Radicale

* Fix: time-range filter on a VTODO having DTSTART/DUE and also CREATED/COMPLETED used the CREATED->COMPLETED duration instead of the DTSTART->DUE one, so completed tasks were missing from (or wrongly returned by) calendar-query REPORT results
* Fix: sharing/proppatch: reject in case of write-access but 'p' is in permissions
* Fix: sharing/by-map: catch collection path without trailing / (supporting "pimsync")
* Add: [report] max_expand_occurrence option to separate from max_freebusy_occurrence
* Add: [system] max_vevent_rrule_occurrence option to catch DoS by problematic RRULE early enough (workaround for missing protection in current vobject version)

* Fix: web plugin helpers httputils.serve_resource/serve_folder ignored their mimetypes and fallback_mimetype parameters and always used the built-in mapping, so custom web plugins could not serve additional file types with a correct Content-Type
* Fix: free-busy REPORT always failed with HTTP 400 ("FREEBUSY occurrences limit of 0 hit") when [reporting] max_freebusy_occurrence is set to 0 (limit disabled), because the limit check did not honor the disabled limit
* Fix: time-range filter treated a VEVENT with a whole-day DURATION (e.g. P1D, P2D) as zero-length (timedelta.seconds instead of total_seconds), so such events were missing from calendar-query REPORT results
* Fix: calendar-data expand (REPORT) left recurrence properties (e.g. RDATE) on the expanded single-occurrence VEVENTs; a single try/except around the sequential delattr() calls stopped at the first absent property (e.g. missing EXDATE), so later ones were never removed
* Fix: text-match filter on a structured property (e.g. vCard N or ADR) crashed with HTTP 500 (AttributeError: 'Name'/'Address' object has no attribute 'lower') because vobject parses these into non-string objects; their text representation is now used
* Fix: sharing bday-to-ICS conversion assigned the empty-FN fallback marker to the {nickname} placeholder instead of {fn}, so a VCARD with an empty FN got its NICKNAME overwritten with "!fn!" in the generated SUMMARY/DESCRIPTION and the {fn} fallback never resolved
* Fix: sharing/delete: add forgotten backmap

* Extension: item verification on commandline
* Improvement: catch lack of support of PERIOD in vobject <= 0.9.9
* Fix: sharing: backmap of REPORT/PROPPATCH hrefs is now URL-encode-aware (edit of a shared collection failed when the principal contains '')
* Workaround: remove trailing spaces on TZID and TZNAME appended by buggy Microsoft clients
* Extension: [auth] imap_append_domain option (optional)

* Add: [sharing] conversion_bday_summary_template (customize summary)
* Add: [sharing] conversion_bday_description_template (customize description)
* Add: [sharing] conversion_bday_alarm_trigger_template (customize alarms)
* Add: [sharing] conversion_bday_categories (customize)
* Add: [sharing] conversion_bday_age_max (limit in case of "age" placeholder is used which blocks using RRULE)
* Extension: [sharing/bday conversion]: add STATUS + CLASS fields
* Improve: sanitize item align timezone (add/remove) of EXDATE or RDATE with DTSTART
* Fix: sharing: bday conversion backmap on PROPFIND/REPORT if script_name is active (via reverse proxy)

* Fix: sharing: PROPFIND returns now empty owner element in case of a mapped share as clients try PROPFIND on this not accessable href
* Improve: sharing: PROPFIND returns also privilege "write" in case "write-content" and "write-properties" is permitted
* Extension: WebUI dark theme with automatic browser/OS color scheme detection
* Fix: WebUI hide copy button in insecure environments
* Improve: WebUI decode URL in text field for better readability
* Fix: sharing: bday conversion hrefs for vCard filenames ending in v/c/f
* Add: [web] prefer_browser_login option