kolaente fb1d9919b6 fix: ignore a task index outside the range a project can hold ...

address pr-swarm finding: index is documented read only but huma does not strip
read only fields from a request body, so a caller could post index MaxInt64.
calculateNextTaskIndex then wrapped to MinInt64 and every later create in that
project collided on the unique (project, index) constraint - one request, task
creation in a shared project broken for everyone, permanently.

Internal callers legitimately pass an index (duplication keeps task numbering),
so an implausible one now falls back to the server assigned next index instead
of being rejected outright.

Claude-Session: https://claude.ai/code/session_01GR9u1EFvq994jqGoeJqYSX

2026-07-30 00:28:00 +02:00

..

audit

feat: audit admin reads and denied admin access

2026-07-03 16:56:03 +00:00

caldav

fix(caldav): compute VTODO DURATION components correctly (#3155)

2026-07-11 17:28:59 +02:00

caldavtests

…

cmd

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

config

fix(filters): resolve relative and absolute date filters in UTC (#3181) 🤖🤖🤖 (#3229)

2026-07-19 13:31:21 +02:00

cron

…

db

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

doctor

…

e2etests

…

events

…

files

fix: GCS signing issue (#2920)

2026-07-02 17:38:37 +02:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-07-25 00:24:11 +00:00

initialize

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

license

…

log

…

mail

fix(cli): drain the mail queue before user commands exit

2026-07-09 17:05:21 +00:00

metrics

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

migration

perf(tasks): index task_positions on (project_view_id, position)

2026-07-26 01:13:08 +00:00

models

fix: ignore a task index outside the range a project can hold

2026-07-30 00:28:00 +02:00

modules

fix(migration): seed task positions for exports without order information

2026-07-26 01:13:08 +00:00

notifications

fix(notifications): render Markdown in plain-text emails (#3219)

2026-07-18 14:39:32 +02:00

plugins

…

red

…

richtext

feat(richtext): add markdown-domain change detection

2026-06-29 08:12:35 +02:00

routes

fix: let the server pick the position of a bulk created task

2026-07-29 21:44:55 +02:00

swagger

docs: fix @Success 200 -> 201 on 5 PUT/Create endpoints

2026-07-18 17:05:32 +00:00

user

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

utils

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

version

…

web

fix: interpolate dynamic values into translated error toasts

2026-07-18 13:41:15 +00:00

websocket

…

webtests

feat: raise the bulk create limit to 200 tasks

2026-07-29 21:51:17 +02:00

yaegi_symbols

feat(filters): generate open task saved filter on user creation

2026-06-27 13:35:50 +00:00