v0.5.0

What's Changed

• Silver criteria: repeatable build, release verification, CONTRIBUTING, assurance case by @Yoshiofthewire in #72
• ci: build with the Go version go.mod names by @Yoshiofthewire in #73
• fix: bind CSRF tokens to the session and let local accounts enrol TOTP by @Yoshiofthewire in #74
• docs: add license, contributing, security, and code of conduct by @Yoshiofthewire in #75
• chore: re-vendor go-webdav (AI/LLM fork labeling) by @Yoshiofthewire in #76
• Add OpenSSF Best Practices and Scorecard badges by @Yoshiofthewire in #77
• feat: unify calendar with the Busnes suite shell by @Yoshiofthewire in #79
• Enforce KyCalendar key floors and support strong TLS by @Yoshiofthewire in #80
• appearance: theme page for every role, no sidebar select by @Yoshiofthewire in #81
• Sync ky-ui 0.4.1 classic theme catalog by @Yoshiofthewire in #82
• chore(deps): Bump alpine from 294b683 to be26560 by @dependabot[bot] in #83
• chore(deps): Bump the go group with 2 updates by @dependabot[bot] in #84
• chore(ci): Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 in the actions group by @dependabot[bot] in #87
• chore(deps): Bump vite from 8.3.4 to 8.3.5 in /web in the npm-build group by @dependabot[bot] in #85
• chore(deps): Bump lucide-react from 1.59.0 to 1.61.0 in /web in the npm-runtime group by @dependabot[bot] in #86
• feat(sso): end sessions on KyIdentity back-channel logout by @Yoshiofthewire in #88
• fix(sso): fence subject-wide back-channel logout by @Yoshiofthewire in #89
• fix(store): sign out SSO sessions no back-channel logout can reach by @Yoshiofthewire in #90
• Sync ky-ui 0.4.3: field and status contrast by @Yoshiofthewire in #91
• Improve KyCalendar phone views and keyboard focus by @Yoshiofthewire in #92
• Restore KyCalendar time labels and keyboard navigation by @Yoshiofthewire in #93
• Record corrected KyCalendar captures and comparison gallery by @Yoshiofthewire in #94
• Restore start times in phone Month view by @Yoshiofthewire in #95
• Record KyCalendar round 3 results and owner Month preference by @Yoshiofthewire in #96
• docs: add OctoCounts badge to the License section by @Yoshiofthewire in #97
• ci: run plain and strong-key race suites in parallel per backend by @Yoshiofthewire in #98
• ci: give every non-PR run its own concurrency group by @Yoshiofthewire in #99
• Start the 0.5.0 release line by @Yoshiofthewire in #100

Full Changelog: v0.4.3...v0.5.0

v0.4.3

What's Changed

• ci(compat): run go mod tidy after pointing at ky-primitives by @Yoshiofthewire in #70
• docs: operator checklist for the scheduling device gate by @Yoshiofthewire in #71

Full Changelog: v.0.4.3...v0.4.3

v0.4.2

What's Changed

• KyCalendar Plan 1: core CalDAV server by @Yoshiofthewire in #5
• chore(deps): Bump github.com/Busnes-app/ky-primitives from 0.8.0 to 0.9.0 in the ky-primitives group by @dependabot[bot] in #1
• chore(deps): Bump modernc.org/sqlite from 1.59.0 to 1.60.1 in the go group by @dependabot[bot] in #2
• chore(deps): Bump the npm-runtime group across 1 directory with 3 updates by @dependabot[bot] in #4
• chore(deps): Bump the npm-build group across 1 directory with 6 updates by @dependabot[bot] in #3
• docs(dependabot): any bundle-changing npm bump needs a dist rebuild by @Yoshiofthewire in #6
• KyCalendar Plan 2: group calendars and access by @Yoshiofthewire in #7
• fix(sso,scim): revoke before storing a privilege change on every path by @Yoshiofthewire in #8
• KyCalendar Plan 3: recurrence and event API by @Yoshiofthewire in #9
• KyCalendar Plan 4: backup and restore backend by @Yoshiofthewire in #11
• fix(cli): init-admin reads its password from stdin by @Yoshiofthewire in #12
• fix(sso): refuse a username clash clearly; add rename-user by @Yoshiofthewire in #13
• Standalone administration 1/3: local groups by @Yoshiofthewire in #14
• Standalone administration 2/3: people by @Yoshiofthewire in #15
• Standalone administration 3/3: sign-in by @Yoshiofthewire in #16
• SCIM never touches local accounts; admin reattach across issuers by @Yoshiofthewire in #17
• fix(store): lock the acting admin's row in every access write by @Yoshiofthewire in #18
• v1a cleanup: SCIM group PATCH, filter escapes, refusal audit, name rules, list paging by @Yoshiofthewire in #19
• Drop the "Feature 0" label from KyBackup by @Yoshiofthewire in #20
• fix: build with Go 1.27.2; raise go.mod floor to 1.26.9 by @Yoshiofthewire in #22
• docs(fork): point FORK.md at Busnes-app/go-webdav by @Yoshiofthewire in #21
• ci: add OpenSSF Scorecard workflow by @Yoshiofthewire in #23
• chore: standard Go bump method by @Yoshiofthewire in #24
• fix(web): calendar layout, KyCalendar name, Single Sign On label by @Yoshiofthewire in #27
• feat(installer): KyQuickStart apply-setup for KyCalendar by @Yoshiofthewire in #28
• chore(release): set every version source to 0.4.0 by @Yoshiofthewire in #29
• Fix hostile-review findings: CalDAV DoS, login brute force, SCIM scope, deploy defaults by @Yoshiofthewire in #34
• chore(deps): Bump golang.org/x/sys from 0.48.0 to 0.49.0 in the go group by @dependabot[bot] in #30
• mcp: add MCP access for AI agents by @Yoshiofthewire in #35
• Subscribe calendars to published ICS links by @Yoshiofthewire in #36
• Pin the MCP server's auth, audit and no-cancel guarantees by @Yoshiofthewire in #37
• chore(ci): Bump the actions group with 4 updates by @dependabot[bot] in #33
• chore(deps): Bump the npm-build group in /web with 3 updates by @dependabot[bot] in #31
• chore(deps): stop proposing FullCalendar major versions by @Yoshiofthewire in #38
• feat: tasks (VTODO) in task-list calendars by @Yoshiofthewire in #41
• chore(deps): Bump lucide-react from 1.51.0 to 1.56.0 in /web in the npm-runtime group across 1 directory by @dependabot[bot] in #39
• chore(deps): Bump vitest from 5.0.3 to 5.0.4 in /web in the npm-build group by @dependabot[bot] in #40
• release: v0.4.2 by @Yoshiofthewire in #42

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: https://github.com/Busnes-app/KyCalendar/commits/v0.4.2