kolaente 068a302173 fix(richtext): don't resolve mentions of other users' bots ...

Markdown mention resolution looked up any username, so mentioning another
user's bot rendered its display name into the stored HTML. Resolution now
gets the requesting identity and applies the same bot visibility rule as
user search: only humans and the requester's own bots are resolved, other
bots stay literal text.

2026-11-03 18:23:04 +01:00

..

audit

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

caldav

fix(caldav): merge multiple CATEGORIES properties into labels (#4183)

2026-10-19 14:49:06 +00:00

caldavtests

fix(caldav): reject non-VTODO and unparsable resources with 403 instead of 500

2026-10-26 14:44:48 +01:00

cmd

feat(attachments): add a repair command for the previews older versions left in keyvalue

2026-10-19 20:33:06 +02:00

config

feat: add basic auth config for health endpoints

2026-11-03 09:12:02 +01:00

cron

…

db

fix(reminders): only remind subscribers

2026-10-26 14:47:13 +01:00

doctor

fix(doctor): escape control characters in report values

2026-11-03 17:34:38 +01:00

e2etests

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

errorreport

…

events

fix(events): allow new handlers while draining

2026-10-22 21:29:40 +02:00

files

fix(avatar): remove a replaced avatar's blob only after commit

2026-10-20 23:05:30 +02:00

health

…

i18n

feat(user): lock account after 10 failed password attempts

2026-11-03 10:41:13 +01:00

initialize

feat(migration): keep queued import uploads in the file storage

2026-09-15 17:57:00 +02:00

license

feat(license): add user_invites feature

2026-09-12 18:21:35 +02:00

log

feat(log): add SafeHeaders to mask credential headers in logs

2026-10-19 16:05:26 +02:00

mail

…

metrics

…

migration

fix(migration): subscribe creators and assignees to their existing tasks

2026-10-26 14:47:13 +01:00

models

fix(filters): omit filter expression from invalid filter HTTP error (#4306)

2026-11-03 08:57:46 +00:00

modules

feat(auth): sync teams from oidc groups claim (#4311)

2026-11-03 17:13:41 +00:00

notifications

fix(notifications): escape user input in conversational email header

2026-10-19 21:06:10 +02:00

plugins

…

red

…

richtext

fix(richtext): don't resolve mentions of other users' bots

2026-11-03 18:23:04 +01:00

routes

fix(richtext): don't resolve mentions of other users' bots

2026-11-03 18:23:04 +01:00

swagger

[skip ci] Updated swagger docs

2026-10-30 22:32:12 +00:00

user

test(user): assert lockout event and notification

2026-11-03 10:41:13 +01:00

utils

feat(utils): add CheckJSONForNUL to detect \u0000 escapes in JSON

2026-11-02 11:58:07 +01:00

version

…

web

fix(api): treat page=0 as the first page on v1 list endpoints

2026-10-20 15:13:02 +02:00

websocket

feat(api): return the user object instead of user_id on time entries

2026-10-22 11:14:14 +02:00

webtests

feat(user): lock account after 10 failed password attempts

2026-11-03 10:41:13 +01:00

yaegi_symbols

[skip ci] Updated yaegi symbols

2026-11-03 11:22:09 +00:00