Skip to content

tududi

v1.1.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 1mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

expressjs get-things-done gtd gtd-applications gtd-management nodejs
+5 more
project-management react reactjs task-management todo

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Disable upgrade-insecure-requests CSP flag via UPGRADE_INSECURE_REQUESTS env var, resolve OIDC users in link callback, and keep the inbox page after converting items to tasks.

Changes in this release

Bugfix Medium

Disable upgrade-insecure-requests CSP directive for plain HTTP deployments.

Disable upgrade-insecure-requests CSP directive for plain HTTP deployments.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Use dedicated UPGRADE_INSECURE_REQUESTS env var instead of COOKIE_SECURE for CSP.

Use dedicated UPGRADE_INSECURE_REQUESTS env var instead of COOKIE_SECURE for CSP.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Resolve user from session in OIDC link callback.

Resolve user from session in OIDC link callback.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Allow task deferral until any time on the same day as due date.

Allow task deferral until any time on the same day as due date.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Stay on inbox page after converting an item to a task.

Stay on inbox page after converting an item to a task.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Add x-csrf-token to CORS allowedHeaders.

Add x-csrf-token to CORS allowedHeaders.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Serve static files from dist when index.html exists, regardless of NODE_ENV.

Serve static files from dist when index.html exists, regardless of NODE_ENV.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Enable deletion of CalDAV calendars.

Enable deletion of CalDAV calendars.

Source: llm_adapter@2026-06-12

Confidence: low

 —
Full changelog

What's Changed

  • fix(csp): disable upgrade-insecure-requests for plain HTTP deployments by @chrisvel in https://github.com/chrisvel/tududi/pull/1175
  • fix(csp): use dedicated UPGRADE_INSECURE_REQUESTS env var instead of COOKIE_SECURE by @chrisvel in https://github.com/chrisvel/tududi/pull/1176
  • fix(oidc): resolve user from session in link callback by @chrisvel in https://github.com/chrisvel/tududi/pull/1177
  • fix(tasks): allow defer until any time on the same day as due date by @chrisvel in https://github.com/chrisvel/tududi/pull/1178
  • fix(inbox): stay on inbox page after converting item to task by @chrisvel in https://github.com/chrisvel/tududi/pull/1182
  • fix(caldav): cannot delete CalDAV calendars by @chrisvel in https://github.com/chrisvel/tududi/pull/1183
  • fix(inbox): stay on inbox page after converting item to task by @chrisvel in https://github.com/chrisvel/tududi/pull/1171
  • fix(cors): add x-csrf-token to CORS allowedHeaders by @chrisvel in https://github.com/chrisvel/tududi/pull/1186
  • fix(static): serve from dist when index.html exists, regardless of NODE_ENV by @chrisvel in https://github.com/chrisvel/tududi/pull/1187

Full Changelog: https://github.com/chrisvel/tududi/compare/v1.1.0...v1.1.1

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track tududi

Get notified when new releases ship.

Sign up free

About tududi

Self-hosted task management that combines the simplicity of personal with the power of professional project organization. Built for individuals and teams who value privacy, control, and efficiency.

All releases →

Related context

Beta — feedback welcome: [email protected]