WebCalendar v1.9.16

This release brings a major security-hardening feature (signed release-file manifest verification), wide-ranging wizard installer and mobile-UI bug fixes, RFC 5545–conformant iCal handling, full Unicode/emoji support in iCal imports, and modernized Markdown documentation published as a MkDocs Material site.

Security

• Security audit now verifies a signed manifest of release files and reports extra, modified, and missing files — a defense against opportunistic webshell drops (#233). See docs/release-signing.md for the maintainer runbook and independent verification instructions.

Fixed

• Restore CREATE TABLE IF NOT EXISTS for webcal_blob in upgrade SQL
• Remove spurious CREATE TABLE from upgrade SQL preview; fix copy button
• Add --skip-ssl fallback for MySQL CLI; create webcal_blob if missing
• Align day view time column when untimed events are present (#100)
• Nav links from view_entry.php now return to own calendar (#159)
• Preserve correct date for all-day events during CSV import (#193)
• Replace += 86400 day loop with mktime to prevent DST duplicate days (#167)
• Honor BYMONTH selection for monthly repeating events (#155)
• Repair Expert Mode ByDay/ByMonthDay/BySetPos button selection (#165)
• Skip BYMONTHDAY values exceeding month length per RFC 5545 (#149)
• Use exclusive DTEND for untimed events per RFC 5545 (#144)
• Widen webcal_blob.cal_name from VARCHAR(30) to VARCHAR(255) (#105)
• Correct ICS export timezone/DST handling (#74)
• Add maxlength to brief description input to prevent silent truncation (#60)
• Empty ICS email attachment when creator is not a participant (#236)
• Add missing management pages to access control page lookup (#368)
• Remove ldap_sort() call removed in PHP 8.0 (#373)
• Enable double-tap to add events on Android Chrome (#528)
• Preserve English fallback translations for non-English languages (#450)
• Prevent password lockout when cal_passwd column is too narrow (#567)
• Gracefully handle invalid or unwritable cache directory (#617)
• Time selection dropdowns wrapping in Repeat/Reminders tabs (#625)
• Add missing globals for name validation in save_user() (#498)
• End time wrapping on separate lines in event editor (#596)
• Handle missing wizard gracefully (#610)
• PHP 8.2+ float-to-int deprecation in time_selection() (#612)
• Typos in HTML attributes, CSS selectors, and class names (#574)
• Respect EMAIL_MAILER setting instead of hardcoding SMTP (#629)
• Replace broken DES-crypt session cookies with secure token-based remember-me
• Always use UTF-8 meta charset; add latin1-to-utf8 migration tool (#626)
• Set UTF-8 charset on database connections and HTTP headers (#626)
• Upgrade wizard skipping v1.9.11 SQL when upgrading from v1.9.10 (#624)
• Display events of all participants
• Wizard upgrade regressions blocking install and post-install runtime (#639)
• Restore upgrade helper functions dropped in wizard rewrite (#639)
• cat_owner NULL cleanup and version-stamp error reporting in installer (#639)
• Schema probe now authoritative over stale version stamp during upgrade (#639)
• Bypass and clear stale query cache for WEBCAL_PROGRAM_VERSION (#639)
• Custom template HTML save, Firefox select font, and mobile minical fixes (#639)
• Keep Month/Week/Year views horizontal on iPad portrait (#639)
• Narrow-viewport minical caption-side rendering (#640)
• Stop wiping non-array site_extras values on save (#641)
• Navbar collapse breakpoint and dual-collapse toggle on mobile (#639)
• Stray quote and PHP block in styles.css (#639)
• Correct ICS export timezone for Apple Calendar and CalDAV clients
• Support emoji and full Unicode in iCal imports and display

Changed

• Upgrade PHPMailer from 6.8.1 to 7.0.2 (#602)
• Upgrade PHP_CodeSniffer from 3.x to 4.0.1
• Documentation modernized: legacy HTML docs archived, replaced with Markdown
• Database backend support clarified: MySQL, PostgreSQL, SQLite3 are supported and tested; Oracle, DB2, ODBC, Interbase are legacy/untested on PHP 8

Added

• MCP server unit and integration tests with CI workflow
• Comprehensive Markdown documentation in docs/
• Manual ordering UI for event categories (#493)
• MkDocs Material documentation site with GitHub Pages deployment

Verifying this release

WebCalendar v1.9.16 ships a signed manifest (MANIFEST.sha256 + MANIFEST.sha256.sig) and a cosign keyless signature of the release zip. See docs/release-signing.md (github.com) for verification instructions.