Skip to content

[pull] main from calcom:main#694

Merged
pull[bot] merged 4 commits intocode:mainfrom
calcom:main
Mar 28, 2026
Merged

[pull] main from calcom:main#694
pull[bot] merged 4 commits intocode:mainfrom
calcom:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented Mar 28, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

laurenschristian and others added 4 commits March 28, 2026 13:08
* fix: join multiple Reply-To addresses as comma-separated string

Some SMTP providers (e.g., SendLayer) reject emails when Reply-To is
passed as an array to nodemailer, which serializes it as multiple
Reply-To headers. Using a comma-joined string is RFC 2822 compliant
and works universally across all SMTP providers.

Fixes #28610

* test: add unit tests for getReplyToHeader SMTP compatibility

- Verify replyTo is always returned as comma-separated string, not array
- Test single email, multiple emails, and empty email cases
- Add RFC 5322 compliance test for SMTP compatibility

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* docs: add RFC 5322 reference comment to getReplyToHeader tests

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Lawrence Christian <67164412+LCNDevs@users.noreply.github.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>
Co-authored-by: Romit <romitgabani1.work@gmail.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: block localhost and loopback addresses in SSRF protection

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: block loopback IPs by hostname in SSRF protection

Add 127.0.0.1, ::1, [::1], and 0.0.0.0 to blocked hostnames list for
defense-in-depth protection against SSRF attacks targeting localhost.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Romit <romitgabani1.work@gmail.com>
Co-authored-by: Romit <85230081+romitg2@users.noreply.github.com>
…worker shutdown flake (#28630)

* fix: mock @calcom/lib/i18n in EventManager.test.ts to prevent vitest worker shutdown flake

TranslationService transitively imports @calcom/lib/i18n which triggers slow
module resolution via vite's RPC. When the vitest worker shuts down before it
completes, it causes 'Closing rpc while fetch was pending' errors.

Mocking the module prevents the actual module resolution during test loading.

Co-Authored-By: romitgabani1 <romitgabani1.work@gmail.com>

* chore: remove explanatory comments per review feedback

Co-Authored-By: romitgabani1 <romitgabani1.work@gmail.com>

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
…sibility (#28631)

Both booking-sheet-keyboard.e2e.ts and bookings-list.e2e.ts intermittently
timeout in CI when clicking the booking item button before the DOM has
finished rendering. Adding explicit waitFor({ state: 'visible' }) on the
role=button element after the parent booking item is visible ensures the
click target is fully ready.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@pull pull Bot locked and limited conversation to collaborators Mar 28, 2026
@pull pull Bot added the ⤵️ pull label Mar 28, 2026
@pull pull Bot merged commit 31f4076 into code:main Mar 28, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants