# Changelog All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] ## [0.6.0] - 2026-04-03 ### Fixed - Fix budget entry update failing with "Internal Error" when changing category - `date` validator import shadowed the `date` field from the request body, causing SQLite to receive a function reference instead of a string value (fixes #8) ## [0.5.9] - 2026-04-03 ### Security - Fix stored XSS in task titles and subtask titles - all user-provided text in tasks.js is now escaped via `escHtml()` before insertion into innerHTML templates - Fix stored XSS in settings page member list - display_name and username are now escaped via `escHtml()` in `memberHtml()` - Fix rate limiter bypass via X-Forwarded-For IP spoofing - `trust proxy` now defaults to `loopback` instead of unconditional `1`; configurable via `TRUST_PROXY` env var - Fix Google OAuth CSRF - add cryptographic `state` parameter to OAuth flow, validated on callback - Fix CSV injection in budget export - fields starting with `=`, `+`, `-`, `@`, tab, or carriage return are now prefixed with apostrophe - Fix missing session invalidation on user deletion - all active sessions of deleted users are now destroyed - Restrict username to `[a-zA-Z0-9._-]` with minimum 3 characters, preventing HTML/script injection via usernames - Restrict Google Calendar sync trigger (`POST /google/sync`) and Apple Calendar sync trigger (`POST /apple/sync`) to admin role - Add warning log when Apple CalDAV credentials are stored without DB encryption enabled ## [0.5.8] - 2026-04-03 ### Added - Add Italian (Italiano) localization - full translation of all 497 i18n keys (thanks @albanobattistella, PR #7) - Add Italian as selectable language in Settings locale picker ## [0.5.7] - 2026-04-03 ### Fixed - Fix recurring calendar events not expanding - RRULE parser now strips the `RRULE:` prefix used by ICS/CalDAV, which previously caused all recurrence rules to be silently ignored - Fix recurring multi-day events not appearing when their start date falls before the view window but the event spans into it - Fix all-day recurring event instances getting datetime end values instead of date-only format - Add YEARLY recurrence frequency support for birthday and anniversary events ## [0.5.6] - 2026-04-03 ### Fixed - Fix all-day calendar events appearing on the correct day and the following day - ICS DTEND for DATE values is exclusive per RFC 5545, now correctly adjusted (fixes #5) - Fix multi-day events not showing when using DURATION instead of DTEND - add ICS DURATION property support in CalDAV parser - Fix birthdays from Apple Calendar not syncing - birthday calendars are no longer excluded from sync - Fix outbound ICS builder using inclusive DTEND for all-day events - now correctly emits exclusive DTEND per RFC 5545 ## [0.5.5] - 2026-04-03 ### Fixed - Fix iCloud Calendar sync failing with FOREIGN KEY constraint error - `created_by` was hardcoded to user ID 1 instead of resolving dynamically (fixes #4) - Sync all iCloud calendars instead of only the first one - previously only a single calendar was imported, ignoring Family, subscribed, and other calendars - Add missing `cfgDel` helper function used by `clearCredentials` - disconnecting Apple Calendar would crash - Skip unreachable or broken calendars gracefully instead of aborting the entire sync ## [0.5.4] - 2026-04-03 ### Fixed - Fix SQLCipher PRAGMA key syntax error on fresh install - hex-encoded key must be wrapped in double quotes for valid PRAGMA syntax (fixes #3) ## [0.5.3] - 2026-04-03 ### Security - Fix SQLCipher PRAGMA key interpolation - encryption keys containing single quotes no longer crash on startup; key is now hex-encoded - Enforce minimum password length (8 characters) when admin creates new users - previously any 1-character password was accepted - Add length bounds on username (64 chars) and display_name (128 chars) to prevent unbounded input - Add input length bounds on login (username 64 chars, password 1024 chars) - Invalidate all other sessions when a user changes their password - previously active sessions survived password reset - Session and CSRF cookies now have `secure: true` by default; HTTP is only allowed when `SESSION_SECURE=false` is explicitly set in `.env` - previously cookies were sent without `Secure` flag in non-production environments - Document authorization model in SECURITY.md - clarify that all family members share read/write access to all data by design ### Changed - Use multi-stage Docker build to exclude build tools (python3, make, g++) from runtime image - Exclude `docs/` directory from Docker image via `.dockerignore` - Consolidate `dotenv.config()` to single call in `server/index.js` - remove duplicate calls from `server/db.js` and `server/auth.js` ## [0.5.2] - 2026-04-01 ### Security - Add rate limiting to SPA fallback route to prevent file system hammering via unauthenticated wildcard requests - Add CSRF protection to auth routes that change state (logout, create user, change password, delete user) - previously bypassed global CSRF middleware due to router registration order - Fix incomplete vCard escaping in contacts export - backslash characters are now escaped first before other special characters (`,`, `;`, newline), preventing injection via contact fields - Restrict CI workflow GITHUB_TOKEN to `contents: read` (principle of least privilege) ## [0.5.1] - 2026-04-01 ### Fixed - Meals: fixed crash when dragging a meal slot - `dragging` state is now destructured before `cleanup()` runs, preventing a null-reference error on drop - i18n: `t()` now resolves dot-notation keys against nested locale JSON objects (e.g. `t('nav.tasks')` correctly returns `"Aufgaben"` instead of the raw key string); affects all pages, components, and navigation - PWA: replaced placeholder "O" icons with the actual Oikos house logo across all icon variants (192, 512, maskable 192, maskable 512, apple-touch-icon, favicon); maskable variants use full-bleed background with logo within the 80% safe zone - fixes Android home screen showing only a blue circle - PWA: weather widget icons (OpenWeatherMap) now render correctly in installed PWA on Android; service worker no longer intercepts cross-origin image requests (opaque responses caused silent rendering failures in standalone mode) - Settings: language selector replaced from cramped radio buttons to a native `