nia-todo v3.1.1

Fixed

• Restored protected user avatars in Android and Debian native clients by using the shared authentication headers for both JWT and persisted opaque sessions, including credentials for native cross-origin requests.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v3.1.1-full.deb
• Docker images:
  • ghcr.io/weedpump/nia-todo:3.1.1
  • docker.io/weedpump/nia-todo:3.1.1

Native client apps are bundled into the server package/image and served via /downloads/.

nia-todo v3.1.0

Changed

• Reworked the GitHub Actions build and release pipelines into separate test, package, and release workflows with independent native-client builds, tag-based releases, and Docker publishing to both GHCR and Docker Hub.
• Applied grouped Dependabot updates across Python, Rust/Tauri, Playwright, and GitHub Actions dependencies.
• Simplified development and packaging defaults around the single nia-todo instance and removed obsolete two-repository release and development-branding remnants.

Fixed

• Stopped logout from leaving REST and WebSocket background work active, preventing delayed synchronization from repopulating cleared local data or continuing authenticated requests after the session ends.
• Made project invitations consistent for usernames and verified email addresses: unknown users return an error, while pending invitations remain visible and revocable until accepted.
• Improved server .deb installation across supported Python versions by preferring Python 3.13 for bundled wheels and falling back to an online dependency install when wheel ABIs do not match.
• Fixed server package staging, checksum verification, restore ownership handling, and native Windows, Android, and Debian build dependencies in the release pipelines.
• Made package and frontend tests use the installed service environment and isolated test data, avoiding accidental access to real service data.
• Removed stale references to deleted release, migration, and BrainDump debug scripts from tooling and documentation.

Security

• Hardened login protection with persisted IP/account throttling, balanced lockout thresholds, durable failed-login audit records, scheduled cleanup, and HTTP-level regression coverage.
• Added global streamed request-body limits, bcrypt password byte limits, bounded user-controlled text fields, safer avatar decoding, and timeouts for external BrainDump audio processes.
• Protected avatar access, tightened account-enumeration responses, corrected secure-cookie and HSTS handling behind reverse proxies, and expanded browser isolation and PDF-preview CSP headers.
• Reduced deployment blast radius with root-owned application code, read-only and capability-restricted containers, scoped systemd filesystem access, and hardened Docker documentation matching the shipped defaults.
• Pinned all third-party GitHub Actions to immutable commits and wired the security regression checks into the normal backend and release gates.
• Removed the implicit OpenClaw credential-file fallback and documented that OIDC/SSO delegates login MFA to the configured identity provider.
• Removed inline script execution and the global Tauri bridge, and protected first-run setup with a one-time token available only from the service or container log.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v3.1.0-full.deb
• Docker images:
  • ghcr.io/weedpump/nia-todo:3.1.0
  • docker.io/weedpump/nia-todo:3.1.0

Native client apps are bundled into the server package/image and served via /downloads/.

nia-todo v3.0.2

Fixed

• Mobile browser, PWA, and Android native todo swipes now continue after pointer capture is lost on todo content, restoring left/right status changes from title, metadata, and description areas.
• Long unbroken todo descriptions now stay inside todo cards and the detail modal read/editor views, with card previews clamped instead of stretching the dashboard.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v3.0.2-full.deb
• Docker images:
  • ghcr.io/weedpump/nia-todo:3.0.2
  • docker.io/weedpump/nia-todo:3.0.2

Native client apps are bundled into the server package/image and served via /downloads/.

nia-todo v3.0.1

Fixed

• Native Windows and Debian todo card Status/Snooze dropdowns now open reliably by preserving placement state and suppressing the follow-up WebView summary click after the native pointer handler toggles the menu.
• Long todo titles now wrap within todo cards instead of overflowing past the viewport and blocking mobile quick actions.
• Todo title editing now uses an auto-growing multi-line field so long titles remain readable while creating, editing, and viewing todos.
• Mobile title editing now keeps Enter available for line breaks, while desktop users can still save with Ctrl+Enter or Cmd+Enter.
• Workspace menus now use the shared Lucide plus icon for the add-workspace action instead of a literal plus character.
• Mobile todo swipe gestures now use pointer capture, animation-frame updates, and stricter cancel cleanup to avoid stuck or jittery swipe states.
• Mobile todo swipes can now start from the checkbox/status control area while still respecting the left-edge navigation dead zone.
• Mobile sidebars now keep the header and footer fixed while only the navigation/project region scrolls, with clipped pills fixed without horizontal overflow.
• iOS/Safari now hides native WebKit scrollbars while keeping the app's custom overlay scrollbars visible, preventing duplicate scroll indicators in light and dark mode.
• Android native todo drag-and-drop now keeps a visible drag ghost attached to the finger while moving todos between projects or sections.
• Closing the mobile sidebar now immediately hides its custom scrollbar overlay instead of letting it float over the dashboard until the fade timeout.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v3.0.1-full.deb
• Docker images:
  • ghcr.io/weedpump/nia-todo:3.0.1
  • docker.io/weedpump/nia-todo:3.0.1

Native client apps are bundled into the server package/image and served via /downloads/.

nia-todo v3.0.0

Added

• Added checklist subtasks for todos, including progress chips, independent subtask updates, realtime sync, recurring-todo carry-over, and confirmation before completing a parent todo with open subtasks.
• Added todo comments with author display, edit/delete actions, shared-project permissions, comment-count chips, and realtime updates.
• Added todo attachments with authenticated server-local uploads/downloads, attachment-count chips, image/PDF preview, native download handling, shared-project access checks, realtime updates, and backup/restore coverage.
• Added admin controls for attachments, including global upload enablement, allowed file extensions, a default 5 GB quota, per-user quota overrides, and user-visible storage usage.
• Added a global Calendar sidebar view for due todos with day, week, and month modes, timeline-style day/week layouts, mobile month day selection, localized labels, offline/PWA coverage, and normal todo interactions from calendar entries.
• Added draft subtasks, comments, and attachments while creating new todos, with online-only handling when draft data needs a real server todo ID.
• Added full UI language support for 12 languages: German, English, Czech, French, Italian, Dutch, Polish, Brazilian Portuguese, Russian, Swedish, Spanish, and Simplified Chinese.
• Added localized app UI, system emails, release-tour content, native/OIDC handoff screens, offline/PWA language precache coverage, and locale-aware date/time formatting.
• Added a version-aware “What’s new” release tour with per-user seen state, carry-forward display across follow-up releases, responsive icon-based slides, and offline/PWA precache coverage.
• Added a native Debian desktop app package alongside Windows and Android, including release/download manifest integration, Debian platform download UI, autostart support, tray/global-hotkey settings, OIDC URL handler registration, desktop notifications, and WebKitGTK cache cleanup after app or executable changes.
• Added Debian desktop global-hotkey activation through the XDG Desktop Portal GlobalShortcuts API when available, with a legacy global-shortcut fallback for desktops without portal support.
• Added curated Lucide icon choices for projects and workspaces, with localized labels and searchable keywords.
• Added desktop/tablet drag-and-drop for moving todos directly onto sidebar projects while preserving offline sync behavior.
• Added auto-hiding overlay scrollbars for the main app and admin panel.

Changed

• Refreshed the app with the Next UI design system: calmer surfaces, rounded borderless cards, shared button/field/dropdown/menu primitives, unified light/dark polish, and more consistent responsive desktop/tablet/mobile layouts.
• Refined Todo, Project, Workspace, Settings, BrainDump, login, setup, admin, confirmation, danger, native OIDC return, app download, and update dialogs to use shared detail-modal and action primitives.
• Reworked the Todo detail experience into a larger editor shell with compact collapsible sections for content, planning, organization, subtasks, comments, attachments, recurring, and location-related details.
• Unified project and workspace editors with the Todo detail modal language, including large inline title fields, drawer-style sections, header actions, polished sharing rows, and hidden save actions until changes are present.
• Merged todo status selection into the left todo control, using a compact icon-only dropdown on mobile and a full status pill with label on desktop.
• Refined dashboard, project views, todo rows/cards, sidebar navigation, workspace switching, user menu, topbar search, section actions, version/download actions, and mobile swipe actions to match the Next UI visual language.
• Centralized icon rendering through the generated Lucide icon subset across the app, setup/password pages, and admin panel; the sidebar Focus entry is now labeled as Filter.
• Renamed the native desktop .deb target from Linux to Debian across manifest platform keys, artifact names, UI labels, release metadata, and downloads.
• Renamed the Debian desktop package/artifact to nia-todo-desktop / nia-todo-desktop-vX.Y.Z-debian-amd64.deb to avoid conflicts with the server package.
• Updated release packaging so Windows, Android, and Debian desktop clients are bundled consistently into the server .deb and Docker image downloads with versioned SHA256 manifest metadata.
• Switched packaged backups to snapshot runtime data under NIA_TODO_DATA_DIR alongside a consistent SQLite backup, covering database state, attachments, avatars, generated keys, and future runtime files while excluding backup archives and SQLite temp/journal files.
• Disabled touch pinch-zoom/two-finger page scaling and precision-touchpad pinch zoom for the web app while keeping normal browser zoom via keyboard/menu available.
• Replaced remaining legacy inline app event handlers with delegated data-* actions across todo cards, sections, settings, API keys, and drag-and-drop.

Fixed

• Kept cache-busted app-shell modules available offline by matching Service Worker cache entries without query strings.
• Cleaned up startup sync ownership so REST handles authoritative full refreshes while WebSocket startup stays focused on auth/session and realtime deltas, preventing duplicate full-cache writers from racing IndexedDB/UI state.
• Guarded authoritative REST refreshes while local offline queue sync is active or pending, preventing cache replacement from clobbering queued offline changes.
• Deferred server-side todo hard-deletes until the undo grace window expires, so undoing a delete preserves related todo data instead of recreating only the parent todo.
• Show pinned todos in project views in a dedicated top group, matching the main dashboard behavior.
• Improved German wording for parent project fields from “Eltern-Projekt” to “Übergeordnetes Projekt”.
• Improved mobile/touch behavior for todo quick actions, drag-and-drop, swipe gestures, FAB layering, and iPad-sized layouts.
• Fixed admin header/auth state handling, logged-out action guards, OIDC login button initialization, create-user field height, mobile action stacking, and admin CSS scoping.

Security

• Hardened attachment uploads with streaming temp-file writes, server-side quota/type policy enforcement, magic-byte validation for common binary formats, active-content blocking, and client-side preflight for disabled uploads, file type, file size, and quota.
• Hardened native attachment downloads with authenticated Tauri download handling, same-origin redirect protection, timeout handling, size guards, and platform download directories.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v3.0.0-full.deb
• Docker images:
  • ghcr.io/weedpump/nia-todo:3.0.0
  • docker.io/weedpump/nia-todo:3.0.0

Native client apps are bundled into the server package/image and served via /downloads/.

nia-todo v2.12.2

Added

• Added due-date sorting, todo duplication, and i18n-aware Quick Add syntax for recurring todos.

Changed

• Refined todo list layout with cleaner cards, better metadata placement, and section grouping in search results.
• Improved local/offline completion state handling for todos.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v2.12.2-full.deb
• Docker image: ghcr.io/weedpump/nia-todo:2.12.2

Windows and Android apps are bundled into the server package/image and served via /downloads/.

nia-todo v2.12.1

Changed

• Refreshed the public API documentation for the latest OIDC/SSO, location reminder, admin session/statistics, BrainDump learning, and profile preference endpoints.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v2.12.1-full.deb
• Docker image: ghcr.io/weedpump/nia-todo:2.12.1

Windows and Android apps are bundled into the server package/image and served via /downloads/.

nia-todo v2.12.0

Added

• Added OIDC-based single sign-on for users and admins, including admin-side provider configuration and account linking.

Changed

• Cleaned up the login screen for the new sign-in options: API docs and changelog links were removed, alternative login actions are grouped more clearly, the theme switcher is less prominent, app downloads stay visible, and the mobile fullscreen login is centered.
• Android todo drag auto-scroll now starts consistently near the visible top and bottom edges, including browser/iPad HTML5 drag and native pointer drag paths, so moving todos through long lists feels symmetric in both directions.

Fixed

• Android passkey login now rebinds its trusted origin immediately after changing the configured server URL, so switching servers no longer requires restarting the app before passkeys work again.
• Native offline cold starts now wait for the bundled app shell before showing backend/API connection errors, preventing a false boot error when the app is opened without network.
• Android/native todo dragging now cleans up stale drag-over and ghost state reliably after pointer/touch cancel paths, preventing stuck visual drop indicators.
• Android native todo dragging now blocks secondary finger input during an active drag, preventing multi-touch background swipes from stranding the dragged todo or hiding it until the app is restarted.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v2.12.0-full.deb
• Docker image: ghcr.io/weedpump/nia-todo:2.12.0

Windows and Android apps are bundled into the server package/image and served via /downloads/.

nia-todo v2.11.8

Fixed

• Restored the persisted global Today Focus button state after app reload/start so the active indicator matches the filtered view.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v2.11.8-full.deb
• Docker image: ghcr.io/weedpump/nia-todo:2.11.8

Windows and Android apps are bundled into the server package/image and served via /downloads/.

nia-todo v2.11.7

Fixed

• Focus date filtering now treats reminder-only todos as scheduled for their reminder day when no deadline is set, so Today Focus and Focus view filters include quick reminder-driven tasks without requiring artificial deadlines.

Distribution targets:

• Full Debian/Ubuntu server bundle: nia-todo-server-v2.11.7-full.deb
• Docker image: ghcr.io/weedpump/nia-todo:2.11.7

Windows and Android apps are bundled into the server package/image and served via /downloads/.