What's Changed
- fix(mcp): support defer_until on task create/update tools by @chrisvel in #1395
- Fix area overview/detail count mismatch by @chrisvel in #1396
- Polish sidebar: consistent alignment, expandable People, unified active/hover styles by @chrisvel in #1398
- Add recurrence fields to MCP task create/update tools by @chrisvel in #1397
- build(deps): bump nanoid from 3.3.17 to 3.3.18 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #1399
- fix: set response_format.json_schema.strict to true for Anthropic compatibility by @chrisvel in #1400
- Fix MCP list_inbox to filter out deleted/trashed/processed items by @chrisvel in #1401
- fix(mcp): normalize date-only due_date to user timezone by @chrisvel in #1402
- chore: trim PR template checkboxes by @chrisvel in #1403
- fix(security): prevent SSRF in URL metadata fetching by @chrisvel in #1404
- fix(security): prevent stored XSS via SVG task attachments (GHSA-x24w-9w59-wqhq) by @chrisvel in #1405
- fix(security): enforce per-resource access control on uploads static route (GHSA-49fc-pf7x-cj8x) by @chrisvel in #1406
- fix(security): close IPv6-literal SSRF guard bypass (GHSA-h72v-w7gx-hq4h) by @chrisvel in #1407
- fix(security): harden session cookie secure-flag resolution (CodeQL #33) by @chrisvel in #1408
- fix(security): force download disposition on uploads, clean up attachments on task delete (GHSA-43p8-ch4p-gqg4) by @chrisvel in #1409
Full Changelog: v1.4.0...v1.4.1-rc.1