This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryFixed web plugin MIME type handling, free‑busy REPORT limit logic, whole‑day VEVENT filtering, recurrence property cleanup, structured property text matching, and bday‑to‑ICS conversion bugs.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes web plugin helpers to respect mimetypes and fallback_mimetype parameters. Fixes web plugin helpers to respect mimetypes and fallback_mimetype parameters. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes free-busy REPORT to succeed when max_freebusy_occurrence is set to 0 (disabled). Fixes free-busy REPORT to succeed when max_freebusy_occurrence is set to 0 (disabled). Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes time-range filter to correctly handle whole‑day VEVENT durations. Fixes time-range filter to correctly handle whole‑day VEVENT durations. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes calendar-data expand to remove all recurrence properties on expanded single‑occurrence VEVENTs. Fixes calendar-data expand to remove all recurrence properties on expanded single‑occurrence VEVENTs. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes text‑match filter crash on structured vCard properties lacking a lower() method. Fixes text‑match filter crash on structured vCard properties lacking a lower() method. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes sharing bday‑to‑ICS conversion to assign the empty‑FN fallback marker correctly. Fixes sharing bday‑to‑ICS conversion to assign the empty‑FN fallback marker correctly. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Fixes sharing/delete to include a forgotten backmap. Fixes sharing/delete to include a forgotten backmap. Source: llm_adapter@2026-07-19 Confidence: low |
— |
| Bugfix | Low |
Sharing/delete operation now includes a forgotten backmap. Sharing/delete operation now includes a forgotten backmap. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Fixes
- Fix: web plugin helpers httputils.serve_resource/serve_folder ignored their mimetypes and fallback_mimetype parameters and always used the built-in mapping, so custom web plugins could not serve additional file types with a correct Content-Type
- Fix: free-busy REPORT always failed with HTTP 400 ("FREEBUSY occurrences limit of 0 hit") when [reporting] max_freebusy_occurrence is set to 0 (limit disabled), because the limit check did not honor the disabled limit
- Fix: time-range filter treated a VEVENT with a whole-day DURATION (e.g. P1D, P2D) as zero-length (timedelta.seconds instead of total_seconds), so such events were missing from calendar-query REPORT results
- Fix: calendar-data expand (REPORT) left recurrence properties (e.g. RDATE) on the expanded single-occurrence VEVENTs; a single try/except around the sequential delattr() calls stopped at the first absent property (e.g. missing EXDATE), so later ones were never removed
- Fix: text-match filter on a structured property (e.g. vCard N or ADR) crashed with HTTP 500 (AttributeError: 'Name'/'Address' object has no attribute 'lower') because vobject parses these into non-string objects; their text representation is now used
- Fix: sharing bday-to-ICS conversion assigned the empty-FN fallback marker to the {nickname} placeholder instead of {fn}, so a VCARD with an empty FN got its NICKNAME overwritten with "!fn!" in the generated SUMMARY/DESCRIPTION and the {fn} fallback never resolved
- Fix: sharing/delete: add forgotten backmap
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]