WebCalendar v1.9.17
Maintenance release focused on the install/upgrade wizard's PHP 8.1+ compatibility, plus a TinyMCE security update and several smaller fixes.
Security
- Update TinyMCE to 7.9.3 to address CVE-2026-47759 (XSS).
Fixed
- Prevent "Unexpected end of JSON input" during install/upgrade on PHP 8.1+; the wizard now returns proper JSON instead of an empty body on database errors (#642)
- Restore missing wizard methods so the admin-user and upgrade-SQL steps work again (
createAdminUser,getUpgradeSqlCommands) (#642) - Ship the TinyMCE table plugin referenced by the editor configuration
- Guard
count()against null in RSS feed generation on PHP 8 - Return MCP event times in the user's local timezone
- Repair MCP
add_eventand rate limiting, and isolate the MCP test suite - Handle mixed latin1/UTF-8 data in the charset conversion tool
Verifying this release
WebCalendar releases ship a signed manifest. See docs/release-signing.md for verification instructions.