Skip to content

tududi

v1.1.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

expressjs get-things-done gtd gtd-applications gtd-management nodejs
+5 more
project-management react reactjs task-management todo

Affected surfaces

auth deps

Summary

AI summary

Fixes security vulnerabilities, task synchronization, migration issues, OIDC/SAML/OAuth2 auth, CalDAV sync, CSRF protections, UI improvements, and dependency updates.

Full changelog

What's Changed

  • Fix: Resolve 20 security vulnerabilities in dependencies by @chrisvel in https://github.com/chrisvel/tududi/pull/983
  • Fix: Prevent subtasks from disappearing when updating parent task by @chrisvel in https://github.com/chrisvel/tududi/pull/984
  • Fix: Bi-weekly recurring task scheduling for multi-day patterns by @chrisvel in https://github.com/chrisvel/tududi/pull/1005
  • fix: add missing i18next dependency to package.json by @chrisvel in https://github.com/chrisvel/tududi/pull/1006
  • fix: exclude cancelled tasks from Overdue and Due Today sections by @chrisvel in https://github.com/chrisvel/tududi/pull/1007
  • fix: use correct InboxItem model name in MCP inbox tools by @oritromax in https://github.com/chrisvel/tududi/pull/986
  • Bump hono from 4.12.8 to 4.12.12 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1012
  • Bump @hono/node-server from 1.19.11 to 1.19.13 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1011
  • Bump lodash from 4.17.23 to 4.18.1 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1010
  • Bump nodemailer from 8.0.4 to 8.0.5 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1009
  • feat: Add OIDC/SSO authentication support by @chrisvel in https://github.com/chrisvel/tududi/pull/1008
  • fix: allow Sunday selection in monthly weekday recurring tasks by @chrisvel in https://github.com/chrisvel/tududi/pull/1014
  • fix: correct Sequelize alias case for OIDCIdentity-User association by @chrisvel in https://github.com/chrisvel/tududi/pull/1015
  • fix: resolve inbox project creation bugs by @chrisvel in https://github.com/chrisvel/tududi/pull/1018
  • fix: prevent Telegram polling errors from blocking container startup by @chrisvel in https://github.com/chrisvel/tududi/pull/1019
  • fix: prevent task name truncation when creating from inbox by @chrisvel in https://github.com/chrisvel/tududi/pull/1020
  • fix: resolve OIDC authentication error with existing identities by @chrisvel in https://github.com/chrisvel/tududi/pull/1021
  • fix: resolve OIDC session loss and migration failures by @chrisvel in https://github.com/chrisvel/tududi/pull/1023
  • build(deps): bump follow-redirects from 1.15.11 to 1.16.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1024
  • fix: add CSRF token support to frontend requests by @chrisvel in https://github.com/chrisvel/tududi/pull/1025
  • build(deps): bump hono from 4.12.12 to 4.12.14 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1034
  • feat(caldav): Add CalDAV Synchronization Support (Issue #978) by @chrisvel in https://github.com/chrisvel/tududi/pull/1030
  • fix(search): Handle touch events to prevent input blur on mobile when saving views by @chrisvel in https://github.com/chrisvel/tududi/pull/1039
  • fix(mcp): Include subtasks in get_task API response by @chrisvel in https://github.com/chrisvel/tududi/pull/1040
  • fix(ui): Auto-focus project search field when opened (Issue #992) by @chrisvel in https://github.com/chrisvel/tududi/pull/1038
  • fix(inbox): Fix tag/project autocomplete selection by @chrisvel in https://github.com/chrisvel/tududi/pull/1043
  • fix(notifications): Add missing test notification endpoint (Issue #1002) by @chrisvel in https://github.com/chrisvel/tududi/pull/1047
  • feat(task-content): make markdown checkboxes interactive in task description view by @TastyPi in https://github.com/chrisvel/tududi/pull/1046
  • fix: add missing CSRF token to today settings PUT request by @TastyPi in https://github.com/chrisvel/tududi/pull/1044
  • fix(migration): Correctly migrate password column from v1.0.0 (Issue #1051) by @chrisvel in https://github.com/chrisvel/tududi/pull/1052
  • fix: restore password migration COALESCE and add trust proxy diagnostics by @chrisvel in https://github.com/chrisvel/tududi/pull/1057
  • fix(migration): resolve v1.0.0 password column migration causing login failures by @chrisvel in https://github.com/chrisvel/tududi/pull/1059
  • fix(oidc): normalize OIDC_SCOPE to handle whitespace issues by @chrisvel in https://github.com/chrisvel/tududi/pull/1060
  • build(deps-dev): bump i18next-http-backend from 3.0.2 to 3.0.5 in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/chrisvel/tududi/pull/1058
  • fix(admin): add CSRF token to admin user management operations by @chrisvel in https://github.com/chrisvel/tududi/pull/1065
  • test: add comprehensive user isolation tests for tasks by @chrisvel in https://github.com/chrisvel/tududi/pull/1067
  • fix: add copy button to note details page by @chrisvel in https://github.com/chrisvel/tududi/pull/1068
  • fix: wire CalendarToken model into models/index.js to prevent MCP crashes by @chrisvel in https://github.com/chrisvel/tududi/pull/1069
  • fix: use CALDAV_ENABLED for calendar feature flag by @chrisvel in https://github.com/chrisvel/tududi/pull/1070
  • fix(tasks): fix projectless task visibility leak in dashboard metrics (#1063) by @alimuratgymn in https://github.com/chrisvel/tududi/pull/1066
  • fix: replace 6-word limit with 150-character limit for project names by @chrisvel in https://github.com/chrisvel/tududi/pull/1077
  • fix: make password_digest migration compatible with all schema versions by @chrisvel in https://github.com/chrisvel/tududi/pull/1078
  • feat: add configurable file upload limit via environment variable by @chrisvel in https://github.com/chrisvel/tududi/pull/1080
  • Added Kanidm to the documentation of OIDC SSO by @meszolym in https://github.com/chrisvel/tududi/pull/1095
  • fix: use auto-detect for session cookie secure flag to support reverse proxies by @chrisvel in https://github.com/chrisvel/tududi/pull/1101
  • fix: initialize email service on startup to enable user registration by @chrisvel in https://github.com/chrisvel/tududi/pull/1102
  • fix: correct Note model field from 'name' to 'title' in MCP search tool by @chrisvel in https://github.com/chrisvel/tududi/pull/1103
  • fix: register session middleware before CalDAV routes to enable session auth by @chrisvel in https://github.com/chrisvel/tududi/pull/1106
  • fix: increase HTTP keep-alive timeout for persistent MCP connections by @chrisvel in https://github.com/chrisvel/tududi/pull/1111
  • fix: cascade delete tasks and attachments when deleting project by @chrisvel in https://github.com/chrisvel/tududi/pull/1114
  • fix: add max-width constraint to completion chart tooltip on mobile by @chrisvel in https://github.com/chrisvel/tududi/pull/1107
  • Fix: Enable subtask expansion on Today page by @chrisvel in https://github.com/chrisvel/tududi/pull/1097
  • Feat/mcp tests by @jax0m in https://github.com/chrisvel/tududi/pull/1093
  • fix(lint): Use backend eslint config in lint-staged for backend files by @TastyPi in https://github.com/chrisvel/tududi/pull/1089
  • fix: ensure notification_preferences are initialized for all users by @chrisvel in https://github.com/chrisvel/tududi/pull/1115
  • fix: Update task count display when tasks are created or deleted by @chrisvel in https://github.com/chrisvel/tududi/pull/1116
  • fix: Add CSRF token to project image upload request by @chrisvel in https://github.com/chrisvel/tududi/pull/1119
  • feat(oauth): Add OAuth2 resource server support (RFC 9728) by @TastyPi in https://github.com/chrisvel/tududi/pull/1042
  • fix(caldav): Add missing encryption keys and repository methods by @chrisvel in https://github.com/chrisvel/tududi/pull/1127
  • fix(tasks): Preserve task name when changing recurring task status by @chrisvel in https://github.com/chrisvel/tududi/pull/1128
  • fix(tasks): Fix timezone handling for recurring task day-of-week display by @chrisvel in https://github.com/chrisvel/tududi/pull/1130
  • fix(caldav): Add CalDAV discovery endpoints for client connection by @chrisvel in https://github.com/chrisvel/tududi/pull/1131
  • fix(caldav): Add error handling to CalDAV API routes by @chrisvel in https://github.com/chrisvel/tududi/pull/1132
  • fix(project): Add CSRF token to task status update in ProjectDetails by @chrisvel in https://github.com/chrisvel/tududi/pull/1143
  • fix(tasks): Enforce project permissions in Today screen queries by @chrisvel in https://github.com/chrisvel/tududi/pull/1148
  • fix(caldav): Validate Bearer tokens in CalDAV auth middleware by @chrisvel in https://github.com/chrisvel/tududi/pull/1155
  • fix(caldav): Handle calendar-multiget REPORT so iOS tasks appear by @chrisvel in https://github.com/chrisvel/tududi/pull/1156
  • fix(caldav): serialize DUE and DTSTART as VALUE=DATE to prevent iOS midnight reminders by @chrisvel in https://github.com/chrisvel/tududi/pull/1157
  • fix(caldav): exclude CalDAV routes from compression middleware by @chrisvel in https://github.com/chrisvel/tududi/pull/1158
  • fix(caldav): use prefix-agnostic XML node lookup to support iOS clients by @chrisvel in https://github.com/chrisvel/tududi/pull/1159
  • fix(caldav): make iOS autodiscovery RFC-compliant end-to-end by @chrisvel in https://github.com/chrisvel/tududi/pull/1160
  • Updated OIDC docs for Authentik by @hickey in https://github.com/chrisvel/tududi/pull/1150
  • Include CSRF token when setting project task to in progress by @emptynick in https://github.com/chrisvel/tududi/pull/1126
  • fix(migration): Parse JSON string before property access in notification preferences migration by @TastyPi in https://github.com/chrisvel/tududi/pull/1120
  • fix(notifications): include CSRF token in test notification request by @damjanZGB in https://github.com/chrisvel/tududi/pull/1091
  • fix(oidc): make OIDC_ENABLED check case-insensitive by @chrisvel in https://github.com/chrisvel/tududi/pull/1163
  • fix(modals): prevent discard dialog mouse clicks from closing parent modal by @chrisvel in https://github.com/chrisvel/tududi/pull/1164
  • fix(caldav): preserve VALARM on round-trip and fix defer_until UTC offset display by @chrisvel in https://github.com/chrisvel/tududi/pull/1165

New Contributors

  • @oritromax made their first contribution in https://github.com/chrisvel/tududi/pull/986
  • @dependabot[bot] made their first contribution in https://github.com/chrisvel/tududi/pull/1012
  • @TastyPi made their first contribution in https://github.com/chrisvel/tududi/pull/1046
  • @alimuratgymn made their first contribution in https://github.com/chrisvel/tududi/pull/1066
  • @meszolym made their first contribution in https://github.com/chrisvel/tududi/pull/1095
  • @jax0m made their first contribution in https://github.com/chrisvel/tududi/pull/1093
  • @hickey made their first contribution in https://github.com/chrisvel/tududi/pull/1150
  • @emptynick made their first contribution in https://github.com/chrisvel/tududi/pull/1126
  • @damjanZGB made their first contribution in https://github.com/chrisvel/tududi/pull/1091

Full Changelog: https://github.com/chrisvel/tududi/compare/v1.0.0...v1.1.0

Security Fixes

  • Fix: Resolve 20 security vulnerabilities in dependencies
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track tududi

Get notified when new releases ship.

Sign up free

About tududi

Self-hosted task management that combines the simplicity of personal with the power of professional project organization. Built for individuals and teams who value privacy, control, and efficiency.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]