• v0.5.1 7f8a611f5e

    v0.5.1 — CalDAV stays on TCP; CI stops cancelling publishes
    All checks were successful
    CI / gate (push) Successful in 1m1s
    CI / image (push) Successful in 50s
    Stable

    joeyr released this 2026-08-09 11:08:34 -05:00 | 105 commits to main since this release

    Changed

    • CalDAV now stays on TCP; HTTP/3 is disabled for the iCloud session. iCloud answers
      with Alt-Svc: h3=":443", and caldav's HTTP layer acts on it: measured against the live
      host, request 1 negotiates HTTP/1.1 and every request after it negotiates HTTP/3 over
      UDP 443. That is fine on a network carrying UDP 443 cleanly and invisible on one that
      is not — a blocked or MTU-broken UDP path returns no error, only a request that never
      comes back. HTTP/3 buys a handful of small CalDAV requests nothing, so the dependency
      is removed rather than diagnosed.

      Framed honestly: this is hardening, not a fix for a reproduced bug. The timeouts
      seen while investigating stopped without it.

    • CI no longer cancels a superseded run. cancel-in-progress was cancelling
      publishes, not just tests: two pushes a minute apart killed the first one's image
      job partway through, so that commit's :<sha> tag — the only immutable rollback target
      CI produces — never reached the registry, and the window where :latest still pointed
      at the previous version got wider. Superseded runs now queue. The cost is runner time
      re-proving a commit nobody will deploy; the alternative loses artifacts that cannot be
      recreated without pushing an empty commit.

    Fixed

    • The explanation for signing in again after a redeploy was wrong, in the runbook, in
      server.py and in the stack file. OAuthProxy built without a client_storage does
      not fall back to memory — it builds an encrypted file store under
      $FASTMCP_HOME/oauth-proxy/<key-fingerprint>/. The state is written to disk and would
      survive a restart; it is lost because that path sits in the container's writable layer
      with nothing mounted there. The fix is therefore a volume, not a database, which is a
      much smaller change than the one previously written down. docs/oauth-persistence.md
      carries the plan, including why it still does not unblock replicas > 1.
    Downloads