ulsklyc/yuvomi v2.81.0

on GitHub

Added

• Birthday import offers "Select all" and "Deselect all". Select every contact
  with a birthday that has not already been imported, or clear the selection, with
  one button above the list. Large selections are imported in batches. If a later
  batch fails, the saved count remains visible in the warning and the list is
  refreshed; retrying reports the total across successful batches.
• yuvomi.cloud answers the four questions people ask most before they install. "Before you
  commit" now also says whether there is an app in the store (no, it installs from the browser and
  sends push reminders, with HTTPS), what works without signal (reading the last loaded calendar,
  tasks, shopping list, contacts and overview; changes need a connection), whether a CalDAV or
  Nextcloud server is still needed (only to keep editing in other apps; Yuvomi syncs with it but is
  no CalDAV server itself) and how Home Assistant fits in (ICS feeds, webhooks and the REST API with
  per-module tokens, no official integration). Each answer is held against the code by the landing
  page tests.

Fixed

• The currency and long time zones are no longer cut off in the appearance settings on a
  phone (#2166). A currency read like "AED - United Arab Emirates Dirham" and ended in "…" on
  a narrow screen, and so did five time zones such as "North Dakota/New Salem". The currency
  now shows its code and symbol ("GBP £"), a time zone its city ("New Salem"), and the hint
  below starts with the full name ("Currently British Pound."). The currency list in the loan
  dialog of the budget keeps the full names.
• A write request without a body gets the route's own answer instead of a server error (#2209).
  Since the move to Express 5, a POST, PUT or PATCH without a body left the request body empty
  and most routes - meals, tasks, shopping, notes, calendar, budget, reminders, pantry, contacts
  and more - answered 500. The server now treats a missing body as an empty one in one place, so
  each route says which field is missing (400). The MCP endpoint still answers a call without a
  body with a JSON-RPC parse error, and an Idempotency-Key stored before the update keeps
  matching its retry.
• Creating a recipe through the MCP bridge no longer ends in "Internal error" (#2197). When
  an assistant put the recipe fields next to operation_key instead of into payload,
  call_api_operation sent the request without a body and the recipe routes failed on it. The
  bridge now answers that the body belongs in payload, and a required body that is missing goes
  out as an empty object, so the route says which field is missing. The recipe routes themselves
  answer a request without a body, or with ingredients that are not a list, with 400 instead of
  500. Events, shopping items and tasks were not affected because they have MCP tools of their
  own; recipes are only reachable through the bridge.
• A new event appears at its time in the calendar right away. After adding an event, the
  agenda (and every other day list) showed it below all other events of that day until the next
  reload, whatever its start time. The same happened when an edit moved an event to another time
  of day. The event is now sorted into place as soon as it is saved.
• Assigning a synced iCloud event no longer turns its Apple Maps place into plain text. A
  place picked through Apple's location search is stored on several lines, and the single-line
  location field in Yuvomi dropped the line breaks. Saving the event, even only to assign a
  household member, therefore sent a changed location back to iCloud, and the iPhone showed the
  address as text without the map link. A location that differs only by line breaks now counts
  as unchanged, so the event stays as it is in iCloud; a location you really change is still
  sent.
• A single occurrence changed on the iPhone keeps the assignment of its series. Editing
  one occurrence of a recurring iCloud, CalDAV or Google event in another calendar app ("This
  event only") makes it a separate event in Yuvomi. That event only got the calendar's default
  person, so the household member assigned to the series in Yuvomi was missing on exactly that
  day. It now takes over the series' assignment when it first arrives (the default person still
  applies if the series has none), and an assignment you change on it later stays. A series split
  with "All future events" gets a new identity in Apple Calendar and is still treated as a new
  event.
• A planned snack now shows up on the wall and in Today. Since 2.79.0 a paired display
  receives every meal of the day, but the choice of which meal to show only looked at breakfast,
  lunch and dinner. A day whose only remaining plan was a snack showed no meal at all. The snack
  now takes part in that choice at its place in the day, between lunch and dinner (#2206).
• Wall mode on older browsers: the footer sits at the bottom again. Without dvh support
  (Chrome and Android WebView below 108) the wall was only as tall as its content, so "Updated",
  the kitchen timer and "Leave wall mode" floated mid-screen on a quiet day. The wall now takes
  its height from the app shell, which works in every browser; current browsers look the same
  (#2183).
• Browsers without color-mix() no longer lose buttons, selections and colors. On Chrome
  and WebView below 111 and Safari below 16.2, primary buttons (Save, Sign in, Pair) and the
  add button had no fill and their label disappeared, toasts and the search overlay were
  see-through, holidays showed white text on nothing, and the selected task, contact, document,
  filter or search result looked like the rest. These now get a plain color from the design
  tokens; note and shift colors show as a colored ring, and empty checklist boxes keep their
  edge. Tints elsewhere stay plain, as the browser table in the installation guide describes;
  current browsers are unchanged (#2184).

Security

• Updated three production dependencies for published advisories (#2192, #2193, #2194).
  body-parser 2.4.0 stops a compressed request body with trailing bytes from tying up the
  server (denial of service). nodemailer 10.1.4 fixes three cases in which its address parser
  read part of a quoted name or comment as an extra recipient. ip-address 10.7.4 no longer spends quadratic
  time on a long IPv6 zone identifier.