diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index ba9b61c..91ee507 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -48,4 +48,4 @@ Paste output here. ## Additional Context -Any other context — screenshots, related issues, or configuration details. +Any other context - screenshots, related issues, or configuration details. diff --git a/BACKLOG.md b/BACKLOG.md index 005ec50..6e87613 100644 --- a/BACKLOG.md +++ b/BACKLOG.md @@ -24,5 +24,5 @@ Neue Vorschläge? → [Issue öffnen](https://github.com/ulsklyc/oikos/issues/ne | BL-08 | Dashboard: Wetter-Widget Refresh | v0.4.0 | | BL-09 | Kontakte: vCard-Import / -Export | v0.4.0 | | BL-10 | PWA: Offline-Fallback für kritische Seiten | v0.4.0 | -| — | UX Polish (Animationen, Bottom Sheet, FAB, Stagger, Vibration) | v0.2.0 | -| — | Event-Listener-Leaks, CSS-Lücken, Modal-Tests | v0.2.1 | +| - | UX Polish (Animationen, Bottom Sheet, FAB, Stagger, Vibration) | v0.2.0 | +| - | Event-Listener-Leaks, CSS-Lücken, Modal-Tests | v0.2.1 | diff --git a/CHANGELOG.md b/CHANGELOG.md index ab6d193..0c261b5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,46 +10,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [0.5.5] - 2026-04-03 ### Fixed -- Fix iCloud Calendar sync failing with FOREIGN KEY constraint error — `created_by` was hardcoded to user ID 1 instead of resolving dynamically (fixes #4) -- Sync all iCloud calendars instead of only the first one — previously only a single calendar was imported, ignoring Family, subscribed, and other calendars -- Add missing `cfgDel` helper function used by `clearCredentials` — disconnecting Apple Calendar would crash +- Fix iCloud Calendar sync failing with FOREIGN KEY constraint error - `created_by` was hardcoded to user ID 1 instead of resolving dynamically (fixes #4) +- Sync all iCloud calendars instead of only the first one - previously only a single calendar was imported, ignoring Family, subscribed, and other calendars +- Add missing `cfgDel` helper function used by `clearCredentials` - disconnecting Apple Calendar would crash - Skip unreachable or broken calendars gracefully instead of aborting the entire sync ## [0.5.4] - 2026-04-03 ### Fixed -- Fix SQLCipher PRAGMA key syntax error on fresh install — hex-encoded key must be wrapped in double quotes for valid PRAGMA syntax (fixes #3) +- Fix SQLCipher PRAGMA key syntax error on fresh install - hex-encoded key must be wrapped in double quotes for valid PRAGMA syntax (fixes #3) ## [0.5.3] - 2026-04-03 ### Security -- Fix SQLCipher PRAGMA key interpolation — encryption keys containing single quotes no longer crash on startup; key is now hex-encoded -- Enforce minimum password length (8 characters) when admin creates new users — previously any 1-character password was accepted +- Fix SQLCipher PRAGMA key interpolation - encryption keys containing single quotes no longer crash on startup; key is now hex-encoded +- Enforce minimum password length (8 characters) when admin creates new users - previously any 1-character password was accepted - Add length bounds on username (64 chars) and display_name (128 chars) to prevent unbounded input - Add input length bounds on login (username 64 chars, password 1024 chars) -- Invalidate all other sessions when a user changes their password — previously active sessions survived password reset -- Session and CSRF cookies now have `secure: true` by default; HTTP is only allowed when `SESSION_SECURE=false` is explicitly set in `.env` — previously cookies were sent without `Secure` flag in non-production environments -- Document authorization model in SECURITY.md — clarify that all family members share read/write access to all data by design +- Invalidate all other sessions when a user changes their password - previously active sessions survived password reset +- Session and CSRF cookies now have `secure: true` by default; HTTP is only allowed when `SESSION_SECURE=false` is explicitly set in `.env` - previously cookies were sent without `Secure` flag in non-production environments +- Document authorization model in SECURITY.md - clarify that all family members share read/write access to all data by design ### Changed - Use multi-stage Docker build to exclude build tools (python3, make, g++) from runtime image - Exclude `docs/` directory from Docker image via `.dockerignore` -- Consolidate `dotenv.config()` to single call in `server/index.js` — remove duplicate calls from `server/db.js` and `server/auth.js` +- Consolidate `dotenv.config()` to single call in `server/index.js` - remove duplicate calls from `server/db.js` and `server/auth.js` ## [0.5.2] - 2026-04-01 ### Security - Add rate limiting to SPA fallback route to prevent file system hammering via unauthenticated wildcard requests -- Add CSRF protection to auth routes that change state (logout, create user, change password, delete user) — previously bypassed global CSRF middleware due to router registration order -- Fix incomplete vCard escaping in contacts export — backslash characters are now escaped first before other special characters (`,`, `;`, newline), preventing injection via contact fields +- Add CSRF protection to auth routes that change state (logout, create user, change password, delete user) - previously bypassed global CSRF middleware due to router registration order +- Fix incomplete vCard escaping in contacts export - backslash characters are now escaped first before other special characters (`,`, `;`, newline), preventing injection via contact fields - Restrict CI workflow GITHUB_TOKEN to `contents: read` (principle of least privilege) ## [0.5.1] - 2026-04-01 ### Fixed -- Meals: fixed crash when dragging a meal slot — `dragging` state is now destructured before `cleanup()` runs, preventing a null-reference error on drop +- Meals: fixed crash when dragging a meal slot - `dragging` state is now destructured before `cleanup()` runs, preventing a null-reference error on drop - i18n: `t()` now resolves dot-notation keys against nested locale JSON objects (e.g. `t('nav.tasks')` correctly returns `"Aufgaben"` instead of the raw key string); affects all pages, components, and navigation -- PWA: replaced placeholder "O" icons with the actual Oikos house logo across all icon variants (192, 512, maskable 192, maskable 512, apple-touch-icon, favicon); maskable variants use full-bleed background with logo within the 80% safe zone — fixes Android home screen showing only a blue circle +- PWA: replaced placeholder "O" icons with the actual Oikos house logo across all icon variants (192, 512, maskable 192, maskable 512, apple-touch-icon, favicon); maskable variants use full-bleed background with logo within the 80% safe zone - fixes Android home screen showing only a blue circle - PWA: weather widget icons (OpenWeatherMap) now render correctly in installed PWA on Android; service worker no longer intercepts cross-origin image requests (opaque responses caused silent rendering failures in standalone mode) - Settings: language selector replaced from cramped radio buttons to a native `