+      ko: 사용자 ID
+      ru: ID пользователя
+      ms: ID Pengguna
+      pt-br: ID do usuário
+    required: true
+    type: number
+  - default: '1000'
+    edit: true
+    envKey: PGID
+    labelEn: Group ID
+    labelZh: 用户组 ID
+    label:
+      en: Group ID
+      zh: 用户组 ID
+      zh-Hant: 使用者群組 ID
+      ja: グループ ID
+      ko: 그룹 ID
+      ru: ID группы
+      ms: ID Kumpulan
+      pt-br: ID do grupo
+    required: true
+    type: number
+  - default: Asia/Shanghai
+    edit: true
+    envKey: TZ
+    labelEn: Timezone
+    labelZh: 时区
+    label:
+      en: Timezone
+      zh: 时区
+      zh-Hant: 時區
+      ja: タイムゾーン
+      ko: 시간대
+      ru: Часовой пояс
+      ms: Zon waktu
+      pt-br: Fuso horário
+    required: true
+    type: text
diff --git a/apps/grocy/4.6.0/data/.gitkeep b/apps/grocy/4.7.0/data/.gitkeep
similarity index 100%
rename from apps/grocy/4.6.0/data/.gitkeep
rename to apps/grocy/4.7.0/data/.gitkeep
diff --git a/apps/grocy/4.6.0/docker-compose.yml b/apps/grocy/4.7.0/docker-compose.yml
similarity index 89%
rename from apps/grocy/4.6.0/docker-compose.yml
rename to apps/grocy/4.7.0/docker-compose.yml
index 791118319..12db23de3 100644
--- a/apps/grocy/4.6.0/docker-compose.yml
+++ b/apps/grocy/4.7.0/docker-compose.yml
@@ -1,6 +1,6 @@
 services:
   grocy:
-    image: "lscr.io/linuxserver/grocy:4.6.0"
+    image: "lscr.io/linuxserver/grocy:4.7.0"
     container_name: ${CONTAINER_NAME}
     restart: unless-stopped
     networks:
diff --git a/apps/grocy/4.6.0/scripts/.gitkeep b/apps/grocy/4.7.0/scripts/.gitkeep
similarity index 100%
rename from apps/grocy/4.6.0/scripts/.gitkeep
rename to apps/grocy/4.7.0/scripts/.gitkeep
diff --git a/apps/grocy/4.7.0/scripts/init.sh b/apps/grocy/4.7.0/scripts/init.sh
new file mode 100755
index 000000000..f8bcc9578
--- /dev/null
+++ b/apps/grocy/4.7.0/scripts/init.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)"
+ENV_FILE="${ENV_FILE:-$ROOT_DIR/.env}"
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
+}
+
+read_env_value() {
+  local key="$1"
+  [[ -f "$ENV_FILE" ]] || return 0
+  local value
+  value="$(sed -n "s/^${key}=//p" "$ENV_FILE" | tail -n 1)"
+  case "$value" in
+    \"*\") value="${value#\"}"; value="${value%\"}" ;;
+    \'*\') value="${value#\'}"; value="${value%\'}" ;;
+  esac
+  printf '%s\n' "$value"
+}
+
+configured_value() {
+  local key="$1"
+  local default_value="$2"
+  local value
+  value="${!key:-}"
+  if [[ -z "$value" ]]; then
+    value="$(read_env_value "$key")"
+  fi
+  printf '%s\n' "${value:-$default_value}"
+}
+
+resolve_app_path() {
+  local key="$1"
+  local raw="$2"
+  local clean candidate resolved current part
+  local -a parts=()
+  case "$raw" in
+    ""|/*|.|..|../*|*/../*|*/..) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  if [[ "$raw" =~ [[:cntrl:]] ]]; then
+    echo "unsafe ${key} path" >&2
+    return 1
+  fi
+  clean="${raw#./}"
+  [[ -n "$clean" ]] || { echo "unsafe ${key} path" >&2; return 1; }
+  command -v realpath >/dev/null 2>&1 || { echo "realpath is required" >&2; return 1; }
+  candidate="$ROOT_DIR/$clean"
+  resolved="$(realpath -m -- "$candidate")" || { echo "unsafe ${key} path" >&2; return 1; }
+  case "$resolved" in
+    "$ROOT_DIR"/*) ;;
+    *) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  current="$ROOT_DIR"
+  IFS='/' read -r -a parts <<< "$clean"
+  for part in "${parts[@]}"; do
+    [[ -z "$part" || "$part" == "." ]] && continue
+    current="$current/$part"
+    if [[ -L "$current" ]]; then
+      echo "unsafe ${key} path" >&2
+      return 1
+    fi
+  done
+  printf '%s\n' "$resolved"
+}
+
+PUID="$(configured_value PUID 1000)"
+PGID="$(configured_value PGID 1000)"
+[[ "$PUID" =~ ^[0-9]+$ ]] || fail "PUID must be numeric"
+[[ "$PGID" =~ ^[0-9]+$ ]] || fail "PGID must be numeric"
+
+DATA_DIR_RAW="$(configured_value APP_DATA_DIR ./data)"
+DATA_DIR="$(resolve_app_path APP_DATA_DIR "$DATA_DIR_RAW")"
+mkdir -p -- "$DATA_DIR"
+[[ "$(resolve_app_path APP_DATA_DIR "$DATA_DIR_RAW")" == "$DATA_DIR" ]] || fail "unsafe APP_DATA_DIR path"
+chown -R --no-dereference "$PUID:$PGID" "$DATA_DIR"
diff --git a/apps/grocy/4.6.0/scripts/uninstall.sh b/apps/grocy/4.7.0/scripts/uninstall.sh
similarity index 100%
rename from apps/grocy/4.6.0/scripts/uninstall.sh
rename to apps/grocy/4.7.0/scripts/uninstall.sh
diff --git a/apps/grocy/4.6.0/scripts/upgrade.sh b/apps/grocy/4.7.0/scripts/upgrade.sh
similarity index 100%
rename from apps/grocy/4.6.0/scripts/upgrade.sh
rename to apps/grocy/4.7.0/scripts/upgrade.sh
diff --git a/apps/grocy/README_en.md b/apps/grocy/README_en.md
deleted file mode 100644
index be36f0694..000000000
--- a/apps/grocy/README_en.md
+++ /dev/null
@@ -1,17 +0,0 @@
-# Grocy
-
-Grocy is a self-hosted household ERP application for groceries, shopping lists, chores, recipes, meal planning, and inventory.
-
-## Access
-
-The web interface listens on `PANEL_APP_PORT_HTTP` (default `80`). Follow the upstream documentation for the current initial login credentials and change them after login.
-
-## Persistence
-
-Configuration and SQLite data are stored in `APP_DATA_DIR`, mounted at `/config`. `PUID` and `PGID` control file ownership.
-
-## References
-
-- [Website](https://grocy.info)
-- [GitHub](https://github.com/grocy/grocy)
-- [Container image](https://github.com/linuxserver/docker-grocy)
diff --git a/apps/grocy/data.yml b/apps/grocy/data.yml
index 6790771ac..27504142b 100644
--- a/apps/grocy/data.yml
+++ b/apps/grocy/data.yml
@@ -1,31 +1,34 @@
 name: Grocy
 tags:
-  - Tool
+- Tool
 title: 家用 ERP 与物资管理系统
 description: 家用 ERP 与物资管理系统
 additionalProperties:
   key: grocy
   name: Grocy
   tags:
-    - Tool
+  - Tool
+  type: tool
+  website: https://grocy.info
+  document: https://github.com/grocy/grocy
+  github: https://github.com/grocy/grocy
   shortDescZh: 家用 ERP 与物资管理系统
   shortDescEn: Home ERP and grocery management system
+  crossVersionUpdate: true
+  limit: 0
+  architectures:
+  - amd64
+  - arm64
   description:
-    en: A self-hosted home ERP system for managing groceries, household chores, and inventory.
+    en: A self-hosted home ERP system for managing groceries, household chores, and
+      inventory.
     zh: 一款自托管的家用 ERP 系统，用于管理食品、家务和库存物资。
     zh-Hant: 一款自託管的家用 ERP 系統，用於管理食品、家務和庫存物資。
     ja: 自宅ホスト型の家庭用 ERP システム。食料品、家事、在庫を管理。
     ko: 식료품, 가사, 재고를 관리하는 자체 호스트형 가정용 ERP 시스템.
-    ru: Самостоятельно развёртываемая домашняя ERP-система для управления продуктами, делами и запасами.
-    ms: Sistem ERP rumah yang dihoskan sendiri untuk menguruskan barangan runcit, kerja rumah dan inventori.
-    pt-br: Sistema ERP doméstico autohospedado para gerenciar mantimentos, tarefas domésticas e inventário.
-  type: tool
-  crossVersionUpdate: true
-  limit: 0
-  recommend: 0
-  website: https://grocy.info
-  github: https://github.com/grocy/grocy
-  document: https://github.com/grocy/grocy
-  architectures:
-    - amd64
-    - arm64
+    ru: Самостоятельно развёртываемая домашняя ERP-система для управления продуктами,
+      делами и запасами.
+    ms: Sistem ERP rumah yang dihoskan sendiri untuk menguruskan barangan runcit,
+      kerja rumah dan inventori.
+    pt-br: Sistema ERP doméstico autohospedado para gerenciar mantimentos, tarefas
+      domésticas e inventário.
diff --git a/apps/grocy/logo.png b/apps/grocy/logo.png
index a982e330a..a389ac250 100644
Binary files a/apps/grocy/logo.png and b/apps/grocy/logo.png differ