kolaente 34c779e209 fix(caldav): stop answering requests out of process-wide state ...

The handlers configured caldav-go through its setup functions, which write
package-level globals that HandleRequest then reads. Between a request's setup
and its handling another request could overwrite them, so two users syncing at
the same time could be answered from each other's storage - the wrong user, the
wrong projects.

caldav-go takes the state per request now, so pass it there instead. A test
driving eight concurrent requests per user fails against the old code both as a
race report and as user1 receiving user15's calendar.

TaskHandler never set a user or the supported components at all, so it answered
current-user-principal with whichever username the last request happened to
leave behind. It gets them like the others now.

2026-08-19 22:24:21 +02:00

..

audit

feat(audit): audit full personal data export requests

2026-07-28 18:05:34 +02:00

caldav

fix(caldav): report completion status from Done instead of done_at

2026-07-30 11:32:24 +02:00

caldavtests

fix(caldav): don't duplicate a task when a client PUTs a stale href

2026-08-18 12:55:13 +02:00

cmd

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

config

fix(ratelimit): give session renewal its own budget

2026-08-18 14:01:06 +02:00

cron

…

db

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

doctor

feat: report ParadeDB extension and index status in doctor command

2026-08-05 19:27:12 +02:00

e2etests

…

events

…

files

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-08-19 00:39:19 +00:00

initialize

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

license

fix(license): refuse redirects and use the SSRF-safe http client for checks

2026-07-28 17:26:12 +02:00

log

…

mail

fix(user): keep old email active until new one is confirmed

2026-08-18 22:03:38 +02:00

metrics

fix(metrics): store active users as TTL keys in keyvalue to avoid concurrent map access

2026-08-19 17:29:35 +02:00

migration

feat(user): add pending_email column

2026-08-18 22:03:38 +02:00

models

fix(projects): deny writes to pseudo projects across the permission family

2026-08-19 16:02:39 +02:00

modules

feat(keyvalue): add PutWithTTL to the storage interface

2026-08-19 17:29:35 +02:00

notifications

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

plugins

fix: expose xorm and xormigrate to yaegi plugins

2026-08-18 22:03:09 +02:00

red

…

richtext

feat(richtext): add markdown-domain change detection

2026-06-29 08:12:35 +02:00

routes

fix(caldav): stop answering requests out of process-wide state

2026-08-19 22:24:21 +02:00

swagger

[skip ci] Updated swagger docs

2026-08-19 00:53:08 +00:00

user

fix(user): expire used TOTP passcodes via keyvalue TTL

2026-08-19 17:29:35 +02:00

utils

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

version

…

web

fix(web): stop logging the full auth object on permission denials

2026-07-29 07:58:17 +00:00

websocket

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

webtests

fix(caldav): encode task uids in hrefs instead of interpolating them raw (#3560)

2026-08-19 20:13:06 +00:00

yaegi_symbols

[skip ci] Updated yaegi symbols

2026-08-19 16:27:07 +00:00