This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Summary
AI summaryFixed contact sync errors, UI display bugs, localization issues, and added editable CardDAV accounts with bulk enable/disable.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
CardDAV accounts can be edited (name, server URL, username, password) without deleting the account; empty password field retains stored credentials. CardDAV accounts can be edited (name, server URL, username, password) without deleting the account; empty password field retains stored credentials. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Medium |
"Enable all" / "Disable all" actions for accounts toggle multiple address books with a single request; failures affect only the offending row. "Enable all" / "Disable all" actions for accounts toggle multiple address books with a single request; failures affect only the offending row. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Feature | Medium |
Sync status distinguishes real server errors from accounts lacking enabled address books, disabling sync action when none are enabled. Sync status distinguishes real server errors from accounts lacking enabled address books, disabling sync action when none are enabled. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Unchecking an address book no longer fails with HTTP 404; toggle persists correctly. Unchecking an address book no longer fails with HTTP 404; toggle persists correctly. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Contact sync displays address book names instead of raw URLs; account card shows server URL and last-sync time. Contact sync displays address book names instead of raw URLs; account card shows server URL and last-sync time. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Medium |
Sync failures are now visible in the UI with per‑account and per‑address‑book error states. Sync failures are now visible in the UI with per‑account and per‑address‑book error states. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Low |
Destructive action buttons now use defined danger styling for visibility in dark mode. Destructive action buttons now use defined danger styling for visibility in dark mode. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Low |
Address book names are no longer truncated on narrow screens, keeping the "Disconnect" button accessible. Address book names are no longer truncated on narrow screens, keeping the "Disconnect" button accessible. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Low |
Toggling an address book or calendar preserves keyboard focus and keeps the sync button reachable while inactive. Toggling an address book or calendar preserves keyboard focus and keeps the sync button reachable while inactive. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | Low |
Server error messages are now translated according to UI language instead of defaulting to German. Server error messages are now translated according to UI language instead of defaulting to German. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Refactor | Low |
`t()` now uses `Intl.PluralRules` for correct pluralization of counted strings. `t()` now uses `Intl.PluralRules` for correct pluralization of counted strings. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Refactor | Low |
Contact sync and Calendar sync share a unified visual grammar: identical card structure, single disclosure component, consistent status vocabulary, and a three‑step button hierarchy. Contact sync and Calendar sync share a unified visual grammar: identical card structure, single disclosure component, consistent status vocabulary, and a three‑step button hierarchy. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Refactor | Low |
Disconnect confirmation dialog now names the account and states consequences; canceling the edit dialog runs through the same unsaved‑changes guard as pressing Escape. Disconnect confirmation dialog now names the account and states consequences; canceling the edit dialog runs through the same unsaved‑changes guard as pressing Escape. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Fixed
- Unchecking an address book in Settings → Sync → Contact sync no longer fails with "HTTP 404" (#534). The page called an endpoint that never existed (
POST /accounts/:id/addressbooks/toggle) while the API offersPUT /contacts/cardav/addressbooks/:id— the request was rejected before reaching any handler, which is why nothing appeared in the server log. Toggling now persists and affects only the selected address book. - Contact sync showed raw server URLs instead of address book names, and the account card left out the server URL and last-sync time. All three read fields the API does not send (
display_name,cardav_url,last_syncinstead ofname,cardavUrl,lastSync). The same field-name bug also made Calendar sync and Reminder sync report "Not connected / Never synced" for every CalDAV account regardless of state. - Sync failures are no longer invisible. A failing address book (for example a server answering
501 Not Implemented) previously left the account reporting "Connected"; the error only existed in the container log. The failure is now stored per account and per address book, outranks the success state, and is shown on the row that caused it with the list expanded. - Destructive actions in Settings had no danger styling:
.btn--danger-outlinewas used in ten places but never defined, so "Disconnect", "Delete" and "Log out" fell back to the browser default — black text on a near-black surface in dark mode (1.3:1). The same audit found.btn--active(bulk-select in Tasks) equally undefined, leaving its active state invisible. - Contact sync was unusable on phones: a long account URL stretched the card to 582 px inside a 309 px column, pushing "Disconnect" out of the viewport with no way to scroll to it. Address book names are no longer truncated on narrow screens.
- Toggling an address book or calendar no longer drops keyboard focus to the top of the page, and the sync button stays reachable by keyboard while it is inactive.
- Server error messages reached the interface in German regardless of the selected language. Responses now carry a stable
errorCodethat the client translates.
Added
- CardDAV accounts can be edited (name, server URL, username, password). A rotated password no longer means deleting the account and re-selecting every address book; leaving the password field empty keeps the stored one. A URL and username that already belong to another account are rejected with a clear message.
- "Enable all" / "Disable all" for accounts with more than one address book — one bundled request instead of one click per entry. If a single request fails, only that row stays unchanged.
- Sync status now distinguishes a real server error from an expected setup gap: an account without any enabled address book is shown neutrally and its sync action is disabled instead of reporting success for a non-event.
Changed
t()selects plural forms viaIntl.PluralRules, so counted strings read correctly ("1 address book enabled" instead of "1 address books enabled"). Locales that need no distinction are unaffected.- Contact sync and Calendar sync now share one visual grammar: identical card structure, one disclosure component, one status vocabulary, and a three-step button hierarchy (sync, maintenance, destructive).
- The confirmation for disconnecting an account names the account and states the consequence separately, and canceling the edit dialog now runs through the same unsaved-changes guard as pressing Escape.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v0.71.3 Changes WebDAV backup default path from "/oikos/backups/" to "/yuvomi/backups/".
- v0.66.0 Repository URL changed to `https://github.com/ulsklyc/yuvomi`.
- v0.66.0 Docker image moved to `ghcr.io/ulsklyc/yuvomi`.
- v0.66.0 Project renamed from Oikos to Yuvomi.
- v0.62.0 Changes event dialog to unified sync target picker across Google and CalDAV calendars.
Beta — feedback welcome: [email protected]