OpenTodoApp/OpenTodo v0.16.0

OpenTodo v0.16.0

on GitHub

OpenTodo 0.16.0 is a security release that finishes the internal audit: adding someone to a project or workspace by email now asks them first, unless you already share something with them, and the answer no longer reveals whether an address has an account. Background work now runs when it is due: reminders at their exact time, digests at the chosen hour, deliveries right away. Please read the upgrade note for API clients.

Upgrade notes

• One migration (0049_member_invitations: the table of membership invitations). No new variable. Back up first, as for every release.
• API clients that add people by email must handle 202. POST /api/v1/projects/{id}/members and POST /api/v1/workspaces/{id}/members with an email now answer 202 {"pending": true} when the person shares no project or workspace with you yet, and also for an address without an account, which used to answer 404 user_not_found. The person is not a member until they accept, so a script that shares a project and then expects the member list to include the person must wait for the acceptance (or add someone it already shares a project with, which still answers 201). Adding by account id inside a created workspace is unchanged. (Membership invitations)

Security

• Adding someone by email asks them first. The owner or an admin of any project could add any account on the server by its address, and the project appeared in that person's sidebar without their say; the answer also told whether the address had an account. Someone who already shares a project or workspace with you is still added at once. Anyone else gets an invitation in their notifications and in Settings → Account → Invitations (and by email when outgoing email is on) and becomes a member only by accepting it; an address without an account gets the same answer and the same "waiting for an answer" row, so the share dialog no longer tells which addresses have accounts. Declining keeps the same project from asking again for 14 days. Found in an internal audit. (Roles and assignments)

Changed

• Background jobs run when their work is due instead of on fixed timers. On a self-hosted server:

  • Web push reminders go out at their firing time instead of up to 30 seconds later.
  • Weekly digests go out at the chosen hour instead of up to 5 minutes later.
  • Calendar fetches, calendar sync, issue polls and webhook retries run at their scheduled time.
  • Queued webhook and notification channel deliveries are sent at once.
  • The audit log, the Trash, old read notifications and the delivery logs are cleaned when an item passes its retention, instead of hourly or daily.
  • An idle server no longer checks the delivery queues every second.

  Self-hosted servers and hosts now run the same job definitions. (Architecture)

• The share dialog and a workspace's members list show who has not answered yet. Invitations are listed under Waiting for an answer with their role, and can be cancelled. (Roles and assignments, Workspaces)

• The add-member routes answer 202 for invitations. See the upgrade note above. (API)

Install

• Docker: docker run -d -p 8080:8080 -v opentodo:/data ghcr.io/opentodoapp/opentodo:0.16.0
• Binary: download opentodo-<os>-<arch> below, then run it (data goes to ./data).
• Command-line client: ot-<os>-<arch>. Browser extension: opentodo-browser-extension-chrome.zip and opentodo-browser-extension-firefox.zip.

Verify downloads with sha256sum -c SHA256SUMS. Self-hosting guides: docs/self-hosting.