v0.11.0

Added

• Directory pages can list event types in a deliberate order. Set Directory order on
  an event type and public person and team pages sort by it, so the meeting you want booked
  first is the one a visitor sees first. Lower numbers come first, equal numbers sort by
  name, and an event with no order set keeps its existing position.
• Public pages and emails can carry your business branding. Set once under Settings →
  Branding: a business name, a logo, a banner, and your Privacy and Terms URLs. Both images
  have an opacity control, and the logo's height is set for email (public pages scale it
  up). Applied to the directory, booking and manage pages, and to emails.
• Calendar invites can come from Calnode instead of the host's calendar. A new
  per-event-type setting, Calendar invite → Sent by. The default is unchanged: the host's
  connected calendar invites the booker, from the host's own address. Choose Calnode and
  the booker's invite comes from your workspace's email sender (Settings → Email) instead,
  so no host's personal address reaches them, and a team can book under one name. Hosts
  still get the meeting, with its Meet/Teams link, on their own calendar. Needs email set
  up. Existing bookings keep the way they were invited.
• RSVP tracking for invites Calnode sends. With Resend receiving set up (Settings →
  Email → RSVP tracking), a booker's Yes / No / Maybe is read from their calendar reply,
  shown on the booking, and sent as a new booking.rsvp webhook event. Calnode sets up the
  Resend webhook itself (manual steps as a fallback) and needs a full-access Resend API
  key. Each invite gets a private reply address, and an answer only counts when Resend
  verified it came from that booking's booker.

Security

• Go toolchain 1.26.9, and the Docker image builds with Go 1.27.2. Both close 12
  published Go standard-library vulnerabilities that govulncheck reports as reachable
  from Calnode: GO-2026-6599 and GO-2026-6600 (html/template); GO-2026-6603,
  GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (HTTP/2 in net/http);
  GO-2026-6605, GO-2026-6609 and GO-2026-6613 (net/http); GO-2026-6607 (crypto/tls);
  and GO-2026-6608 (net/textproto). go.mod moves from toolchain go1.26.6 and the
  builder image from golang:1.27.1-alpine. No code or dependency change.