Yuvomi

Security

• Global search no longer surfaces other members’ private calendar events (GHSA-gjpr-85rg-587c). The search box at the top of the app queries every module at once, and its calendar bucket applied only the module-access check: a member could type a word and get the title and date of another member’s private appointment, or of an event from a subscribed calendar that was never shared - while the calendar’s own search has filtered both since #474. The global search now applies the same two clauses as the calendar search, so the two return the same hits for the same word, which is what #471 intended. Found while reviewing #1055.

Changed

• Updated the production dependency nodemailer to 10 (#1048). It carries the password-reset and invitation mails; the SMTP settings are unchanged.

Fixed

• Leaving the dashboard now stops its clock, silent refresh, weather and wall timers (#976, #977). The router had no teardown contract for pages: the dashboard only cancelled its own timers at the start of its next render, never when you navigated away, so they kept ticking against a container that was no longer on screen and started dashboard requests behind whatever page you were on - the wall kitchen timer even chimed and re-rendered there. Every page render now receives an abort signal from the router that fires as soon as the route is replaced, and the dashboard binds all its timers and listeners to it. A render that is overtaken by another one (retry, the customize toggle, a weather refresh, a wall timer) now stops after its pending requests instead of rebuilding the surface a second time, so an older response can no longer overwrite a newer one. Third-party modules get the same signal in their render context.
• Birthdays no longer vanish from the calendar when you filter by person (#1054). The person filter and “Assigned to me” keep an entry only if a selected person is assigned to it, and a birthday belongs to a contact, not to a household member - so any person selection emptied the whole birthday layer. Birthdays now sit outside the person axes, the way holidays always have; the “Birthdays” toggle in the filter sheet remains the way to hide them. Ordinary events without an assignment still drop out under a person filter, which is intentional (#987).
• A Mealie or Tandoor address on a private or local network now says which switch to set (#1053). Since 2.64.1 the SSRF guard also checks an IP literal on the first hop (GHSA-9jh6), so a provider configured as http://192.168.x.x that used to slip past the guard now needs RECIPE_PROVIDER_ALLOW_PRIVATE_NETWORK=true - but the form answered “Could not connect to the recipe provider with these credentials”, and the account card showed the bare resolver message. The form now refuses a local name or a private IP literal before any network call and names the switch, the way notification channels do; a hostname that resolves into a private network gets the same hint on the connection test, on the account card and after a failed sync. The 2.64.1 notes below carry the same addendum, since that is where an upgrader looks first.