This release includes 7 security fixes for security teams reviewing exposed deployments.
Published 1mo
Productivity & Wikis
✓ No known CVEs patched
This release patches 7 known CVEs
Topics
appointment
appointment-booking
appointment-scheduling
appointments
calendar
calendars
+6 more
calendly-alternative
docker
elixir
phoenix-liveview
postgresql
scheduling
Affected surfaces
auth
rbac
rce_ssrf
Summary
AI summaryAdd one‑click Google Calendar connect to onboarding and many usability improvements.
Full changelog
[1.2.2] — 2026-06-24
Bug Fixes
- core: Serve gzip static assets only in production
- core: Give the analytics dashboard refresh visible feedback
- core: Only require ANALYTICS_SALT_SECRET when booking analytics is enabled
- core: Stop button icons wrapping onto their own line
- core: Include config-referenced heroicons in the asset bundle
- core: Keep Quill booking content readable over image backgrounds
- core: Show hamburger nav on tablets, not just phones
- core: Match mobile nav menu structure to desktop
- core: Verify reCAPTCHA before consuming per-recipient booking limit
- core: Validate every resolved address in SSRF guard
- core: Rate-limit booking confirmations per recipient to curb email abuse
- core: Block SSRF to internal hosts on CalDAV and video integrations
- core: Drop 'unsafe-inline' from CSP script-src
- core: Propagate CSP nonce to the reCAPTCHA loader script
- core: Drop unused 'unsafe-eval' from CSP script-src
- core: Present booking-analytics visitors and conversion as estimates
- core: Suppress false booking-analytics anomaly alerts on small samples
- core: Stop capturing arbitrary query parameters in booking analytics
- core: Stop false booking-analytics anomaly alerts across day boundaries
- core: Count booking-page visitors consistently when the client IP is unknown
- core: Trust forwarded IP headers only from known proxies on live connections
- core: Resolve the real client IP on live connections behind a proxy
- core: Prevent scheduling page crash when booking analytics is enabled
- core: Base booking-analytics conversion on actual converting visitors
- core: Count a booking-page visitor once across meeting types
- core: Add id to booking-link slug form for LiveView form recovery
- core: Prevent booking page step labels from clipping in themes
- core: Accept text/plain handshake for calendar webhook validation
- core: Label footer legal link as "Terms and Conditions"
- core: Scroll to top reliably when navigating between pages
- core: Improve Quill booking card contrast on bright backgrounds
- core: Stop hand-rolled space-x/space-y from doubling Tailwind v4 gaps
- core: Scope hand-rolled utility CSS into cascade layers for Tailwind v4
- core: Correct wrong English text in notification emails
- core: Correct English UI labels broken by a stale gettext merge
- core: Save the booking link slug when pressing Enter
- core: Stop direct booking links from revealing other meeting types
- core: Resolve private booking links to the correct meeting type
- core: Give LiveView forms stable ids for reliable form recovery
- core: Run provider validation when module not yet loaded
- core: Give LiveView forms stable ids for reliable form recovery
- core: Run provider validation when module not yet loaded
- core: Bound persisted tracking-param size at the data layer
- core: Harden booking analytics ingestion and dashboard
- core: Stabilise top_sources tiebreak order
Features
- core: Add one-click Google Calendar connect to onboarding
- core: Refine and gate the booking analytics dashboard
- core: Exclude an organizer's own page visits from booking analytics
- core: Add vendor-neutral analytics view-on-mount hook
- core: Show custom question answers in synced calendar events
- core: Add per-request CSP nonce to script-src
- core: Add device-type breakdown to booking analytics
- core: Add admin toggle for booking analytics
- core: Make booking analytics opt-in via config flag
- core: Add config-driven Resources navigation menu
- core: Announce guest attendees and illustrate the booking-link modal
- core: Add booking-link share previews with organiser photo and details
- core: Add icons to the navigation menu and Features dropdown
- core: Support a Features navigation dropdown via :feature_pages config
- core: Add eligible-user count query to Auth context
- core: Scroll to top on internal link navigation site-wide
- core: Add config-gated pricing link to nav and footer
- core: Add Contact link to desktop site navigation
- core: Add config-gated pricing link to nav and footer
- core: Surface the guest limit in the meeting type editor
- core: Refine the guest booking flow across both themes
- core: Add guest attendees with email RSVP to bookings
- core: Add generic data-analytics-event click tracking
- core: Emit booking-page-published telemetry on first publish
- core: Emit booking-created telemetry on guest bookings
- core: Emit calendar-connected telemetry with provider
- core: Emit onboarding-completed telemetry
- core: Add private and direct booking links for meeting types
- core: Add analytics dashboard with sources and visits over time
- core: Add VisitsChart component for analytics dashboard
- core: Add SourcesTable component for analytics dashboard
- core: Add SummaryCards component for analytics dashboard
- core: Persist UTM and tracking params on bookings end-to-end
- core: Log page views on public scheduling routes
- core: Persist UTM and tracking parameters on bookings
- core: Cast UTM and tracking fields on meetings
- core: Add UTM and tracking columns to meetings
- core: Add Analytics context with log_page_view and reads
- core: Add UtmExtractor for UTM and custom tracking params
- core: Add Analytics rate limiter for event ingestion
- core: Add BotDetector for UA-based bot filtering
- core: Add daily-salted Fingerprint for cookie-less analytics
- core: Add EventQueries for analytics reads
- core: Add EventSchema for analytics events
- core: Add analytics_events table for booking analytics
Security Fixes
- Drop 'unsafe-inline' from CSP script-src
- Drop unused 'unsafe-eval' from CSP script-src
- Propagate CSP nonce to reCAPTCHA loader script
- Verify reCAPTCHA before consuming per‑recipient booking limit
- Validate every resolved address in SSRF guard
- Block SSRF to internal hosts on CalDAV and video integrations
- Rate‑limit booking confirmations per recipient to curb email abuse
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]