v2.65.1

Security

• Global search no longer surfaces other members' private calendar events
  (GHSA-gjpr-85rg-587c). The search box
  at the top of the app queries every module at once, and its calendar bucket applied only the
  module-access check: a member could type a word and get the title and date of another member's
  private appointment, or of an event from a subscribed calendar that was never shared - while the
  calendar's own search has filtered both since #474. The global search now applies the same two
  clauses as the calendar search, so the two return the same hits for the same word, which is what
  #471 intended. Found while reviewing #1055.

Changed

• Updated the production dependency nodemailer to 10 (#1048). It carries the password-reset
  and invitation mails; the SMTP settings are unchanged.

Fixed

• Leaving the dashboard now stops its clock, silent refresh, weather and wall timers (#976,
  #977). The router had no teardown contract for pages: the dashboard only cancelled its own
  timers at the start of its next render, never when you navigated away, so they kept ticking
  against a container that was no longer on screen and started dashboard requests behind whatever
  page you were on - the wall kitchen timer even chimed and re-rendered there. Every page render
  now receives an abort signal from the router that fires as soon as the route is replaced, and
  the dashboard binds all its timers and listeners to it. A render that is overtaken by another
  one (retry, the customize toggle, a weather refresh, a wall timer) now stops after its pending
  requests instead of rebuilding the surface a second time, so an older response can no longer
  overwrite a newer one. Third-party modules get the same signal in their render context.
• Birthdays no longer vanish from the calendar when you filter by person (#1054). The person
  filter and "Assigned to me" keep an entry only if a selected person is assigned to it, and a
  birthday belongs to a contact, not to a household member - so any person selection emptied the
  whole birthday layer. Birthdays now sit outside the person axes, the way holidays always have;
  the "Birthdays" toggle in the filter sheet remains the way to hide them. Ordinary events without
  an assignment still drop out under a person filter, which is intentional (#987).
• A Mealie or Tandoor address on a private or local network now says which switch to set
  (#1053). Since 2.64.1 the SSRF guard also checks an IP literal on the first hop (GHSA-9jh6), so a
  provider configured as http://192.168.x.x that used to slip past the guard now needs
  RECIPE_PROVIDER_ALLOW_PRIVATE_NETWORK=true - but the form answered "Could not connect to the
  recipe provider with these credentials", and the account card showed the bare resolver message.
  The form now refuses a local name or a private IP literal before any network call and names the
  switch, the way notification channels do; a hostname that resolves into a private network gets
  the same hint on the connection test, on the account card and after a failed sync. The 2.64.1
  notes below carry the same addendum, since that is where an upgrader looks first.