Add iOS-specific UX improvements:
Safe Areas:
- Add CSS variables for safe area insets (notch, home indicator)
- Add body classes: isNativeMobile, isIOS, isKeyboardVisible
- Apply safe area padding on native mobile platforms
Keyboard Handling:
- Install @capacitor/keyboard plugin
- Track keyboard visibility via keyboardWillShow/Hide events
- Set --keyboard-height CSS variable for layout adjustments
- Remove bottom safe area padding when keyboard is visible
Status Bar:
- Install @capacitor/status-bar plugin
- Sync status bar style with app dark/light theme
- Configure overlaysWebView: false in capacitor.config.ts
These changes ensure proper display on iPhone devices with
notch/Dynamic Island and home indicator.
The previous commit changed module resolution to bundler mode which
fixed Angular tests but broke Node.js ESM imports in super-sync-server.
Switch to tsup bundler that outputs both ESM (.mjs) and CJS (.js) formats,
with proper exports field to support both environments:
- CJS for super-sync-server (Node.js commonjs)
- ESM for Angular/webpack bundler imports
- Update @angular/* packages to v21.0.8
- Update @angular/material and @angular/cdk to v21.0.6
- Update @angular-eslint/* to v21.1.0
- Update @ngrx/* to v21.0.1
- Update TypeScript to 5.9.3
- Update ngx-markdown to v21 and marked to v17
- Update typia to v11 for TypeScript 5.9 support
- Update @types/node to v22, chart.js to v4.5.1
Breaking changes addressed:
- Replace deep imports with public API imports (idb, formly, ngrx)
- Update marked-options-factory for marked v17 API changes
- Add custom FormlySliderComponent (formly slider incompatible with Mat v21)
- Update ngx-markdown SANITIZE configuration
- Fix HostListener decorators with unused $event args
- Fix crypto.subtle type compatibility
- Add skipLibCheck for dependency type conflicts
- Update tsconfig module settings for Angular 21
Removed:
- @angular-builders/custom-webpack (unused)
- Update @simplewebauthn/server from v11 to v13.2.2 for compatibility
- Add debug logging for WebAuthn config and authentication options
- Browser library also needs to be updated to v13.2.2 (manual step)
The version mismatch between server and browser libraries may have been
causing passkey registration/login issues.
Authentication changes:
- Add passkey (WebAuthn) as primary login method
- Add email magic link as fallback for devices without passkey support
- Remove password-based authentication entirely
New features:
- Passkey registration and login via @simplewebauthn/server
- Magic link login with 15-minute expiry tokens
- Passkey recovery via email link
- Self-hosted simplewebauthn-browser.min.js for reliability
Database changes:
- Add Passkey model for WebAuthn credentials
- Add PasskeyChallenge model for registration/auth challenges
- Add loginToken and loginTokenExpiresAt fields for magic links
- Add passkeyRecoveryToken fields for passkey recovery
UI changes:
- Login form: email + "Login with Passkey" + "Send Login Link"
- Register form: email + terms checkbox + "Register with Passkey"
- Consistent token display UI for both passkey and magic link login
- Remove password fields and forgot password flow
Security:
- CSP-compliant magic link redirect using external script
- Rate limiting on all auth endpoints
- Single-use magic link tokens
Move ical.js (~76KB) to a lazy-loaded chunk via dynamic import.
The library is only loaded when calendar integration features are used.
- Create ical-lazy-loader.ts for on-demand loading
- Make getRelevantEventsForCalendarIntegrationFromIcal async
- Update calendar-integration.service.ts to use switchMap
Resolve conflict in webdav-sync-expansion.spec.ts:
- Use simplified sync verification without reload (sync updates NgRx directly)
- Test: B marks task done -> sync -> verify A sees task as done
- CVE-2025-66035: XSRF token leakage via protocol-relative URLs
- CVE-2025-66412: Stored XSS via SVG animation and MathML attributes
- CVE-2025-66414: DNS rebinding in @modelcontextprotocol/sdk
Updated @angular/* packages to 20.3.15 and @angular/cli to 20.3.13.
* master: (41 commits)
16.7.2
16.7.1
16.7.0
fix(focus-mode): show start button when break time is up in banner mode
fix(focus-mode): hide dismiss button in banner-only mode (#5737)
fix(focus-mode): add start button in banner after session completes (#5737)
refactor(focus-mode): remove isAlwaysUseFocusMode setting (#5737)
feat(focus-mode): add task existence check before resuming tracking (#5737)
feat(focus-mode): add icon buttons for banner and sync session with tracking (#5753)
fix(repeat): schedule tasks for correct day and remove from Today when needed (#5594)
feat(focus-mode): sync duration when Pomodoro settings change (#5753)
feat(focus-mode): add new settings and fix pomodoro dialog (#5753)
fix(focus-mode): fix pomodoro long break timing and add ticking sound option (#5753)
feat(android): add better notifications and permanent notification for focus mode
feat(android): add background time tracking via foreground service
build(ci): add i18n JSON validation step to lint-and-test workflow
docs: add archived tasks viewer to community plugins
fix(android): make schedule dialog scrollable on small screens (#5741)
fix(focus-mode): preserve existing notes when opening notes panel (#5752)
fix(sync): show user-friendly error for Flatpak/Snap permission issues
...
# Conflicts:
# src/app/features/android/store/android.effects.ts
# src/app/features/focus-mode/store/focus-mode.effects.ts
# src/app/features/issue/dialog-edit-issue-provider/dialog-edit-issue-provider.component.ts
# src/app/features/reminder/reminder.module.ts
# src/app/features/task-repeat-cfg/store/task-repeat-cfg.effects.ts
