kolaente c6f18e405c fix(caldav): build iCalendar output linearly, cap reminders and titles ...

Every VALARM repeats the task title and the output was built with string
concatenation, so rendering cost grew quadratically with the number of
reminders. Build it with a strings.Builder instead.

Tasks may now have at most MaxRemindersPerTask (100) reminders and a
title of at most MaxTaskTitleLength (1000) characters, checked through
v1, v2 and CalDAV. On update the reminder limit only applies when the
count grows and the title limit only when the title changes, so existing
tasks stay editable.

2026-11-05 15:42:45 +01:00

..

admin_actions_test.go

fix(user): deliver password reset emails to locked accounts

2026-11-03 20:15:14 +01:00

admin_bypass_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

admin_bypass.go

…

admin_overview.go

feat(projects): exclude trashed projects from instance counts

2026-11-04 23:14:28 +01:00

admin_project_list.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

admin_team_list.go

fix(admin): rank exact and prefix team matches before the page cap

2026-10-01 17:29:10 +02:00

admin_user_actions.go

fix(cli): invalidate sessions when resetting a password directly

2026-11-03 20:15:14 +01:00

admin_user_create.go

…

api_routes_test.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_routes.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_tokens_expiry_cron_test.go

…

api_tokens_expiry_cron.go

…

api_tokens_expiry_notification_test.go

…

api_tokens_expiry_notification.go

…

api_tokens_permissions.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

api_tokens_test.go

fix(models): return 404 for missing api tokens on delete (#3944) (#4119)

2026-10-15 21:01:39 +00:00

api_tokens.go

fix(auth): refuse email-unconfirmed accounts on every credential path

2026-10-20 15:13:02 +02:00

bot_users_permissions.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

bot_users_test.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

bot_users.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

bulk_task_create_test.go

…

bulk_task_create.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

bulk_task_test.go

test(tasks): cover race move to writable project and bulk update race

2026-11-04 09:08:29 +01:00

bulk_task.go

fix(tasks): reject bulk updates without fields

2026-10-16 15:49:28 +02:00

comment_quotes_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

comment_quotes.go

…

error_test.go

fix(filters): omit filter expression from invalid filter HTTP error (#4306)

2026-11-03 08:57:46 +00:00

error.go

feat(models): add errors for linking user identities

2026-11-05 12:44:50 +01:00

events.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

export_test.go

fix(export): only replace the export file pointer if it is unchanged

2026-11-03 18:28:14 +01:00

export.go

fix(export): only replace the export file pointer if it is unchanged

2026-11-03 18:28:14 +01:00

favorites.go

…

filter_complexity_test.go

test: pin error values for filter nesting and relation hierarchy limits

2026-11-03 21:04:05 +01:00

hex_color_validation_test.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

kanban_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

kanban_task_bucket_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

kanban_task_bucket.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

kanban_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

kanban.go

fix(kanban): cap manual buckets at 100 per view

2026-10-20 15:13:02 +02:00

label_permissions.go

…

label_task_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

label_task_test.go

…

label_task.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

label_test.go

feat(user): attach bot owner to bot users in central loaders

2026-10-30 22:57:12 +01:00

label.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

link_sharing_permissions.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

link_sharing_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

link_sharing.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

listeners_test.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

listeners.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

main_test.go

…

mentions_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

mentions.go

fix(avatar): cancel an avatar decode when the client goes away

2026-10-20 23:05:30 +02:00

message.go

…

metrics_count_test.go

feat(projects): exclude trashed projects from instance counts

2026-11-04 23:14:28 +01:00

models.go

…

notifications_database.go

…

notifications_permissions_test.go

…

notifications_permissions.go

…

notifications_refresh_test.go

…

notifications_refresh.go

…

notifications_task_identifier_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

notifications_test.go

fix(reminders): show due reminders in notifications without email

2026-10-01 15:38:27 +02:00

notifications.go

fix(avatar): cancel an avatar decode when the client goes away

2026-10-20 23:05:30 +02:00

oauth_codes.go

…

permissions_test.go

…

permissions.go

…

project_access_cleanup_test.go

test(projects): share trash admin and webhook test setup

2026-11-04 23:14:28 +01:00

project_access_cleanup.go

fix(projects): preserve trashed data during user cleanup

2026-11-04 23:14:28 +01:00

project_access_test.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

project_access.go

feat(projects): add trash metadata and access filtering

2026-11-04 23:14:28 +01:00

project_ancestor_test.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

project_ancestor.go

feat(projects): trash and restore project trees

2026-11-04 23:14:28 +01:00

project_duplicate_test.go

fix(projects): archive duplicates after copying attachments

2026-11-05 11:29:33 +01:00

project_duplicate.go

fix(projects): archive duplicates after copying attachments

2026-11-05 11:29:33 +01:00

project_json_test.go

…

project_permissions_multiple_teams_test.go

…

project_permissions_pseudo_test.go

…

project_permissions_subproject_test.go

…

project_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_purge_test.go

fix(caldav): invalidate sync tokens after permanent deletion

2026-11-04 23:14:28 +01:00

project_purge.go

fix(caldav): invalidate sync tokens after permanent deletion

2026-11-04 23:14:28 +01:00

project_repair_test.go

…

project_repair.go

fix(projects): reserve identifiers and repair trashed orphans

2026-11-04 23:14:28 +01:00

project_team_foreign_test.go

…

project_team_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_team_test.go

…

project_team.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

project_trash_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

project_trash.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

project_users_permissions_test.go

…

project_users_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_users_test.go

…

project_users.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_view_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_view_test.go

fix(views): cap filter bucket configurations at 50

2026-10-20 15:13:02 +02:00

project_view.go

fix(views): cap filter bucket configurations at 50

2026-10-20 15:13:02 +02:00

project.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

reaction_permissions.go

…

reaction_test.go

fix(reactions): never return a null user in a reaction list

2026-10-13 23:43:18 +02:00

reaction.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

saved_filter_positions_test.go

…

saved_filters_permissions.go

…

saved_filters_test.go

perf(filters): look up matching tasks by id set when pruning filter kanban views

2026-11-03 21:04:05 +01:00

saved_filters.go

perf(filters): look up matching tasks by id set when pruning filter kanban views

2026-11-03 21:04:05 +01:00

sessions_permissions.go

…

sessions_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

sessions.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

setup_tests.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

subscription_permissions.go

…

subscription_test.go

…

subscription.go

fix(subscriptions): subscribe creators and assignees regardless of project subscriptions

2026-10-26 14:47:13 +01:00

task_assignees_archived_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_assignees_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

task_assignees_test.go

fix(subscriptions): subscribe creators and assignees regardless of project subscriptions

2026-10-26 14:47:13 +01:00

task_assignees.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_attachment_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

task_attachment_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_attachment.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_collection_filter_test.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

task_collection_filter.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

task_collection_sort_test.go

…

task_collection_sort.go

…

task_collection_test.go

fix(filters): respect filter_include_nulls on saved filter views

2026-09-30 21:33:09 +02:00

task_collection.go

docs(filters): describe the filter grammar in filter parameter docs

2026-10-19 13:25:00 +02:00

task_comment_permissions.go

…

task_comments_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_comments.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_created_notification_test.go

…

task_delete_cron_test.go

refactor(trash): share the retention setting

2026-11-04 23:14:28 +01:00

task_delete_cron.go

refactor(trash): share the retention setting

2026-11-04 23:14:28 +01:00

task_duplicate_test.go

…

task_duplicate.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_index_test.go

test(tasks): grant write access where tests move tasks out of unwritable projects

2026-11-04 09:08:29 +01:00

task_index.go

…

task_limits_test.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

task_overdue_reminder_test.go

fix(reminders): limit overdue task events to the recipient's projects

2026-11-05 15:42:45 +01:00

task_overdue_reminder.go

fix(reminders): limit overdue task events to the recipient's projects

2026-11-05 15:42:45 +01:00

task_position_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_position_view_test.go

…

task_position.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_relation_authz_test.go

…

task_relation_permissions.go

…

task_relation_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_relation_write_race_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_relation.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_reminder_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

task_reminder.go

feat(projects): skip trashed projects in reminder jobs

2026-11-04 23:14:28 +01:00

task_search_bench_test.go

…

task_search_favorites_access_test.go

…

task_search_subtask_access_test.go

…

task_search_test.go

fix(tasks): return no tasks when a search has no project scope

2026-10-02 19:08:02 +02:00

task_search.go

fix(tasks): return no tasks when a search has no project scope

2026-10-02 19:08:02 +02:00

task_trash_test.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_trash.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_unread_statuses.go

…

task_view_lock_test.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_write_race_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

tasks_permissions.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

tasks_test.go

fix(tasks): keep the deleting user's data out of the task deleted event

2026-11-05 15:42:45 +01:00

tasks.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

team_members_permissions.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

team_members_test.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

team_members.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

team_sync_test.go

fix(teams): only sync external team memberships of the current issuer

2026-11-03 20:15:14 +01:00

team_sync.go

fix(teams): only sync external team memberships of the current issuer

2026-11-03 20:15:14 +01:00

teams_permissions_test.go

…

teams_permissions.go

…

teams_test.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

teams.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

time_tracking_filter.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

time_tracking_test.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

time_tracking.go

fix(time-tracking): enforce project trash container permissions

2026-11-04 23:14:28 +01:00

unsplash.go

…

user_confirmation_test.go

…

user_delete_test.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

user_delete.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

user_invite_link_test.go

fix(db): rank accent-insensitive matches as exact

2026-10-22 11:58:48 +02:00

user_invite_link.go

…

user_list_test.go

fix(user): match exact username search literally on PostgreSQL

2026-11-03 20:15:14 +01:00

user_project_test.go

…

user_project.go

…

user_settings_test.go

fix(user): count wrong passwords on password change toward account lockout

2026-11-03 20:15:14 +01:00

user_settings.go

refactor(user): share password and TOTP reauthentication

2026-11-05 12:44:49 +01:00

users.go

…

webhooks_permissions.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

webhooks_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

webhooks.go

chore: better wording

2026-10-20 15:13:02 +02:00