v1.66.1

Fixed

• Recurring events now honor the recurrence rule's timezone, generating DST-correct occurrences; a data migration re-anchors existing non-UTC series so their times no longer drift across daylight-saving boundaries.
• The dashboard RSVP list can now be filtered by multiple statuses at once.
• Telegram: banned users are blocked from interacting with the bot, and the bot's /unsubscribe now actually stops notifications instead of leaving per-type settings still delivering.
• Financial documents are no longer silently lost: payout statements and attendee invoices record when their email was sent, surface delivery errors in the admin, retry undelivered emails via a sweep, and mark documents with no possible recipient as terminally undeliverable instead of re-sending forever.
• A failure sending one referrer's payout statement or email no longer aborts the rest of the payout batch.

Security

• Bumped python-engineio and python-socketio to clear newly disclosed CVEs.

---

What's Changed

• docs(whats-new): list editions in sidebar nav like ADR by @biagiodistefano in #589
• docs: refresh docs/ against recent changes (1.53.0 → 1.66.0) by @biagiodistefano in #590
• refactor(controllers): hoist repeated endpoint permissions to class level (#595) by @biagiodistefano in #596
• docs: add AI_USAGE.md, AI Disclousre and update README by @biagiodistefano in #597
• fix(docs): correct per-event revenue endpoint path in 1.64.0 CHANGELOG (#592) by @biagiodistefano in #598
• fix(telegram): block banned users in bot & fix /unsubscribe no-op (#583, #584) by @biagiodistefano in #599
• fix(tooling): correct bootstrap-tests target and dedup seed blacklist entries (#591) by @biagiodistefano in #600
• fix(events): honor RecurrenceRule.timezone with DST-aware occurrences (#594) by @biagiodistefano in #601
• chore(cleanup): remove dead code & redundant user() overrides (#574) by @biagiodistefano in #603
• refactor(common): split god modules models.py and fields.py (#581) by @biagiodistefano in #604
• refactor(accounts): extract RevelUserAdmin display logic into formatters (#576) by @biagiodistefano in #605
• refactor(events): split events/tasks.py into a per-domain package (#575) by @biagiodistefano in #606
• refactor(tasks): package the accounts/events task modules + enforce explicit Celery task names (#607) by @biagiodistefano in #609
• refactor(events): split organization_service god module into a package (#578) by @biagiodistefano in #612
• fix(payouts): isolate statement/email failures from the payout batch (#611) by @biagiodistefano in #615
• fix(billing): track email delivery so financial documents aren't silently lost (#616) by @biagiodistefano in #617
• fix(billing): persist a terminal undeliverable state so no-recipient documents aren't re-swept forever (#618) by @biagiodistefano in #619
• refactor: eliminate cross-module private imports + enforce all/import hygiene (#613, #614) by @biagiodistefano in #620
• refactor(accounts): consolidate 8 email-send wrappers into one template-driven task (#608) by @biagiodistefano in #622
• fix(deps): bump python-engineio/socketio to clear new CVEs by @biagiodistefano in #624
• refactor(events): decompose the three longest event-service functions (#579) by @biagiodistefano in #625
• refactor(questionnaires): extract SubmissionService before questionnaire_service.py crosses the 1000-line gate (#621) by @biagiodistefano in #626
• fix(events): allow filtering dashboard RSVPs by multiple statuses (#627) by @biagiodistefano in #628
• refactor(questionnaires): split QuestionnaireController into per-resource mixins (#577) by @biagiodistefano in #629
• feat: PR-driven releases + /release command by @biagiodistefano in #630
• chore(release): v1.66.1 by @biagiodistefano in #631

Full Changelog: v1.66.0...v1.66.1