Skip to content

Tymeslot

v0.100.1 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 3mo Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

appointment appointment-booking appointment-scheduling appointments calendar calendars
+6 more
calendly-alternative docker elixir phoenix-liveview postgresql scheduling

Affected surfaces

auth rbac crypto_tls

Summary

AI summary

Redesign transactional emails, add forced CalDAV re-sync, fingerprint calendar events, and enrich admin alerts.

Full changelog

[0.100.1] — 2026-04-15

Bug Fixes

  • core: Add consecutive_hard_failures to monitor test state fixtures
  • core: Rename bare _ bindings to _upserted in sync sweep worker test
  • core: Address deep review findings for Outlook sync bootstrap refactor
  • core: Decouple Outlook sync bootstrap from push subscription and land cache/security cleanups
  • core: Handle DST transitions in convert_to_utc and expand TZID coverage
  • core: Strip quoted TZID and normalise provider timezones (closes #38)
  • core: Align booking conflict check with canonical blocking predicate
  • core: Harden security module against edge-case bypasses
  • core: Honour configured meeting type order on public booking page
  • core: Normalise provider to atom in CalDAV health check client
  • core: Stop entity-encoding plain-text fields in UniversalSanitizer
  • core: Prevent Quick Actions card overflow on mobile dashboard
  • core: Prevent logo and user dropdown overlap on mobile dashboard
  • core: Hide back-to-website button on mobile auth pages
  • core: Install node_modules before building assets in Docker
  • core: Unbreak dashboard event creation async result path
  • core: Redirect to /dashboard after onboarding and update e2e test for 7-step flow
  • core: Wire password toggle hook on every auth form and give each a unique id
  • core: Stop back-to-website button animating from inside auth card
  • core: Remove phantom css classes and migrate password toggle to data attributes
  • core: Install tailwindcss-animate plugin and remove dead animate classes
  • core: Remove phantom css classes with no definition
  • core: Style rhythm overview empty state
  • core: Register grid-cols-14 and grid-cols-16 in Tailwind config
  • core: Replace stale xs: breakpoint on automation card test buttons
  • core: Use turquoise scale for reCAPTCHA notice links
  • core: Remove unreachable clause in availability shift_safe
  • core: Harden 2026 email helpers against edge-case inputs
  • core: Render quill time slots in a responsive grid
  • core: Adapt rhythm schedule step to iframe height via flex
  • core: Preserve unspecified calendar preference fields on partial upsert
  • core: Re-centre dashboard calendar on current time after refresh
  • core: Keep cancel button icon and label on one line
  • core: Handle OAuth plain-map events in blocking? and convert_events_to_timezone
  • core: Convert CalDAV EXDATE values to Date for cache storage
  • core: Fold created_by_tymeslot into recreate_provider_calendar_events migration
  • core: Normalize OAuth calendar events in EventsRead fetch path
  • core: Set stable field to current version string in CloudronVersions.json
  • core: Restore missing [0.99.39] section in Cloudron CHANGELOG
  • core: Replace fixed CSS values with fluid responsive equivalents
  • core: Resolve code review issues from module-splits deep review
  • core: Resolve architecture issues and add test coverage after code review
  • core: Harden event fingerprinting after code review
  • core: Add @spec to where_overlapping_range
  • core: Improve Google OAuth UX and deduplicate calendar callback rate limiting
  • core: Scrub PII before logging, harden hostname fallback, trim emails
  • core: Address code review findings for canonical CalendarEvent
  • core: Validate calendar discovery input before rate-limiting
  • core: Use user-id for calendar rate limits and reset is_saving on throttle
  • core: Add missing rate limits to calendar event creation and connection tests
  • core: Restore real HealthCheck module in HealthCheckTest setup
  • core: Update stale subscription schema reference in customer lookup test
  • core: Resolve Dialyzer warnings in Profiles module
  • core: Address review findings in co-location branch
  • core: Resolve rebase conflict artifacts in email worker and onboarding
  • core: Address review findings in bounded health check changes
  • core: Bound health check job execution to prevent 10+ minute runs

Features

  • core: Redesign transactional and system emails for 2026
  • core: Add periodic forced full re-sync for CalDAV integrations
  • core: Fingerprint calendar events created by Tymeslot
  • core: Add og-image.png social card for Open Graph meta tags
  • core: Enrich admin alerts with structured reason and PII scrubbing
  • core: Normalise all calendar providers through canonical CalendarEvent
  • core: Add canonical CalendarEvent struct and provider_calendar_events table
  • core: Add standardised admin alerts infrastructure
  • core: Add Credo check enforcing Repo call boundaries

Security Fixes

  • Harden security module against edge-case bypasses
  • Harden event fingerprinting after code review
  • Scrub PII before logging, harden hostname fallback, trim emails
  • Harden 2026 email helpers against edge-case inputs

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Tymeslot

Get notified when new releases ship.

Sign up free

About Tymeslot

Privacy-first scheduling platform

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]