Calendula v0.4.2

Calendula v0.4.2

Fixed

• Priority filter in the unscheduled task list now applies immediately. It previously updated only after you also toggled the schedule filter. The same fix restores immediate list and search filtering in the matrix view.
• Calendar event titles now wrap to multiple lines instead of being cut off on a single line.

Changed

• Calendar event content is now stacked vertically — time and priority badge on top, title below, top-aligned — which removes wasted whitespace. The full title is available as a hover tooltip.

Calendula v0.4.1

Calendula v0.4.1

Fixed

• Task lists no longer go missing when your account has many To-Do lists. Outlook batch sub-requests are now chunked to MailboxConcurrency=4, the per-mailbox limit Microsoft Graph enforces for $batch. Previously a single oversized batch could have sub-requests silently rejected, so some lists failed to load.
• Calendula no longer gets stuck / throttled when Microsoft Graph rate-limits the account. A failed $batch sub-request is now treated as a recoverable load_error for that one list (the rest still load) instead of triggering a 429 retry spiral.

Security

• CORS configuration now rejects wildcard (*) and null origins. Only explicitly allow-listed origins are accepted.
• APP_AUTH_ENABLED now defaults to true in the deployment templates, so fresh deployments are password-protected out of the box.
• Redacted leftover Azure tenant/object GUIDs from the Azure-setup screenshot in the docs.

Added

• Buy Me a Coffee funding handle and GitHub FUNDING.yml sponsor button.

Calendula v0.4.0

Calendula v0.4.0

First public Open Source release. Repository mirrored to GitHub as a single-commit snapshot from the private source.

Added

• README hero banner, comparison table vs Morgen.so, three badges (License/Version/PWA), and a BuyMeACoffee placeholder.
• docs/azure-setup.md step-by-step Azure App Registration guide with screenshots.
• README ## Language section disclosing that the UI is currently German-only; English i18n tracked for a later release.
• Snapshot mirror script for publishing to GitHub.
• Security: Setup-endpoint token gating. POST /api/app-auth/setup now requires a setup_token field (generated at first container start or via CALENDULA_SETUP_TOKEN), closing the single-shot hijack window between container startup and the operator first browser tab.

Changed

• Security: APP_AUTH_ENABLED default flipped from false to true. Fresh deployments are protected by app-level password auth out of the box; first start redirects to /setup. Additive — existing deployments with the flag explicitly set are unaffected.