v0.96.1

[0.96.1] — 2026-03-11

Bug Fixes

• core: Correct git-cliff archive path in release workflows
• core: Use find to locate git-cliff binary after extraction
• core: Restrict valid? to country-based timezones to prevent UTC fallback showing first list entry

Features

• core: Add GitHub release workflows and cliff.toml

[0.99.22] — 2026-03-11

Bug Fixes

• core: Show theme background in embedded Rhythm iframes
• core: Fix timezone dropdown positioning in embedded iframes
• core: Use fixed height on iframe wrapper instead of minHeight

Features

• core: Display version number in site footer
• core: Rewrite session cookie to SameSite=None for cross-site iframes

[0.99.21] — 2026-03-10

Bug Fixes

• core: Correct build-docker.sh to operate within apps/tymeslot/

[0.99.20] — 2026-03-10

Features

• core: Log Cloudron addon detection at startup
• core: Auto-detect Cloudron OIDC addon in runtime config
• core: Auto-detect Cloudron sendmail addon in runtime config
• core: Add CloudronConfig module for sendmail addon
• core: Declare OIDC addon in Cloudron manifest
• core: Declare sendmail addon in Cloudron manifest

[0.99.19] — 2026-03-10

Bug Fixes

• core: Stop sanitizing calendar integration passwords
• core: Prevent integration passwords from leaking into debug logs

[0.99.18] — 2026-03-10

Bug Fixes

• core: Update embed pipeline integration test for dev/test localhost behaviour
• core: Allow localhost embedding in dev/test without configuring allowed domains

Features

• core: Add iframe embedding, weekly calendar view, and shared scheduling init
• core: Add canonical URL tag and current_url/1 layout helper

[0.99.17] — 2026-03-06

Bug Fixes

• core: Address code quality issues in Telegram integration
• core: Address code review issues in Telegram integration
• core: Skip calendar deletion for unlinked meetings and fix resolve_client fallback
• core: Resolve confirmation page overflow in rhythm theme
• core: Pass attendee_locale through ContentBuilder for cancellation and reschedule emails

Features

• core: Add Telegram notification integration
• core: Add Credo check for hand-rolled modal backdrops
• core: Shared-bot Telegram wizard with link expiry and reconnect
• core: Add Telegram notification integration

[0.99.16] — 2026-03-05

Bug Fixes

• Request meetings.space.created scope in Google Meet OAuth flow
• Use hexpm bookworm builder to satisfy cloudron/base OpenSSL 3.0
• Use debian:trixie-slim runtime to satisfy OpenSSL 3.4 requirement

Features

• core: Add changelog link to site footer
• Add Docs link to site footer

[0.99.15] — 2026-03-04

Bug Fixes

• core: Move circuit breaker provider lookups from compile time to runtime
• core: Use consistent short labels for OAuth buttons on signup page
• core: Resolve flaky booking LiveView tests caused by config pollution
• core: Add update_subscription_status/3 callback to SubscriptionManager behaviour
• core: Fix reset-password token URI matching and update OAuth tests to use session
• core: Add is_verified flag to OAuth email-linking test
• core: Fill empty English translations for cancel/reschedule meeting strings
• core: Unwrap {state, timestamp} tuple in OAuth state session test
• core: Correct OAuth provider callback specs and remove dead clauses
• core: Add top-level aliases and remove TODO tag in OAuth state modules
• core: Harden OAuth SSO security and validation
• core: Accept string email_verified claim and document IdP switching
• core: Add defensive fallbacks and fix email verification default
• core: Use constant-time comparison and TTL for OAuth state
• core: Move OAuth registration data from URL params to session

Features

• Add PASSWORD_AUTH_ENABLED flag to disable password-based auth

[0.99.14] — 2026-03-03

Bug Fixes

• core: Validate generic OAuth config and respect email_verified claim
• core: Dispatch meeting.rescheduled event in reschedule flow

Features

• core: Add generic OAuth/OIDC provider support for SSO authentication
• core: Localize meeting cancel, reschedule, and cancel-confirmed pages

[0.99.13] — 2026-03-03

Bug Fixes

• core: Request calendar.events scope instead of broad calendar scope

Features

• saas: Add floating docs table-of-contents hook

[0.99.12] — 2026-03-03

Bug Fixes

• core: Gate OAuth registration paths on REGISTRATION_ENABLED flag
• core: Deduplicate registration-disabled message and gate complete-registration route

Features

• core: Build embed.js via esbuild and bump version to 0.99.12
• saas: Add SEO-optimised author profile pages with docs bylines
• core: Add REGISTRATION_ENABLED flag to gate all registration paths

[0.99.11] — 2026-02-27

Bug Fixes

• core: Name unused variable consistently in calendar workflows
• core: Add missing in_person provider icon assets
• core: Correct broken calendar link in meeting settings empty state
• core: Show inactive calendar integrations in meeting settings and fix persist fallback

Features

• core: Add arrow_right icon to IconComponents

[0.99.10] — 2026-02-27

Bug Fixes

• health_check: Name unused pattern variables consistently
• onboarding: Persist browser-detected timezone to DB on mount
• health_check: Normalize orchestrate_health_check return to match spec
• test: Configure google_oauth state secret in VideoOAuthController test setup
• test: Fix FunctionClauseError in webhook worker timeout test

[0.99.9] — 2026-02-26

Bug Fixes

• dialyzer: Suppress false-positive call_without_opaque in gettext.ex
• core: Harden worker logging — safe error formatting, early discard on missing meeting
• payments: Expire superseded Stripe checkout sessions on retry
• db: Cascade delete meetings when user is deleted
• structured_logger: Suppress unused variable warning in log_by_phase/2

Features

• core: Add ObanLogger telemetry handler for job process tracing
• core: Add LoggerMetadataHook for LiveView process tracing
• webhooks: Store Stripe event payload and auto-nullify after 30 days

[0.99.8] — 2026-02-26

Bug Fixes

• logging: Raise Credo checks to :high and clear all remaining Core violations (Phase 5)
• logging: Fix workers and web layer Logger violations (Phase 3)
• logging: Fix infrastructure and security domain Logger violations (Phase 3)
• logging: Fix integrations domain Logger violations (Phase 3, integrations)
• logging: Fix payments domain Logger violations (Phase 3, payments)
• logging: Fix auth domain Logger violations (Phase 3, auth)
• credo: Detect lazy Logger fn forms; disable MissedMetadataKeyInLoggerConfig

Features

• credo: Add logger hygiene checks (Phase 2)
• logging: Structured logging infrastructure (Phase 1)

[0.99.7] — 2026-02-26

Bug Fixes

• Correctly preserve meeting duration through the booking flow (closes #17)
• video-oauth: Use provider-specific state secrets for Google Meet and Teams

[0.99.5] — 2026-02-25

Bug Fixes

• caldav: Correct false-vs-nil conflation and remove dead rescue
• caldav: Harden percent-encoding fix for reliability and completeness
• caldav: Handle percent-encoded calendar IDs in validation and matching
• dev: Increase Oban stage_interval to avoid crash during code reload
• tests: Resolve ambiguous selectors and async assertion in VideoSettingsComponentTest
• dialyzer: Suppress false contract_with_opaque on valid_ids/0
• caldav: Suppress retries on guessed discovery path
• ui: Move integration card action buttons next to toggle on desktop
• ui: Improve theme customization toolbar and background tabs on mobile
• ui: Improve webhook card layout on mobile
• ui: Improve calendar integration card layout on mobile
• ui: Improve video integration card and modal layout on mobile
• ui: Fix mobile layout of meeting type cards and edit form header
• ui: Raise mobile sidebar z-index above top navigation bar

Features

• Per-attendee locale for email rendering
• emails: Add plain-text fallbacks to all email templates
• caldav: Add RFC 4791 discovery fallback, Zimbra CRUD coverage, and XML parser improvements
• ui: Add mobile timeline view for availability grid
• video: Add edit modal, show URLs in list, fix test connection
• ui: Close mobile sidebar on nav link selection
• ui: Add logo to mobile sidebar header next to close button

[0.99.4] — 2026-02-24

Bug Fixes

• core: Add zimbra to calendar provider DB constraint
• core: Convert non-standard HTTP methods to uppercase strings for Finch
• core: Left-align body text in integration unhealthy email
• config: Fix coveralls terminal_options key and set file_column_width to 125
• lint: Resolve Credo warnings in CalDAV base and discovery service
• core: Migrate CalDAV header handling to Req map format
• core: Add Zimbra to DiscoveryService routing and path_utils
• core: Snooze CalendarEventWorker for circuit recovery on :circuit_open
• core: Return error when all calendar fetches fail in range queries
• core: Register Zimbra provider in registry and add discovery case
• core: Resolve Credo warnings for unused var names and thin wrapper
• core: Correct country mapping for Asia/Yangon to Myanmar
• core: Sort availability slots chronologically within each time period
• deploy: Make asset builds hermetic in all Dockerfiles

[0.99.3] — 2026-02-23

Bug Fixes

• core: Restore visibility and center "Forgot password?" link on login
• core: Build JS bundles in Docker and make asset build hermetic
• railway: Replace shell script with railpack.json start command
• railway: Use absolute path for release binary in railway_start.sh
• railway: Use shell script for start cmd to avoid eval escaping issues
• railway: Move nixpacks.toml to apps/tymeslot (Railway root directory)

[0.99.1] — 2026-02-20

Bug Fixes

• microsoft-oauth: Surface admin consent required error to users
• docker: Remove redundant hex/rebar install step
• csp: Resolve Credo warnings in SecurityHeadersPlug
• csp: Add analytics provider origins to script-src
• test: Rename bare _ to _i in for comprehension to satisfy Credo consistency check
• test: Pre-exhaust rate limit via API to prevent clear_all race in embed settings test
• core: Resolve compiler warnings and Credo violations
• core: Language switcher clickaway and lazy hook destroy collision
• core: Guard against nil duration in maybe_assign_meeting_type
• core: Address code review issues in embed test suite
• core: Fix scheduling box overflow when time slots list is too long
• core: Remove duplicate Tymeslot suffix from page titles
• core: Harden password DoS guard and sanitize backslash redirects
• core: Fix failing and flaky tests across multiple test modules
• core: Remove unused LinkAccessPolicy alias in theme integration test
• core: Move @moduletag after use in all test modules
• core: Add @moduletag :security to rate_limiter_dashboard_test
• core: Add @moduletag taxonomy tags to test modules
• core: Remove @moduletag inserted inside alias blocks in test files
• core: Sort Tymeslot.Security aliases alphabetically in auth modules
• core: Rename anonymous _ variables to _error in input validators test
• core: Remove unreachable list guard in booking orchestrator
• core: Remove unreachable catch-all clause in theme customization rate limiter
• core: Correct @SPEC type for assign_form_errors from list() to map()
• core: Remove unreachable nil guard in assign_theme_customization_data
• core: Address review issues in webhook input validation sanitization
• core: Add UniversalSanitizer to webhook name and URL validation
• core: Update rhythm theme confirmation page layout and label
• core: Fix reCAPTCHA v3 hook so booking form token is populated on submit
• core: Fix honeypot visibility and recaptcha disclaimer layout in booking themes
• core: Fix logger_json formatter config for OTP 28
• core: Remove unreachable clause in sanitize_css_class
• core: Fix type errors in proxy verifier
• test: Make availability fetch truly synchronous in tests
• core: Align credo version and resolve sitemap routing issues
• core: Handle HTML entity escaping in theme readiness error test
• core: Resolve compiler warnings and test failures
• core: Exclude Credo checks from compilation paths
• core: Add Phoenix.CodeReloader listener to mix.exs
• core: Resolve Credo warnings for nested module aliases and line length
• core: Handle empty string meeting_id in custom video provider
• security: Sanitize CSS class names in icon rendering to prevent XSS
• coverage: Replace .coveralls.exs with coveralls.json for proper exclusions
• brand: Add w-auto to logo images to preserve dimensions while fixing layout
• brand: Add explicit dimensions to logo images to prevent layout shift
• rhythm theme: Improve language dropdown text contrast
• test: Correct error message expectation in ErrorHandler test
• test: Use dynamic future date in quill meeting tests
• quill: Improve step navigation contrast on bright backgrounds
• scheduling: Hide language dropdown after slide 1 and fix layout jump
• Correct CAStore API usage in SMTP config
• Remove unreachable pattern match in meeting settings card
• onboarding: Remove unreachable pattern match clauses
• Correct CAStore API usage in mailer health check

Features

• auth: Add regenerate_verification_token/1 to Auth context
• core: Add integration_unhealthy email template tests and fix strong tag rendering
• core: Persist integration health state and notify users on sustained failures
• core: Add page titles and meta descriptions to auth pages
• core: Add rate limiting to all dashboard write operations
• core: Add rate limiting to all dashboard write operations
• core: Implement structured logging with logger_json
• security: Add spam protection to booking forms with honeypot and reCAPTCHA v3
• security: Add rate limiting to theme customization and meeting operations
• core: Add Zimbra calendar provider with SSRF protection
• core: Fix proxy authentication and add verification tools
• quill: Add --flag-height design token for consistency

[0.98.0] — 2026-02-15

Features

• core: Add HTTP proxy environment variable support
• core: Add HTTP proxy configuration support
• Add Zimbra calendar provider support

[0.97.1] — 2026-02-13

Bug Fixes

• Resize caldav, local, and custom icons to match other provider icons
• Remove vertical jump on brand-card hover
• Remove false positive logging in universal sanitizer
• Restore spillover functionality in availability tests
• Sync video circuit breaker providers with actual video integrations
• Add fallback for unsupported Flagpack country codes in timezone selector
• Correctly parse castore CA certificates from PEM file
• Improve CalDAV server detection accuracy and legacy support
• Correct Docker build context and use committed dependency versions
• Correct Microsoft OAuth redirect URIs and add missing details in .env.example
• Correct Google Meet provider name from google_calendar to google_meet
• Support slug format in duration formatting
• Move custom_input_mode_helper.ex to match module name convention
• Use consistent provider icons across all integration UI surfaces
• Update test assertions after component and locale changes
• Update locale plug tests after adding French support
• Auto-detect CalDAV server types for proper authentication
• Add missing translation strings to English locale
• Align postgrex version in core mix.lock with root
• Use dynamic app URL instead of hardcoded domain in onboarding
• Use standard ports for Docker URL generation in production
• Add nil-safe fallbacks to pricing and fix zero-duration parsing

Features

• Add configurable LISTEN_IP with robust validation
• Enhance custom video provider support
• Add template variable support for custom video URLs with fragment validation
• Add complete French (fr) translation support

[0.96.1] — 2026-03-11

Bug Fixes

• Explicitly block auth routes in robots.txt
• Remove unused variable in ensure_calendar_list
• Resolve code quality warnings
• Improve code readability and performance in core
• Resolve race condition and improve queue monitoring infrastructure
• Remove Core deps symlink and align dependency versions
• Enable standalone core deployment and make Stripe optional
• Skip empty blur validation and extract avatar modal
• Unify form input spacing for leading icons and prefixes
• Streamline video room creation and theme tests
• Import flash_group in auth layout
• embed: Build safe URLs and restore overflow
• Stop video playback on slow connections
• Address compilation and credo warnings
• utils: Improve ISO 8601 duration parsing correctness
• Guard dashboard hook config
• Suppress log noise during initial booking form render
• Make language switcher click-away handler conditional
• Add missing track_form_change event handler in VideoSettingsComponent
• Resolve UndefinedFunctionError in MiroTalk provider HTTP client
• Improve MiroTalk provider robustness and fix test assertions
• Improve video room worker robustness and fix test assertions
• Allow localhost and 127.0.0.1 for embedding in development
• Restore QuillVideo hook and add theme hook tests
• Remove unused scheduling.css from tailwind build config
• quill: Prevent duration tag from stretching with multi-line titles
• Ensure custom credo checks are loaded in core app
• Expand Stripe webhook handling and idempotency
• Enhance payment reconciliation and subscription persistence reliability
• Improve payment system robustness and configuration consistency
• Resolve credo and logger warnings in admin alerts and email service
• Resolve credo issues and warnings across umbrella project
• Resolve unreachable patterns and high complexity in webhook handlers
• Allow websocket connections in dev by updating CSP
• Improve citation box rotation and mobile responsiveness
• Add missing @SPEC type specifications and fix linting issues
• Improve locale persistence and navigation on theme booking pages
• Replace String.to_atom/1 with String.to_existing_atom/1 in validation helpers
• test: Improve test robustness, performance, and utility nil-safety
• security: Implement recursive sanitization and deterministic errors
• Handle DST gaps in business hours and harden OAuth token validation
• availability: Respect business days in fallback logic and harden tests
• email-testing: Update testers with missing fields for template rendering

Features

• email: Add comprehensive SMTP configuration and startup validation
• Add external database support for Docker deployment
• Restore marketing screenshots and update gitignore rules
• Generate video poster frames from video start
• Add video background posters separate from thumbnails
• theme: Add video poster for presets
• saas: Record legal acceptance on signup
• booking: Suppress validation errors until form interaction
• Enhance datetime utils with more robust parsing and testing
• Add user agent to LiveView connect_info and improve extraction
• Add generic analytics provider support with Umami implementation
• Dynamic robots.txt serving based on deployment type
• Implement sitemap.xml for SaaS marketing site
• Suppress LiveView disconnect toast during OAuth navigation
• Implement secure-by-default embedding and dashboard preview
• Implement video room recovery mechanism and enhanced retry logic
• Implement feature gating for automations and SaaS subscription integration
• Cache branding status and refresh on subscription changes
• Add show_branding feature flag to control "Powered by Tymeslot" visibility
• Rename notification settings to automation and add bolt icon
• Implement integrated branding footer for scheduling pages
• Background subscription event processing and cancellation persistence
• Replace native confirmation with themed modal for subscription cancellation
• Add support for customer.updated webhook event
• Enhance subscription flow with race condition handling and trialing support
• Add Stripe billing portal support and subscription status views
• Implement Phase 4 - payment system feature completeness
• Make add break form collapsible in availability settings
• Implement robust Stripe webhook handlers for disputes, refunds, and trials
• Implement SaaS-specific payment email templates and tests
• Log unhandled stripe events and update env template
• Enhance embed widget security and customization
• Implement drag-and-drop reordering for meeting types
• Implement Stripe payments and SaaS subscription management
• Enhance SaaS email infrastructure and dashboard integration
• Add default reminder settings and transition to slug-based meeting types
• Customizable multiple reminders per appointment type
• integrations: Harden Outlook availability and Microsoft Teams OAuth
• integrations: Enhance Microsoft (Outlook and Teams) integration
• security: Enhance input validation, rate limiting, and security test coverage
• availability: Implement duration-aware gap logic and ETS caching
• layout: Implement generic theme extension system for UI injection
• auth: Harden session security and improve OAuth resilience
• security: Add support for wildcard domain prefixes in allowed embed domains
• emails: Redesign templates with modern design tokens and Inter font
• ui: Overhaul dashboard UI with token-based design system and glassmorphism
• core: Enhance availability engine and scheduling logic
• webhooks: Enhance security, delivery resilience, and atomic failure tracking
• i18n: Implement comprehensive localization and internationalization support
• integrations: Implement pluggable calendar architecture and improve worker resilience
• Add internationalization (i18n) support for booking pages
• Implement booking widget embedding with security controls
• Complete app redesign and modernization
• Refactor webhooks into a unified notifications dashboard