WebCalendar v1.9.29

Security maintenance release. Updates bundled and build dependencies to clear
known security advisories. No database changes.

Changed

• Updated the bundled TinyMCE editor from 7.9.3 to 8.10.2, clearing a
  high-severity XSS advisory (GHSA-mf2p-h6hf-fcwm / CVE-2026-116675) in the
  media plugin. The shipped file set is unchanged; only pub/tinymce/ contents
  were rebuilt, and the editor configuration is unchanged. (#818)
• Bumped symfony/filesystem to 7.4.23 to clear GHSA-6prc-h956-hxjq. This is a
  dev-only dependency (via php-cs-fixer) and is not shipped in releases. (#817)

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.