` landmark correctly - Add `sr-only` priority labels to dashboard task items - screen readers now announce priority level instead of relying on color alone (WCAG 1.4.1) ### Fixed - Replace hardcoded hex values in greeting widget gradient with `--color-accent-active` / `--color-accent` tokens - dark mode now correctly themes the greeting banner - Replace hardcoded `gap: 2px` with `--space-0h` token in greeting widget ## [0.7.1] - 2026-04-04 ### Security - Fix stored XSS across all pages - extract shared `esc()` utility (`public/utils/html.js`) and apply HTML escaping to all user-controlled data in innerHTML templates (titles, names, locations, descriptions, colors, notes content, autocomplete suggestions) - Remove `user-scalable=no` and `maximum-scale=1` from viewport meta tag - restores pinch-to-zoom accessibility (WCAG 1.4.4) ### Changed - Deduplicate 8 identical `escHtml()` functions (tasks, shopping, calendar, notes, meals, contacts, budget, settings) into single shared `esc()` import from `utils/html.js` - Shared `esc()` also escapes single quotes (`'` to `'`) for safer attribute contexts ## [0.7.0] - 2026-04-04 ### Security - Upgrade bcrypt from 5.1.1 to 6.0.0 - resolves 4 HIGH path traversal CVEs in transitive `tar` dependency via `@mapbox/node-pre-gyp` - Remove hardcoded fallback session secret - server now always throws if `SESSION_SECRET` is unset, regardless of `NODE_ENV` ### Changed - **Breaking:** Migrate entire server and test suite from CommonJS to ESM - all `require()`/`module.exports` replaced with `import`/`export`; `"type": "module"` added to `package.json` - Replace 40+ unstructured `console.*` calls with `server/logger.js` - thin wrapper supporting `LOG_LEVEL` env var (debug/info/warn/error), zero new dependencies - Translate `package.json` description to English for consistency with all other documentation - Translate `.env.example` comments from German to English for international contributors - Translate `.gitignore` comments to English ### Removed - Remove internal audit documents (`docs/claude-md-audit.md`, `docs/repo-audit-2026-04-02.md`) from tracked files - Remove empty `.worktrees/` leftover directory ### Added - Add `CODE_OF_CONDUCT.md` (Contributor Covenant v2.1) - Add `.gitignore` patterns for audit report files (`docs/audit-report-*.md`, `docs/*-audit.md`) ## [0.6.0] - 2026-04-03 ### Fixed - Fix budget entry update failing with "Internal Error" when changing category - `date` validator import shadowed the `date` field from the request body, causing SQLite to receive a function reference instead of a string value (fixes #8) ## [0.5.9] - 2026-04-03 ### Security - Fix stored XSS in task titles and subtask titles - all user-provided text in tasks.js is now escaped via `escHtml()` before insertion into innerHTML templates - Fix stored XSS in settings page member list - display_name and username are now escaped via `escHtml()` in `memberHtml()` - Fix rate limiter bypass via X-Forwarded-For IP spoofing - `trust proxy` now defaults to `loopback` instead of unconditional `1`; configurable via `TRUST_PROXY` env var - Fix Google OAuth CSRF - add cryptographic `state` parameter to OAuth flow, validated on callback - Fix CSV injection in budget export - fields starting with `=`, `+`, `-`, `@`, tab, or carriage return are now prefixed with apostrophe - Fix missing session invalidation on user deletion - all active sessions of deleted users are now destroyed - Restrict username to `[a-zA-Z0-9._-]` with minimum 3 characters, preventing HTML/script injection via usernames - Restrict Google Calendar sync trigger (`POST /google/sync`) and Apple Calendar sync trigger (`POST /apple/sync`) to admin role - Add warning log when Apple CalDAV credentials are stored without DB encryption enabled ## [0.5.8] - 2026-04-03 ### Added - Add Italian (Italiano) localization - full translation of all 497 i18n keys (thanks @albanobattistella, PR #7) - Add Italian as selectable language in Settings locale picker ## [0.5.7] - 2026-04-03 ### Fixed - Fix recurring calendar events not expanding - RRULE parser now strips the `RRULE:` prefix used by ICS/CalDAV, which previously caused all recurrence rules to be silently ignored - Fix recurring multi-day events not appearing when their start date falls before the view window but the event spans into it - Fix all-day recurring event instances getting datetime end values instead of date-only format - Add YEARLY recurrence frequency support for birthday and anniversary events ## [0.5.6] - 2026-04-03 ### Fixed - Fix all-day calendar events appearing on the correct day and the following day - ICS DTEND for DATE values is exclusive per RFC 5545, now correctly adjusted (fixes #5) - Fix multi-day events not showing when using DURATION instead of DTEND - add ICS DURATION property support in CalDAV parser - Fix birthdays from Apple Calendar not syncing - birthday calendars are no longer excluded from sync - Fix outbound ICS builder using inclusive DTEND for all-day events - now correctly emits exclusive DTEND per RFC 5545 ## [0.5.5] - 2026-04-03 ### Fixed - Fix iCloud Calendar sync failing with FOREIGN KEY constraint error - `created_by` was hardcoded to user ID 1 instead of resolving dynamically (fixes #4) - Sync all iCloud calendars instead of only the first one - previously only a single calendar was imported, ignoring Family, subscribed, and other calendars - Add missing `cfgDel` helper function used by `clearCredentials` - disconnecting Apple Calendar would crash - Skip unreachable or broken calendars gracefully instead of aborting the entire sync ## [0.5.4] - 2026-04-03 ### Fixed - Fix SQLCipher PRAGMA key syntax error on fresh install - hex-encoded key must be wrapped in double quotes for valid PRAGMA syntax (fixes #3) ## [0.5.3] - 2026-04-03 ### Security - Fix SQLCipher PRAGMA key interpolation - encryption keys containing single quotes no longer crash on startup; key is now hex-encoded - Enforce minimum password length (8 characters) when admin creates new users - previously any 1-character password was accepted - Add length bounds on username (64 chars) and display_name (128 chars) to prevent unbounded input - Add input length bounds on login (username 64 chars, password 1024 chars) - Invalidate all other sessions when a user changes their password - previously active sessions survived password reset - Session and CSRF cookies now have `secure: true` by default; HTTP is only allowed when `SESSION_SECURE=false` is explicitly set in `.env` - previously cookies were sent without `Secure` flag in non-production environments - Document authorization model in SECURITY.md - clarify that all family members share read/write access to all data by design ### Changed - Use multi-stage Docker build to exclude build tools (python3, make, g++) from runtime image - Exclude `docs/` directory from Docker image via `.dockerignore` - Consolidate `dotenv.config()` to single call in `server/index.js` - remove duplicate calls from `server/db.js` and `server/auth.js` ## [0.5.2] - 2026-04-01 ### Security - Add rate limiting to SPA fallback route to prevent file system hammering via unauthenticated wildcard requests - Add CSRF protection to auth routes that change state (logout, create user, change password, delete user) - previously bypassed global CSRF middleware due to router registration order - Fix incomplete vCard escaping in contacts export - backslash characters are now escaped first before other special characters (`,`, `;`, newline), preventing injection via contact fields - Restrict CI workflow GITHUB_TOKEN to `contents: read` (principle of least privilege) ## [0.5.1] - 2026-04-01 ### Fixed - Meals: fixed crash when dragging a meal slot - `dragging` state is now destructured before `cleanup()` runs, preventing a null-reference error on drop - i18n: `t()` now resolves dot-notation keys against nested locale JSON objects (e.g. `t('nav.tasks')` correctly returns `"Aufgaben"` instead of the raw key string); affects all pages, components, and navigation - PWA: replaced placeholder "O" icons with the actual Oikos house logo across all icon variants (192, 512, maskable 192, maskable 512, apple-touch-icon, favicon); maskable variants use full-bleed background with logo within the 80% safe zone - fixes Android home screen showing only a blue circle - PWA: weather widget icons (OpenWeatherMap) now render correctly in installed PWA on Android; service worker no longer intercepts cross-origin image requests (opaque responses caused silent rendering failures in standalone mode) - Settings: language selector replaced from cramped radio buttons to a native `