From f34537adcf1e708c4d59fe0a7e20b5ffa7f2b18b Mon Sep 17 00:00:00 2001 From: Bernd Rodler Date: Fri, 7 Aug 2026 12:41:34 +0200 Subject: [PATCH] =?UTF-8?q?release:=20v1.7.9=20=E2=80=94=20Phase=201=20cri?= =?UTF-8?q?tical+high=20fixes=20(17/18)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Housekeeping: - Bump VERSION to 1.7.9 - CHANGELOG entry for all Phase 1 fixes - Mark Phase 1 as completed in development plan --- CHANGELOG.md | 24 +++++++++++++++++++ VERSION | 2 +- .../DEVELOPMENT-PLAN.md | 4 ++-- 3 files changed, 27 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2c3d3d4f..2ec6743d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,29 @@ # Changelog +## 1.7.9 (2026-08-07) + +### Bug Fixes (Phase 1 — VNCmailgraph audit) + +- **Mail**: Network transport failures now throw `TransportError` instead of returning empty results, so offline/network-down is distinguishable from an empty folder (#C1) +- **Mail**: Push handler now refreshes contacts and files on remote state changes (#H1) +- **Calendar**: Recurrence expansion IDs use `::occurrence::` delimiter to prevent collision with shared-event prefixes (#C2) +- **Calendar**: Cross-account event aggregation now deduplicates by UID + recurrenceId, preventing phantom duplicates (#C3) +- **Calendar**: `calendarTasksEnabled` admin policy now enforced at runtime, not just in settings UI (#H13) +- **Tasks**: All task mutations (update, delete, toggle) now have error handling with store error state (#H14) +- **Settings**: `updateSetting()` now checks admin policy lock before writing; `force` opt-in for legitimate bypassers (#C7) +- **Settings**: `autoSelectReplyIdentity` now defaults to `true` — auto-identity selection on by default (#H18) +- **Templates**: HTML template bodies are now sanitized with DOMPurify on import to prevent stored XSS (#H7) +- **Auth**: User authentication endpoints now rate-limited — 10 attempts per (IP + username) per 15 minutes (#H3) +- **Auth**: Admin sessions now support token revocation via JTI blacklist on logout (#C4) +- **Auth**: Secure cookie flag now derived from `x-forwarded-proto`, not `NODE_ENV` (#H8) +- **Auth**: OAuth token exchange error logs no longer leak `access_token` (#H4) +- **Auth**: `isHashed()` no longer accepts bcrypt prefixes — scrypt-only, preventing lockout from bcrypt passwords (#H9) +- **Push**: WS→SSE fallback now awaits state snapshot before reconciliation to prevent missed deliveries (#H2) +- **Push**: Offline event handler added — push transports pause when browser goes offline, reconnect on online (#C8) +- **Index**: FTS5 schema-drop now logs a warning so operators know a rebuild is needed (#C6) + +--- + ## 1.7.8 (2026-07-22) ### Features diff --git a/VERSION b/VERSION index 84298f96..f65dc1e2 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.7.8 +1.7.9 diff --git a/runs/2026-08-07-v1.7.8-baseline/DEVELOPMENT-PLAN.md b/runs/2026-08-07-v1.7.8-baseline/DEVELOPMENT-PLAN.md index 006329ee..1c6a9930 100644 --- a/runs/2026-08-07-v1.7.8-baseline/DEVELOPMENT-PLAN.md +++ b/runs/2026-08-07-v1.7.8-baseline/DEVELOPMENT-PLAN.md @@ -506,8 +506,8 @@ ### Deploy Flow Per policy: P1 → deploy to `dev` → QA → fix → promote to `main`. Then P2 → dev → QA → main. Repeat for P3, P4. -### First Sprint Scope -**Phase 1 only** — ship all 8 CRITICAL + 10 HIGH fixes (~32h). This brings health from 7.2 to ~8.5/10 and addresses the most impactful user-facing bugs before adding new features. +### Phase 1 — COMPLETED 2026-08-07 +**Shipped as v1.7.9.** 17 of 18 fixes deployed to `main`. All 2527 tests pass (161 test files). One item deferred: P1.3 (C5 auth localStorage encryption) — requires custom Zustand persist adapter, planned for Phase 3. ---