v0.3.1

Changelog

• 6397698 build: bump the npm group in /web with 2 updates (#39)
• cf1c5bc build: embed the v-prefixed tag and keep node on 24 LTS (#40)
• 472dab8 ci: bump the github-actions group with 2 updates (#38)

v0.3.0

Changelog

• e76d6ec feat(cli,tui): render times in the user's timezone (#34)
• 9c1fa63 feat: self-update command for dodo-cli and dodo-tui (#36)
• 5c072f0 fix: run the ofelia backup job as uid 100 (#33)

v0.2.0

Security hardening across the auth stack, plus cursor pagination for task and completion lists.

Features

• Paginate task lists in the web home and TUI with load-more (25/page) — unified timeline over open tasks, finished one-offs and recurring occurrences (#32) (e467535)
• Paginate the completions list to bound query size (#31) (0c3f206)

Fixes

• Harden auth, sessions, security headers and CI supply-chain — login rate-limiting + lockout, session invalidation on password change, CSP/X-Frame-Options/HSTS, WebSocket same-origin, constant-time CSRF, 1 MiB request-body caps, one-time API-token cookie, Telegram-token log redaction, SHA-pinned GitHub Actions, CSRF-protected logout (#30) (c04bfe2)

v0.1.2

What's new

• Security — password prompt. dodo admin user create and dodo admin user reset-password no longer take a --password flag; passing a password on the command line left it in shell history and exposed it in ps/argv. They now prompt for the password with no echo (and confirm it on create). For automation, pipe a single line to stdin:

  printf 'secret\n' | dodo admin user create --email you@example.com

• CI — Node 24 runtimes. Every GitHub Action was bumped to its Node 24 major (checkout, setup-node, upload-artifact, mise-action, docker/*, build-push, goreleaser), clearing the Node 20 deprecation warnings.

Full changelog: v0.1.1...v0.1.2

v0.1.1

What's new

• Branding — the project logo is now the browser favicon, the topbar brand (with the dodo wordmark next to it), the login header, and the README header.
• Footer — every page has a footer linking to the GitHub repository.
• CI — release builds prune old container versions on GHCR, keeping the most recent 5.

Full changelog: v0.1.0...v0.1.1

v0.1.0

A self-hosted todo & reminders service. One-off and recurring tasks (daily/weekly/monthly/yearly) with low/normal/high priorities that re-notify until done (2h/1h/20m), delivered via each user's own Telegram bot (with a Complete button) and desktop browser notifications. Multi-user, real-time, MIT-licensed, built to run inside a private Tailscale tailnet.

Highlights

• Three binaries — dodo (HTTP API + web UI + scheduler + Telegram pollers, plus admin and backup subcommands; ships in the container), dodo-cli (agent CLI, JSON output), dodo-tui (terminal UI).
• Web UI — server-rendered htmx + Alpine, real-time over websockets: list view with today/week/month + pending/completed/all filters, a month calendar, task create/edit/complete/snooze/delete, recurring tasks, profile, API tokens, Telegram setup, dark/light/system theme, English/Greek.
• Telegram — per-user bots, long polling (no webhooks), reminders with an inline Complete button that completes the task from chat.
• Browser notifications — opt-in desktop notifications for due tasks.
• Reminders — re-notify at the priority interval until completed; snooze to silence until later.
• Clients — agent CLI (JSON, --pretty) and a bubbletea TUI, both token-authed.
• Admin & ops — dodo admin for users/tokens (direct DB), dodo backup -dump for online SQLite backup.
• Security — argon2id passwords, session cookies + CSRF, bearer API tokens, AES-256-GCM encryption of Telegram tokens at rest, strict per-user data scoping.
• Deploy — multi-arch container on GHCR, Docker Compose for dev + a Tailscale (tsrp) production override.

Notable fixes since scaffolding

• Recurring tasks: completing one occurrence keeps the series open; the calendar, list and completed views show every occurrence.
• Telegram poller lifecycle (survives the config-time request context; long-poll timeout) and the /ws upgrade (ResponseWriter hijack) — real-time and Telegram now work end-to-end.

First release — 58 commits.