v0.99.1

[0.99.1] — 2026-02-20

Bug Fixes

• microsoft-oauth: Surface admin consent required error to users
• docker: Remove redundant hex/rebar install step
• csp: Resolve Credo warnings in SecurityHeadersPlug
• csp: Add analytics provider origins to script-src
• test: Rename bare _ to _i in for comprehension to satisfy Credo consistency check
• test: Pre-exhaust rate limit via API to prevent clear_all race in embed settings test
• core: Resolve compiler warnings and Credo violations
• core: Language switcher clickaway and lazy hook destroy collision
• core: Guard against nil duration in maybe_assign_meeting_type
• core: Address code review issues in embed test suite
• core: Fix scheduling box overflow when time slots list is too long
• core: Remove duplicate Tymeslot suffix from page titles
• core: Harden password DoS guard and sanitize backslash redirects
• core: Fix failing and flaky tests across multiple test modules
• core: Remove unused LinkAccessPolicy alias in theme integration test
• core: Move @moduletag after use in all test modules
• core: Add @moduletag :security to rate_limiter_dashboard_test
• core: Add @moduletag taxonomy tags to test modules
• core: Remove @moduletag inserted inside alias blocks in test files
• core: Sort Tymeslot.Security aliases alphabetically in auth modules
• core: Rename anonymous _ variables to _error in input validators test
• core: Remove unreachable list guard in booking orchestrator
• core: Remove unreachable catch-all clause in theme customization rate limiter
• core: Correct @SPEC type for assign_form_errors from list() to map()
• core: Remove unreachable nil guard in assign_theme_customization_data
• core: Address review issues in webhook input validation sanitization
• core: Add UniversalSanitizer to webhook name and URL validation
• core: Update rhythm theme confirmation page layout and label
• core: Fix reCAPTCHA v3 hook so booking form token is populated on submit
• core: Fix honeypot visibility and recaptcha disclaimer layout in booking themes
• core: Fix logger_json formatter config for OTP 28
• core: Remove unreachable clause in sanitize_css_class
• core: Fix type errors in proxy verifier
• test: Make availability fetch truly synchronous in tests
• core: Align credo version and resolve sitemap routing issues
• core: Handle HTML entity escaping in theme readiness error test
• core: Resolve compiler warnings and test failures
• core: Exclude Credo checks from compilation paths
• core: Add Phoenix.CodeReloader listener to mix.exs
• core: Resolve Credo warnings for nested module aliases and line length
• core: Handle empty string meeting_id in custom video provider
• security: Sanitize CSS class names in icon rendering to prevent XSS
• coverage: Replace .coveralls.exs with coveralls.json for proper exclusions
• brand: Add w-auto to logo images to preserve dimensions while fixing layout
• brand: Add explicit dimensions to logo images to prevent layout shift
• rhythm theme: Improve language dropdown text contrast
• test: Correct error message expectation in ErrorHandler test
• test: Use dynamic future date in quill meeting tests
• quill: Improve step navigation contrast on bright backgrounds
• scheduling: Hide language dropdown after slide 1 and fix layout jump
• Correct CAStore API usage in SMTP config
• Remove unreachable pattern match in meeting settings card
• onboarding: Remove unreachable pattern match clauses
• Correct CAStore API usage in mailer health check

Features

• auth: Add regenerate_verification_token/1 to Auth context
• core: Add integration_unhealthy email template tests and fix strong tag rendering
• core: Persist integration health state and notify users on sustained failures
• core: Add page titles and meta descriptions to auth pages
• core: Add rate limiting to all dashboard write operations
• core: Add rate limiting to all dashboard write operations
• core: Implement structured logging with logger_json
• security: Add spam protection to booking forms with honeypot and reCAPTCHA v3
• security: Add rate limiting to theme customization and meeting operations
• core: Add Zimbra calendar provider with SSRF protection
• core: Fix proxy authentication and add verification tools
• quill: Add --flag-height design token for consistency