jody/pl_mail
1
0 Fork 0
mirror of https://github.com/karatektus/pl_mail.git synced 2026-10-25 01:54:10 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,347 Commits 7 Branches 154 Tags
5c7a76d6634beb14fcc8c7ec2923a17d583d2566
Commit Graph
22 Commits
Author SHA1 Message Date
Paul LütznerClaude Opus 5.5Sven JoderPhilippe Delodderjo2904DanversKaraFlouss
 		13303b247e v0.3.9 milestone (#283) 
* Run the end-to-end suite on pull requests into milestone and wip branches

A release's work is now collected on a milestone branch (milestone/v0.4.0)
before it reaches main, and the suite only ran on pull requests into main,
so nothing proposed for the milestone was tested. `milestone/**` joins
`main`, and `wip/**` comes along from wip/28, where it already runs the
suite on the phases of #28 — the same block on both, so they merge
without a conflict.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit d009ff72ad)

* linked-issue: read the description of a pull request into a milestone branch (#254)

GitHub links an issue from "Closes #N" only in a pull request into the
default branch. Into milestone/v0.3.8 or a wip/ branch the closing
references stay empty, so the check failed on every such pull request
however its description named the issue (#252 was the first). For a pull
request into another branch, the description is now read for the same
keywords GitHub accepts.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* The release pull request is the suite run behind a tag (#252)

Releasing asked for the E2E workflow to be started by hand on main before
a tag. Since main became protected, the Release vX.Y.Z pull request cannot
merge until that workflow is green on it, and its commit is what is tagged,
so a manual run only ran the same jobs twice. Releasing now says so, and to
update the branch if main moved after its checks ran, since the protection
does not ask for up-to-date branches.

The paragraph in CONTRIBUTING and the header of e2e.yml that said main is
not verified commit by commit describe main before it was protected; both
now describe it as it is.

Closes #251

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Calendar on a phone: a readable month, a toolbar and top bar that fit, a live now line (#256)

The month chip is its title first, on up to two lines, then its time range
and place; a narrower day drops the end and the place for a third line of
title, long words are hyphenated, and an unanswered invitation has a
dashed bar. Below 39rem, where a day is bars, the grid shrinks and the
chosen day is listed in full under it: today at first, any tapped day
after, with a + for that day that the toolbar's + follows too. On a wider
touch screen the first tap opens a day's card and the second its entry
(calendar--month-tap, and a day-open: variant that the hover and the tap
share).

The calendar toolbar fits below 37rem with icons, a short date label and
smaller buttons, and under 22rem today's date in a box for Today. English
writes a same-month week as "Oct 20-26" (range_short_month). The top bar
tightens below 640px and moves Sync now, What's new and Send feedback into
the user menu. Dialogs are the whole screen below 768px, as compose is.

calendar--now moves the now line every minute on the view's clock and
redraws a view that shows the old day or the new one when the date
changes, which also moves the month's circle on today.

And a + on a day that has gone opened the editor on today:
DefaultEventStart::onDay pulled any past day to the next hour. A past day
now keeps its date.

Closes #253

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Close an issue when its pull request is merged into a milestone branch (#260)

GitHub acts on "Closes #N" only for merges into the default branch, so
issues fixed on a milestone branch stayed open until the release reached
main. A workflow on merged pull requests into milestone/** now closes the
issues the description names, with a comment linking the pull request.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Preview the reply, not the quote, and send replies with their quote visible (#258)

The list preview flattened the whole body and skipped short blocks to find
the first long one, so a one-line reply previewed as its attribution line or
the quoted mail. The quoted history (same seam as the reading view's "···")
and a "-- " signature are cut off first now, in HTML and plain text, and the
chrome skip only applies to bulk mail. The JMAP preview uses the same code.

The composer folded the quote with an inline display: none and its clean-up
removed only the toggle, so replies went out with an invisible quote. The
fold is removed in the editor and again on the server, and the reading view
reveals a folded quote in mail already received.

Closes #257

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Move a thread's unread count when JMAP marks a message read or unread (#267)

EmailPatchApplier wrote seenAt for $seen and left MessageThread::$unreadCount alone, so the web list (which draws bold from that counter) disagreed with the phone app. $seen now goes through ThreadStatusUpdater::markRead(), the web UI's own path, and markRead() counts the whole thread rather than the messages passed in.

Closes #266

Co-authored-by: Philippe Delodder <7259755+phdelodder@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Leave a message that is already in the destination folder where it is (#270)

Trashing a conversation with a message already in the bin queued that message as a move from Trash into Trash. webklex's move() then left the connection in EXAMINE and the server refused it ("NO Not permitted in EXAMINE state"), and the row had already lost its UID. ApplyImapFlagsHandler no longer sends a move into the folder a message is in (and gives the row its UID back), and ThreadStatusUpdater's trash(), archive() and restore() leave such messages out of the move.

Closes #269

Co-authored-by: Philippe Delodder <7259755+phdelodder@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Hide a conversation from the lists only when all of it is in the bin (#272)

A thread's labels are the union of its messages', so one deleted message put Trash on the thread and took the whole conversation out of the Inbox, its tab, label lists, All Mail, Unread, the badges and search, along with any reply threaded into it afterwards. The bin rule is now "carries Trash and has no message outside it", written once (binnedThreads()) for every list and badge and spelled out the same way in the search SQL. Option (b) of the issue.

Closes #268

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Let a long message scroll in the expanded compose window (#273)

expandedValueChanged() used closest('div') to reach the editor's wrapper, but closest() starts at the element itself and the editor is a div, so the wrapper never became a flex container and the editor stayed 170px tall, clipped by [contain:paint]. The wrapper is now the flex column and the editor grows (1 0 auto) to fill the window or its content; the plain-text field fills the expanded window too.

Closes #262

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Write each changelog entry as a file of its own, collected at release (#275)

Every pull request added its paragraph under ## Unreleased in CHANGELOG.md at the same place, so the second of any two conflicted with the first once it merged, and each conflict fix re-ran the whole E2E suite. A pull request now adds changelog.d/<issue>-<words>.md; bin/changelog-release.sh, run in the Release vX.Y.Z pull request, collects the fragments (highlights first) and anything still under ## Unreleased into the release's section and deletes them. CHANGELOG.md stays the one file What's new, bin/release-notes.sh and GitHub read.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Say which step failed when notifications can't be turned on (#278)

Every failure in the enable path (registering the service worker, the
browser's push subscription, the server's answer) ended in the same
"Something went wrong" and the exception was dropped, so a report from a
Pixel 8 could not say which. The pane now names the step and the
DOMException name or HTTP status, and logs the exception to the console.

Closes #277

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Contacts: one address book, with Google, Outlook, Nextcloud and CardDAV contacts in it (#282)

A contacts page and pane for plMail's own contacts and the ones on a server:
Google and Outlook on the mail account's own sign-in, Nextcloud through the
Nextcloud connection, any CardDAV server through Settings -> Contacts. Every
field a phone keeps, the photo included, syncs both ways. Duplicates merge
with 90 days to undo; vCard and CSV import and export; contacts suggested
while composing; JMAP Contact/get, /query and /set. Nextcloud calendars come
with the Nextcloud connection too.

Replaces #237 and #109 by @jo2904 and #244 by @DanversKara.

Closes #157
Closes #236

Co-authored-by: jo2904 <jo2904@users.noreply.github.com>
Co-authored-by: DanversKara <DanversKara@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Install APCu and Xdebug with PIE instead of from PECL (#286)

PECL is deprecated in favour of PIE and was down for most of an evening on 2026-10-21, failing every image build. PIE 1.5.2 now installs APCu (and Xdebug in the dev image) from the extensions' own releases; it is mounted for that one step and not left in the image. Nothing changes at runtime.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Keep contact photos where the web container can serve them (#287)

Contact photos were stored in var/contacts, outside the volumes the web and worker containers share, so synced photos answered 404. They now live under APP_STORAGE_DIR/uploads/contacts; a migration clears the lost paths and has synced books read again so the photos come back.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Match a contact's email addresses in any case (#288)

Addresses are stored lower-cased but were matched as the provider spelled them, so a pull removed and re-inserted the same address and broke the unique key (prod sync failure). They are now matched in their stored form.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Open a contact's reference email in the mail pane (#294)

A click on one of a contact's reference emails in the docked contacts
pane was a Turbo visit inside the contacts frame, which blanked the mail
pane. The click is now offered to the mail pane as a mail-pane:open
event; the pane opens the message beside the contact. Without a mail
pane (the full contacts page) it stays an ordinary visit.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Open mail beside the full Contacts page without a reload (#297)

The full Contacts page was a page of its own, so a reference email
clicked there was a visit: the contact was gone, and on a notebook the
mailbox came back on the calendar it remembered.

The full page is now the mailbox with data-contacts-full on the shell:
the mail column put away and the contacts dock given the row, with the
page's own content in the dock's frame. Opening a message from it loads
the message into the existing mail pane, then contacts--pane#reveal
drops the state in a view transition: the mail slides in from the left
and the dock narrows to its width, the same DOM throughout. On a
notebook the calendar gives way; on a wide screen it stays.

The reference links lose data-turbo-frame="_top", which made ui--split
stash a calendar position for a visit that never came.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Preview image and video attachments on click, like PDFs (#295) (#298)

Clicking an image or video attachment chip opens a viewer in the modal
instead of downloading. Previewable chips (PDF included) get a download
half on the right. Images load from the existing attachment route; videos
from a new /mail/attachment/{id}/video route that serves a fixed video
type inline under the sandbox CSP and answers Range requests.

Closes #295

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Erase a message's parts with it, and delete mail one way (#300)

MessageEraser loaded a message's parts to delete their files, then removed
only the message. After the delete Doctrine forgot the message but kept the
parts managed, so the next flush in the same unit of work failed with "a new
entity was found through the relationship MessagePart#message". Every sync
that removed server-deleted mail with an attachment failed that way.

The eraser now removes the parts, removes a thread it empties (announced to
JMAP as destroyed), and logs file-delete failures instead of keeping the row.
MessagePurger hands its local delete to the eraser, so "delete forever" gains
the thread-label re-sync it lacked. ImapAccountSyncer clears an entity manager
a failed folder left open, so one folder's refused flush no longer fails the
rest.

Closes #299

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Rework the contact editor: quick add, paste details and Improve with AI (#305) (#306)

New contacts start in quick add: paste a name, signature, address line or
vCard and the details it finds are listed, each with a one-click type. The
editor shows the name as one field whose parts fill themselves (titles and
degrees included), rows that appear as you type, Paste details for existing
contacts and a Save to picker. Contact help is a new AI feature, off by
default, that rereads pasted text and suggests updates from the signature
of a contact's newest mail. Phones are read with libphonenumber.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Keep spam off the radar and out of search; add a Not spam button (#308)

Cards read out of mail in Spam are left off the Happening Soon panel and
the mailbox strip (read-time filter, so moving the mail out brings them
back), and a spam conversation no longer shows its cards above the
message. The bin keeps its cards. Search and the type-ahead leave Spam
out unless asked with in:spam, as they already did for the bin. A spam
conversation's toolbar gets a Not spam button that moves it to the inbox.

Closes #304

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Add to contacts asks new or existing; contacts button gets the calendar's three positions (#312)

Closes #309
Closes #311

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Show the pictures a review request hid, dropped or never asked for (#274)

* Show the pictures a review request hid, dropped or never asked for

A BAUHAUS review request, sent through Bazaarvoice, showed neither its
logo nor its product photos, with images allowed. The image proxy was
fine; three steps around it were not.

- The logo is linked as http://. The sanitizer keeps http sources and
  leaves them to render time, the fetcher only connects over TLS, and
  nothing in between upgraded the URL, so every http image became the
  placeholder. RemoteContentBlocker now signs the https:// form. The
  fetcher's own rules also say in the log which one refused a target;
  until now that refusal was the one silent path.
- The first product card sits inside a <form>, and dropElement('form')
  took the photo, the name and the star links with it. The form is
  unwrapped now; textarea and select still go with their content.
- Each card is class="d" style="display:none", switched on with
  .d {display:block !important}. CssToInlineStyles keeps an inline
  property whatever the rule says, so the card stayed hidden next to its
  Outlook twin. Html5CssInliner now lets a stylesheet !important beat a
  plain inline style, and matches selectors against forms as the divs
  the reader will see, so `form .a` rules take the sender's fallback
  for clients without forms.

  app:backfill safe-html-hidden-cards

re-sanitizes stored mail with a form or a stylesheet !important. One
task for both, because neither fix brings the card back alone.

Closes #271

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Mark the German mail page as translated from the current English one

Both pages gained the same two paragraphs in the previous commit, but
the translated-from hash still named the English page before them, so
DocumentationCoverageTest reported the translation as stale.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Credit the image proxy entry and keep it as a changelog fragment

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Paul Lützner <karatektus@gmail.com>

* Swipe a mail row, choose what each swipe does, and long-press for its actions on a phone (#314)

On a phone, below md and by touch only: a row swipes right for read/unread and left for archive, each direction set under Settings → Mail → Swipe actions (read/unread, archive, star, nothing; never trash), and holding a row opens an action sheet with every action its strip offers. Mouse, trackpad and wider windows are unchanged.

Takes over #117, #118 and #119, whose fork was archived. Also gives the Contacts settings' two cards their gap.

Co-authored-by: Flouss <15911342+Flouss@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Admin → Integrations lists the calendar services, so a pinned CalDAV address can be changed later (#279)

CalDAV and Calendar feed get their own group below the file services, with the shared provider row and Configure form; Nextcloud stays with the file services. Calendar services are offered to everyone, so their rows say so and the form has no switch. The server address accepts only http or https, up to 512 characters.

Once people have connected, the CalDAV form says how many connections a changed or cleared pin reaches. A calendar feed offers its address only while one is stored, so it can be cleared.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Offer an address book another connection already mirrors locked, not as new (#319)

Two connections to the same server, a Nextcloud one and a CardDAV one made by hand, reach the same address book under the same remote id. Settings → Contacts now offers such a book locked, saying which connection has it, and refuses a posted tick, as it does for calendars. Otherwise every contact in it showed twice.

Closes #317

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Gmailify: the IMAP folder places a sibling's mail, Gmail deletions detach, and a switch to turn it off (#204)

Closes #203
Closes #205

- A sibling's IMAP copy keeps the placement its folder gives it; Gmail's INBOX/SENT/DRAFT/TRASH/SPAM no longer move it (by @phdelodder).
- Gmail deleting its copy detaches the sibling's IMAP copy instead of erasing it.
- app:backfill gmailify-placement repairs copies the old merge had moved.
- Settings → Aliases: a Gmailify switch per Gmail account. Off detaches carried copies in a background job and declines mail Gmail still collects for another account (Bcc'd mail excepted, as documented).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Gmail sync: look up only the listed ids, not every stored one (#321)

Part of #223: newGmailIds() asks only about the ids Gmail just listed, and nothing when none were.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Store whether a conversation is in the bin, kept by triggers (#322)

Part of #223: message_thread.binned holds #268's rule, kept by triggers on message_label, thread_label and message; lists, badges and search read the column. Identical results on 41 compared queries, most 5-100x faster on a 67k-thread mailbox.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* Account sync: wait out a provider that can't be reached, quietly (#333)

When the worker couldn't connect to the Gmail or Graph API at all, the
account sync went up Messenger's retry ladder: a WARNING with three nested
stack traces per attempt, then CRITICAL and a parked job if the outage
lasted. That job resumes from a cursor and is asked for again every
quarter hour, so nothing was ever lost.

WaitOutConnectionFailures now puts a SyncAccountMessage that failed only
with an HttpClient TransportException back on its own queue, on the
ingest ladder's delays, with one info line per attempt. After five waits
it is dropped with a single warning. Message batches and every other
failure keep the normal path.

Closes #332

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Sven Joder <sj@pmdevelopment.de>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Philippe Delodder <7259755+phdelodder@users.noreply.github.com>
Co-authored-by: jo2904 <jo2904@users.noreply.github.com>
Co-authored-by: DanversKara <DanversKara@users.noreply.github.com>
Co-authored-by: Flouss <15911342+Flouss@users.noreply.github.com>
 2026-10-23 11:18:21 +02:00
dependabot[bot] 62868809f6 Bump the minor-and-patch group with 13 updates (#193) 
Bumps the minor-and-patch group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [doctrine/orm](https://github.com/doctrine/orm) | `3.7.4` | `3.7.5` |
| [symfony/asset-mapper](https://github.com/symfony/asset-mapper) | `8.1.8` | `8.1.9` |
| [symfony/console](https://github.com/symfony/console) | `8.1.8` | `8.1.9` |
| [symfony/framework-bundle](https://github.com/symfony/framework-bundle) | `8.1.8` | `8.1.9` |
| [symfony/http-client](https://github.com/symfony/http-client) | `8.1.8` | `8.1.9` |
| [symfony/mercure-bundle](https://github.com/symfony/mercure-bundle) | `0.5.0` | `0.6.1` |
| [symfony/process](https://github.com/symfony/process) | `8.1.7` | `8.1.9` |
| [symfony/stimulus-bundle](https://github.com/symfony/stimulus-bundle) | `3.5.1` | `3.6.0` |
| [symfony/string](https://github.com/symfony/string) | `8.1.7` | `8.1.9` |
| [symfony/twig-bundle](https://github.com/symfony/twig-bundle) | `8.1.7` | `8.1.9` |
| [symfony/ux-autocomplete](https://github.com/symfony/ux-autocomplete) | `3.5.1` | `3.6.0` |
| [symfony/ux-turbo](https://github.com/symfony/ux-turbo) | `3.5.1` | `3.6.0` |
| [symfony/web-profiler-bundle](https://github.com/symfony/web-profiler-bundle) | `8.1.8` | `8.1.9` |


Updates `doctrine/orm` from 3.7.4 to 3.7.5
- [Release notes](https://github.com/doctrine/orm/releases)
- [Commits](https://github.com/doctrine/orm/compare/3.7.4...3.7.5)

Updates `symfony/asset-mapper` from 8.1.8 to 8.1.9
- [Release notes](https://github.com/symfony/asset-mapper/releases)
- [Changelog](https://github.com/symfony/asset-mapper/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/asset-mapper/compare/v8.1.8...v8.1.9)

Updates `symfony/console` from 8.1.8 to 8.1.9
- [Release notes](https://github.com/symfony/console/releases)
- [Changelog](https://github.com/symfony/console/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/console/compare/v8.1.8...v8.1.9)

Updates `symfony/framework-bundle` from 8.1.8 to 8.1.9
- [Release notes](https://github.com/symfony/framework-bundle/releases)
- [Changelog](https://github.com/symfony/framework-bundle/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/framework-bundle/compare/v8.1.8...v8.1.9)

Updates `symfony/http-client` from 8.1.8 to 8.1.9
- [Release notes](https://github.com/symfony/http-client/releases)
- [Changelog](https://github.com/symfony/http-client/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/http-client/compare/v8.1.8...v8.1.9)

Updates `symfony/mercure-bundle` from 0.5.0 to 0.6.1
- [Release notes](https://github.com/symfony/mercure-bundle/releases)
- [Changelog](https://github.com/symfony/mercure-bundle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/symfony/mercure-bundle/compare/v0.5.0...v0.6.1)

Updates `symfony/process` from 8.1.7 to 8.1.9
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/process/compare/v8.1.7...v8.1.9)

Updates `symfony/stimulus-bundle` from 3.5.1 to 3.6.0
- [Release notes](https://github.com/symfony/stimulus-bundle/releases)
- [Changelog](https://github.com/symfony/stimulus-bundle/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/symfony/stimulus-bundle/compare/v3.5.1...v3.6.0)

Updates `symfony/string` from 8.1.7 to 8.1.9
- [Release notes](https://github.com/symfony/string/releases)
- [Changelog](https://github.com/symfony/string/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/string/compare/v8.1.7...v8.1.9)

Updates `symfony/twig-bundle` from 8.1.7 to 8.1.9
- [Release notes](https://github.com/symfony/twig-bundle/releases)
- [Changelog](https://github.com/symfony/twig-bundle/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/twig-bundle/compare/v8.1.7...v8.1.9)

Updates `symfony/ux-autocomplete` from 3.5.1 to 3.6.0
- [Release notes](https://github.com/symfony/ux-autocomplete/releases)
- [Changelog](https://github.com/symfony/ux-autocomplete/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/symfony/ux-autocomplete/compare/v3.5.1...v3.6.0)

Updates `symfony/ux-turbo` from 3.5.1 to 3.6.0
- [Release notes](https://github.com/symfony/ux-turbo/releases)
- [Changelog](https://github.com/symfony/ux-turbo/blob/3.x/CHANGELOG.md)
- [Commits](https://github.com/symfony/ux-turbo/compare/v3.5.1...v3.6.0)

Updates `symfony/web-profiler-bundle` from 8.1.8 to 8.1.9
- [Release notes](https://github.com/symfony/web-profiler-bundle/releases)
- [Changelog](https://github.com/symfony/web-profiler-bundle/blob/8.2/CHANGELOG.md)
- [Commits](https://github.com/symfony/web-profiler-bundle/compare/v8.1.8...v8.1.9)

---
updated-dependencies:
- dependency-name: doctrine/orm
  dependency-version: 3.7.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/asset-mapper
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/console
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/framework-bundle
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/http-client
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/mercure-bundle
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: symfony/process
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/stimulus-bundle
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: symfony/string
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/twig-bundle
  dependency-version: 8.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: symfony/ux-autocomplete
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: symfony/ux-turbo
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: symfony/web-profiler-bundle
  dependency-version: 8.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-17 11:00:29 +02:00
Paul LütznerandClaude Opus 5 24a5ab3de1 build: mercure 0.8, and a database of PHPUnit's own 
MERCURE 0.5.0 / symfony/mercure 0.8.0, kept out of the earlier sweep
because it carries the live-update transport and should not ride along
with eighteen patch bumps. It earned that: HubInterface gained
getProtocolVersion() and getCookieName(), so the two hub doubles in
CalendarSyncFinishedNotificationTest stopped satisfying it — a fatal
error, not a failing test. Both implement them now, returning what a real
hub would rather than pretending to configuration these tests do not
have. Verified where it matters: the full browser suite, including the
specs that stop and restart the hub to prove the stream recovers.

A DATABASE OF ITS OWN for the unit suite.

Both suites run APP_ENV=test, and doctrine.yaml's
`dbname_suffix: '_test%env(default::TEST_TOKEN)%'` therefore pointed both
at app_test. One database, two suites — and one test in here truncates
real tables, because exercising a data reset is its whole purpose.

Sequentially that is safe; Postgres rolls a TRUNCATE back like anything
else. Concurrently it is not: TRUNCATE takes an ACCESS EXCLUSIVE lock, so
live queries from the browser suite block until the unit test's
transaction ends, and specs with no connection to any of this report
timeouts. It fits the transaction abort seen here once and never
reproduced.

TEST_TOKEN is Symfony's own mechanism for exactly this, so the fix uses
it rather than inventing a second DATABASE_URL. bin/test-unit.sh sets it
and does the create/migrate/seed a fresh database needs.

The seeding is the part worth guarding: PageRendersTest, ListFragmentTest
and others SKIP THEMSELVES when the admin user is missing, so without it a
green run would quietly be ~50 tests smaller than it looks — a worse
failure than a red one. Checked rather than assumed: 4047 tests either
way, no skipped or incomplete markers.

The assertion count moved, 11540 → 11526, and settled there across runs.
That is the point of the change showing up: the unit suite was reading
rows the browser stack had left behind, and now it reads only its own.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-24 15:08:17 +02:00
Paul LütznerandClaude Opus 5 fbdc61b5bd build(deps): Symfony 8.1.5, tailwind-bundle 1.0, TypeScript 7 — and Playwright held at 1.61 
Five of the six open Dependabot PRs, taken locally in one pass rather
than merged one at a time: each rebase triggers the expensive workflow
and they all touch the same two lock files. The sixth, the actions group,
was merged as it was — its own CI was green, and it clears the Node 20
deprecation the runner has been printing.

  symfony/*                     8.1.0/8.1.1 → 8.1.5   (18 packages)
  symfonycasts/tailwind-bundle  0.14.0      → 1.0.0
  @types/node                   22          → 26.2.0
  typescript                    5.6         → 7.0.2

PLAYWRIGHT IS PINNED AT ~1.61.1, deliberately, and this is the only part
worth arguing about.

1.62 failed eight cases in appearance/list-display.spec.ts, every one of
them asserting that a clip-path'd element is visible. Tailwind was the
obvious suspect and is innocent: the compiled clip-path and spacing rules
are byte-identical between the two builds. Reverting Playwright alone
took it from eight failures to none.

Then the question that actually matters — whether 1.62 is RIGHT, because
"element is hidden" could mean a real UI bug. It is not. The account
corner measures 10×10 at (957, 336), display block, visibility visible,
opacity 1, an opaque background, and a parent that does not clip. It is
on screen and painted. 1.62 changed what it counts as visible for
clipped elements and is wrong about this one.

`~1.61.1` rather than `^`: a caret would walk straight back into 1.62 on
the next clean install.

TypeScript 7 earned its place. It found a genuine error — el.click() on
`HTMLElement | SVGElement`, in a test written this morning, since TS7's
lib.dom no longer puts click() on SVGElement — plus nine implicit-anys
that TS5 had also been reporting into a void, because CI does not run
typecheck. All eleven fixed: `npm run typecheck` is clean for the first
time. A typecheck that is permanently red is one nobody runs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-24 13:52:34 +02:00
Paul LütznerandClaude Opus 5 972a8a9d3f Give plMail a landing page, built from the repository it describes 
A wiki is where somebody already inside GitHub looks. It has no way to be
the thing a link to plMail shows a person who has never seen it, so there
is now a site as well: a landing page and the whole handbook, at
karatektus.github.io/pl_mail, deployed by .github/workflows/pages.yml on
every push to main.

It holds no content. The landing page IS README.md and the handbook IS
docs/, rendered into a shell by bin/build-site.php — nothing on the site
can say something the repository does not, because there is nowhere for
it to be written down. Even the hero is lifted rather than written: its
lead is README's own opening paragraph, because a hero composed here
would be the one piece of prose no file backs and the first thing to go
stale. The wiki mirror stays; two outputs of one source cannot disagree
with each other.

The tree is preserved rather than flattened, unlike the wiki mirror,
which had to flatten because a wiki has one namespace. So a cross-link
between two pages needs only its extension changed and an image reference
needs nothing, and the rewriting that remains is the small honest kind: a
path that escapes docs/ becomes a link into GitHub, because the site
carries the handbook and not the source.

**The theme picker is generated from the app's own enum.** Theme::swatch()
already carries surface, ink and accent per theme for the appearance
picker, and the rest of a palette is derived from those at build time —
so the site offers exactly the seven plMail offers, and adding an eighth
to the app adds it here. Transcribing them would have agreed until
somebody added one, and then the site would quietly offer six of seven.

The language picker lists a locale as available when docs/<locale>/
exists and as "not translated yet" when it does not, which makes
translating the handbook the act of creating that directory and nothing
else. Today that means English, with German and Pirate shown and
disabled — a switcher that silently omitted them would say the site has
no opinion about German, where this says where the gap is.

Search is the whole handbook as 140KB of JSON, fetched on first focus and
matched in the browser. A hosted index would be faster to write and would
stop the site being a directory of files that works from a checkout, from
a fork's Pages, and behind whatever proxy somebody puts it behind.

league/commonmark is a require-dev dependency: the site is built in CI and
never by the application, so a Markdown parser in the runtime image would
be a package nothing runs. Bumped guzzlehttp/guzzle to 7.15.2 while
composer was open — 7.15.1 carries two advisories, one of which is a
noncanonical host bypassing host-based checks, which is the shape of the
SSRF guard.

Also corrects this file's claim that the non-Docker Playwright variants
start `symfony serve`. They have not since that server was replaced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-05 21:54:19 +02:00
Paul LütznerandClaude Opus 5 d3fb1692b3 Add the calendar data layer: JSCalendar events with materialised occurrences 
Storage is JSCalendar (RFC 8984) in jsonb, with everything a query touches
projected into real columns. Both halves earn their place. JSCalendar is
canonical because everything this will ever talk to speaks it or converts
cleanly — iCalendar both ways, CalDAV, JMAP calendars when that draft
lands — and a bespoke schema gets re-derived badly the first time an .ics
round-trips, silently dropping participants, alerts and overrides. But
Postgres cannot do range logic on "PT1H", so the columns exist too.

Recurrence is the part that is easy to get almost right, and there are
only three options. Expanding RRULEs at query time means loading every
recurring event ever created to answer "what is in July" — a standup from
2019 still generates instances — and nothing is indexable. Materialising
everything does not terminate for FREQ=DAILY with no UNTIL. So:
materialise to a bounded horizon, roll it forward nightly, and fall back
to live expansion outside it.

calendar_event_occurrence carries a GENERATED tsrange, and views read it
with `span && tsrange(from, to)` against a GiST index. The naive
`starts_at < :to AND ends_at > :from` is not just slower — it silently
misses the conference that started last week and is still running, because
starts_at ordering stops approximating ends_at ordering once multi-day
events exist. That index lives only in the migration: this DBAL has no
flag for USING gist, so every schema diff asks to drop it, and nothing
here may run doctrine:schema:update.

Two findings from writing the tests:

  * sabre accepts FREQ=SECONDLY and FREQ=MINUTELY at validation but its
    iterator has no branch to advance on either, so it yields one instant
    forever. The occurrence cap turned that into a thousand identical rows
    — a worse failure than a hang, because it looks like it worked. The
    converter now refuses both frequencies, and the materialiser stops on
    any rule that fails to move forward.
  * Expansion has to happen in the event's own zone. A 09:00 Berlin
    standup is 08:00 UTC in winter and 07:00 UTC in summer; expanding in
    UTC passes every test written in UTC and moves everyone's meeting
    twice a year. Pinned by testWeeklyExpansionHoldsLocalTimeAcrossADst-
    Transition.

Provenance tables (event_source_link, event_suppression) ship now though
nothing writes them yet: they are what will let extraction re-run over a
whole mailbox as a backfill rather than a resync, and a suppression the
user has already expressed must survive that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-01 00:33:59 +02:00
Paul LütznerandClaude Opus 5 e570884422 Actually license the project 
The README has always said AGPL-3.0 and the repository invites pull
requests, but there was no LICENSE file and composer.json declared
"proprietary". In that state nobody could legally fork or contribute,
and GitHub could not detect a licence at all.

Adds the AGPL-3.0 text — which the licence itself requires be
distributed with the source — and corrects the composer declaration to
AGPL-3.0-or-later.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-07-31 12:28:04 +02:00
Paul Lützner c6ae79450a 2fa 2026-07-31 07:18:26 +02:00
Paul Lützner 122006460d onboarding. this is a lot 2026-07-30 16:40:31 +02:00
Paul Lützner 5a7f6a3a41 scheduler 2026-07-28 22:25:00 +02:00
Paul Lützner d0685d0ee6 update 2026-07-28 12:33:46 +02:00
Paul Lützner a243636a34 this is now a PWA und has push 2026-07-27 23:29:39 +02:00
Paul Lützner 4ef4616ee8 more thread ui and jmap start 2026-07-26 18:06:50 +02:00
Paul Lützner 4f57efa479 updates 2026-07-26 10:58:31 +02:00
Paul Lützner 1971f08953 graph start 2026-07-24 13:56:18 +02:00
Paul Lützner cd3c78c205 update 2026-07-21 13:40:57 +02:00
Paul Lützner 4dc569e439 google oauth 2026-07-16 17:46:51 +02:00
Paul Lützner 3ca64ee0d1 autocomplete shenanigans 2026-07-15 17:10:22 +02:00
Paul Lützner ec7abf6dba update 2026-07-15 14:48:35 +02:00
Paul Lützner 76f890a49e init 2026-07-02 13:12:28 +02:00
Paul Lützner 55862ccb2f Add webapp packages 2026-06-24 14:53:43 +02:00
Paul Lützner db8b7fbac5 Add initial set of files 2026-06-24 14:51:50 +02:00