v0.1.8

Changed

• Visual Studio solution versioned with the repository (Kubuno.Office.slnx, generated by vskubuno, the naming of
  every Kubuno repository): the server is the project Kubuno.Office.Server, the frontend Kubuno.Office.Web, in
  the solution folders Server, Libraries and Frontend, with the shared launch profile "Office (Kubuno Core + browser)".
  The crate and npm names do not change.

Fixed

• Database migrations keep the same checksum on every OS. The repository now
  pins line endings to LF (.gitattributes), so a checkout on Windows no longer
  turns SQL migrations, scripts, manifests or sources into CRLF. A database
  migrated by a Linux build is therefore no longer refused by a Windows or macOS
  build of the same version because its migration checksums differ.

• Syncing documents works again. The endpoint a syncing client asks for the
  list of changes since its last pull (GET /documents/delta) answered with a
  server error every single time, so nothing could ever be synced: the query had
  not been updated when documents gained an origin-format field, and the missing
  column broke the whole response. Listing documents was unaffected, which is
  why the failure looked like it came from the sync client.

• Documents now hand out their version marker on opening. Reading a document
  (GET /documents/:id) and starting an editing session
  (POST /documents/:id/editing/join) returned the document without its etag
  and content_etag, which a client needs to send If-Match on its first save.
  Until it had made one write it had no marker to quote, so two people — or one
  person on two devices — could silently overwrite each other on that first
  save; the conflict check only protected later writes. Both endpoints now
  return the markers, and joining an editing session returns the document
  itself alongside the editor list.

• A retried write is no longer replayed for ever. The store that lets a
  client safely retry a create or an edit (the Idempotency-Key header) kept
  every entry for the life of the instance. A client reusing a key weeks or
  months later — after reinstalling, or because it recycles its key space — got
  the old answer back and its new edit was silently dropped, and the table grew
  without limit. Replays are now honoured for 24 hours, the usual window for
  this, after which the key is treated as new and the entry is cleaned up in the
  background.

• A new document no longer claims to come from a Word file. Every document
  and every workbook created in Office was stamped with the instance's default
  save format, so it reported itself as imported from a .docx (or an .xlsx
  for a workbook) although nothing had been imported. The format badge was
  wrong, and "save back to the source" was offered where there was no source
  file to write to. Only documents and workbooks actually opened from a foreign
  file now carry an origin format; existing ones that never had a source file
  are corrected on upgrade. Document listings also report the origin format now,
  so a client no longer has to open each document to know whether it has one.

Security

• Real-time collaboration (documents, whiteboard), script run logs, imported fonts and images inserted
  from Drive or Photos no longer rely on the access-token cookie the web client used to keep readable by
  page scripts, nor put the access token in WebSocket URLs. Sockets and event streams present a
  one-minute (respectively stream) signed ticket; stored image and font addresses stay plain and are
  signed when they are loaded. Fonts imported from Drive now load as fonts instead of being injected as a
  stylesheet. Requires a Kubuno core that issues signed tickets (POST /api/v1/auth/tickets) and @kubuno/sdk with the signed-URL helpers.
• XML reader updated to a patched release. A crafted document could drive
  it into quadratic time or unbounded memory (RUSTSEC-2026-0194,
  RUSTSEC-2026-0195). Every document this module converts goes through it.
• The Data module no longer runs SQL written by whoever calls it. Two
  endpoints — the dataset SQL check, and widget execution — took text from the
  request body and executed it on the module's own database connection, which
  owns every office schema. Any signed-in account could therefore read or
  destroy every other account's documents, projects and collaboration state. No
  administrator role was needed. Instances running 0.1.7 are affected and
  should upgrade. Both endpoints now refuse, with an explanation; they will
  return once queries run under a role restricted to what the Data module may
  read, and a validator that parses a statement instead of asking the database
  to plan it.
• Database driver updated past an unfixable advisory. The previous line
  pulled in an RSA implementation vulnerable to a timing side-channel
  (RUSTSEC-2023-0071) for which no fix will ever exist. The new line does not
  depend on it at all, and it refuses any SQL string built at run time unless it
  has been audited — every query here was traced back to its source and
  rewritten so the compiler itself proves the statement is a fixed literal.
• Input validation library updated. The version in use carried
  RUSTSEC-2024-0421 through its domain-name parser, which accepted Punycode
  labels that decode to plain ASCII — a mismatch an attacker can use to make two
  different names look like one.

v0.1.7

Security

• HTTP/2 layer updated to a patched release. h2 moves from 0.4.15 to
  0.4.19, closing a denial of service through unbounded empty DATA frames
  (RUSTSEC-2026-0258).
• Error library updated to a patched release. anyhow moves from 1.0.102
  to 1.0.104, closing an unsoundness in Error::downcast_mut()
  (RUSTSEC-2026-0190).
• TLS library updated to a patched release. The pinned rustls carried
  RUSTSEC-2026-0285 (medium). Every outbound HTTPS connection goes through it.

v0.1.6

Fixed

• Office no longer calls the server from the sign-in screen. The host loads
  every module before anyone signs in, so Office asked for its document folders
  while there was no session — a request that could only be rejected. It now
  waits until someone is actually signed in.

Changed

• This module now installs as a Kubuno package (.kbpkg) only. Its system
  packages (Debian/RPM and the Windows and macOS installers) are no longer
  built: the module is distributed as one .kbpkg per platform (Linux, Windows,
  macOS) that the Kubuno server installs itself — from the admin console, or
  offline with kubuno modules:install <file>.kbpkg.

• Dates throughout Office now read in each viewer's own language. Every date
  shown in the editors — recent-file lists, backstage details, project
  timelines, calendars and resource views — is now written by the platform's
  built-in localization rather than a bundled date library, so day, month and
  weekday names come out correctly in every supported language. The date-fns
  dependency has been removed as a result.

• The app table in the README now shows each editor's real logo. The nine
  editors — Documents, Spreadsheets, Presentations, Projects, Diagrams, Data,
  Script, Maths and Whiteboard — are listed with the same artwork the
  applications menu and the browser tab use, instead of stand-in emoji. The
  images ship in-repo under .github/.

• The README now opens with the Office logo. The public README on
  GitHub now shows the Office crest (.github/logo.svg) at the top of the
  page — the repository landing now matches the icon a signed-in user sees
  inside the platform.

• New Documents logo. The sub-application now carries the designer's
  artwork instead of the previous drawing. It is loaded as an image rather than
  inlined in the bundle, so the bytes are fetched once and cached, and only by
  people who actually open the suite.

Added

• The open project view is now in the URL (Projects). Switching between
  Gantt, Table, Calendar, Network, Roadmap and the management views updates the
  address (?view=…), so a refresh (F5) or a shared link reopens the same view
  instead of falling back to the Gantt. The default Gantt view keeps a clean URL.

• The Network view is now a live workspace (Projects). The precedence
  diagram — one card per task, one arrow per dependency, the activity-on-node
  network of the PMBOK — is drawn on a pannable, zoomable canvas in the manner
  of the Flow editor: drag the background (or middle-click) to pan, Ctrl+wheel
  to zoom around the cursor, fit-to-screen and zoom controls in the corner.
  Cards can be moved by hand and keep their place (remembered per project, per
  user); Rearrange puts the automatic layered layout back. Links are handled
  in place: drag from a card's right-hand port onto another card to create a
  dependency (the network refuses a link that would close a loop and says so),
  hover a link to cut it, right-click it to change its type (FS/SS/FF/SF) or
  its lag. Links that are not plain finish-to-start carry a small label, the
  critical path is drawn in red, and each card shows its total float. Every
  change is undoable. Phases are shown as translucent frames around their
  tasks — nested phases as frames within frames — each headed by the phase's
  name and rolled-up progress; the automatic layout keeps every phase in its
  own block of rows so frames never interleave, and dragging a frame's header
  moves the whole phase at once. A magnet button in the zoom bar (and the
  right-click menu) turns snap-to-grid on or off while you arrange cards; the
  choice is remembered per project. A second button switches the diagram to a
  time scale (the time-scaled logic diagram of Primavera P6): a month ruler
  runs across the top, each card is placed at its start date and its width is
  proportional to its duration, so the schedule reads left-to-right while the
  dependency arrows and the critical path stay visible. In time-scale mode the
  cards are positioned by the schedule (they are not hand-moved); turn it off to
  return to the free workspace. The mode is remembered per project.

• The timeline band above the Gantt no longer draws items over each other
  (Projects). Phases that overlap in time — and milestones — are now stacked
  on separate lanes (the band grows to fit, up to six lanes) instead of being
  painted on top of one another. The band shows the top-level phases only,
  since a nested sub-phase always sits inside its parent and only cluttered the
  overview; milestones at any depth are still shown. Labels that do not fit
  their bar are shortened with an ellipsis rather than cut mid-letter, bars
  follow the same calendar span as the Gantt bars (weekends included), and the
  start/end dates have their own gutter so a phase that begins on day one never
  covers them.

• A leaner task table next to the Gantt (Projects). The grid now opens on
  the six columns every planner shows — number, task, duration, %, start, end —
  instead of eleven, so the chart gets the room. What was folded away is still
  in view where it matters: a task with an unusual priority carries a coloured
  dot next to its name (hover for the level), and its assignees appear as small
  avatars in the same cell. The remaining columns (mode, priority, variance,
  predecessors, resources) are one right-click on the header away; Variance
  only lights up while a baseline is being compared, since it is meaningless
  without one. A chevron on the divider (or the header menu) collapses the grid
  to a name-only list and back, the way timeline tools do. Existing projects
  pick up the leaner default once; column widths you had set are kept. Numeric
  and date cells (duration, %, start, end) are right-aligned, headers included,
  so the figures line up down the column.

• The task table of the Gantt view can be resized as a whole (Projects). A
  splitter now sits between the task table and the chart: drag it to give the
  table more or less room — the columns keep their own widths and scroll
  horizontally inside the table when it is narrower than they are (the header
  follows), exactly like a desktop planner. Double-click the splitter to make the
  table hug its columns again (the default). The chosen width is remembered per
  project with the column layout, and the chart always keeps a minimum of room.

• Text effects and typography (Documents). A new button in the Font group
  (next to the highlight colour) brings Word's "Text Effects and Typography"
  menu: a gallery of fifteen ready-made styles, plus Outline, Shadow (outer,
  inner and perspective), Reflection and Glow sub-menus, and the OpenType
  options (number styles, ligatures, stylistic sets). Effects are painted in
  the document itself and survive a round trip through .docx (Word's w14
  extensions). Picking a gallery style replaces any previous effect rather than
  piling on top of it, as in Word; the sub-menus adjust one aspect at a time.
  OpenType options are kept and exported but not yet visible on the page.

• Format Painter (Documents). The Clipboard group gains Word's brush: one
  click copies the formatting of the selection and applies it to the next
  selection; a double click keeps the brush armed until Escape or a second
  click. Alt+Ctrl+C and Alt+Ctrl+V do the same from the keyboard.

Changed

• Square corners on the macro editor window. The floating macro editor
  and its minimized bar now have square corners, matching the platform's flat
  floating-window look.

• Classic window-caption glyph on the macro editor's minimized bar. The
  restore button shows the overlapping-squares glyph instead of diagonal
  double arrows.

• New logos for every Office sub-module — Documents, Spreadsheets,
  Presentations, Projects, Diagrams, Data, Script, Maths and Whiteboard each
  get a coloured hexagon carrying their symbol and initial — used as the browser-tab
  icons and in the applications menu (all but Documents
  previously had generic line icons and no tab icon of their own). The Office
  home page shows these logos on its cards, and the Office logo in its header.

• All Office sub-module logos are now raster (PNG) artwork provided by
  the designer, replacing the vector versions; the Projects icon changes from
  a Kanban board to a document with a "P".

• Whiteboard is listed on the Office home page, which previously only
  showed eight of the nine tools.

• Sub-module names are no longer translated on the Office home page:
  Spreadsheets, Presentations, Projects and Diagrams keep their product names
  in every language, like the other modules.

• Coloured ribbon icons (Documents). The Insert tab and the Clipboard
  group now use coloured icons in the spirit of Word, instead of monochrome
  line icons.

• Larger ribbon buttons in every Office editor: the icon of a large button
  is now 32 px, making the main actions easier to spot.

Fixed

• A spurious console warning ("TextSelection endpoint not pointing into a
  node with inline content") no longer appears when a table is selected in
  Documents.

Fixed

• A withdrawn dependency is no longer used. A crate deep in the tree
  (spin 0.9.8, pulled in through the HTTP stack) was yanked by its authors.
  No vulnerability was announced, but a withdrawn crate has no business in a
  release; the lockfile now takes the version that replaced it.
• The package could not be built where zip is absent. The Windows job of
  the continuous integration has no zip, so the Windows package was simply lost
  the first time it was attempted — a script failure, not a build failure. The
  builder now falls back to 7-Zip, then to PowerShell.

Added

• This module now ships a .kbpkg — the single package format a Kubuno
  server installs by itself, the same file on Linux, Windows and...

v0.1.5

kubuno-office v0.1.5