-
Commands/Core: local-time review windows, validation + recurrence hardening
-
Sync/Email: bound MIME nesting to prevent parse_mail stack overflow
-
Security: fix vCard BDAY panic, scrub legacy plaintext email passwords
-
clippy: clear workspace warnings
-
Remove Rhai plugin runtime; native CSV import (Security axis)
-
Frontend XSS: seal the unsafe attribute escaper (CHRONIC-XSS)
-
Resolve CHRONIC-E: surgical task/email list updates, email paging
-
Regenerate capabilities schema after dropping shell:allow-open
-
sync: BillingInterval::from_str renamed to from_wire in SyncKit SDK
-
sync: pass content hash to SyncKit blob_upload/blob_download
-
UX: map server field validation errors onto the offending input
-
UX/security: encode attacker-controlled values for HTML attributes, guard URL schemes
-
Performance: fix email-search date filter, guard db-watcher clock underflow
-
Storage remediation: atomic position + upsert, friendly timer-race error
-
email reader: detect any HTML tag for reader-mode strip, not a tag denylist
-
Security remediation: fix stored XSS in email labels, harden the URL opener
-
sync saved views, weekly + monthly reviews across devices
-
Data & Sync remediation: blob integrity, DST recurrence, HLC conflict ordering
-
Wire Saved Views frontend; humanize stray error sites
-
Performance: stop the self-write refetch storm, unblock the reactor
-
Stop one bad remote row wedging sync; fix parser edge cases
-
Close blob_hash path traversal and tighten email escaping
-
Fix restore data-loss (C1) and make backup completeness structural
-
perf(ui): stream task pages and lazy-load truncated email bodies
-
Add Bento build recipes (macos, ios, linux, windows)
-
Bump theme-common to 0.7.0
-
Disable text selection on interactive chrome
-
Expand privacy policy: cloud sync, email, keychain details
-
perf: selective sync invalidation, poison-safe sync lock, windowed threads, IMAP batching
-
fix(storage): blob GC, attachment write-order, atomic positive-only manual time