uuid1 -> uuid4 fix, plus preparing for v3.0.1

Author: tobixen

CHANGELOG.md

@@ -12,16 +12,32 @@ Changelogs prior to v2.0 is pruned, but was available in the v2.x releases
 
 This project should adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html), though for pre-releases PEP 440 takes precedence.
 
-## [Unreleased]
+## [3.0.1] - 2026-03-04
+
+Highlights:
+
+* Minor bugfix to support old versions of httpx
+* New test server docker container: OX
+* Minor other fixes and workarounds
+* Started working on proper documentation for the 3.x-series
+
+### Test runs before release
+
+* Xandikos, Radicale, all docker servers (including OX), an external Zimbra server, but no other external servers.
 
 ### Added
 
-* **OX App Suite** compatibility hints added; the library is now tested against OX App Suite via a new Docker test server (`tests/docker-test-servers/ox/`).
-* New `search.unlimited-time-range` feature flag with a workaround in `search.py` that injects a broad time range (1970–2126) for servers that return an empty result set when no time range is specified.
+* **OX App Suite** included in the docker test servers.  Compatibility hints added.  To get OX running it's needed to do an extra build step.  See `tests/docker-test-servers/ox/`.  However, OX is undertested as both the caldav-server-checker and the test suite does not play well with OX (events with historic DTSTART etc are used, OX doesn't support that).
+* New `search.unlimited-time-range` feature flag with a workaround in `search.py` that injects a broad time range (1970–2126) for servers that return an empty result set when no time range is specified (but this still doesn't help to OX).
 
 ### Fixed
 
 * `AsyncDAVClient` failed to initialize when using httpx < 0.23.0 because `proxy=None` was unconditionally passed to `httpx.AsyncClient` which did not accept a `proxy` keyword argument in older releases.  Fixes https://github.com/python-caldav/caldav/issues/632
+* Stalwart (like purelymail) includes extra "not found" error data in some responses.  This could trigger a spurious `"Deviation from expectations found"` log error in production, or an assertion failure in debug mode.
+
+### Security
+
+* UUID1 was replaced with UUID4 before releasing v3.0 ... some places.  Unfortunately I forgot to grep for UUID1 before preparing the release.  When UIDs are generated by UUID1, it may embed the host MAC address in calendar data shared with third parties.  Switched to UUID4 throughout.
 
 ### Potentially Breaking Changes
 
@@ -222,6 +238,7 @@ Additionally, direct `DAVClient()` instantiation should migrate to `get_davclien
 
 ### GitHub Issues Closed
 
+* #71 - `add_object` vs `save_object` (reopened, reverted and closed)
 * #128 - Calendar constructor should accept name parameter (long-standing issue) -- Tobias Brox (@tobixen)
 * #342 - need support asyncio -- @ArtemIsmagilov
 * #424 - implement support for JMAP protocol -- @ArtemIsmagilov

caldav/base_client.py

@@ -389,7 +389,7 @@ def _normalize_to_list(obj: Any) -> list:
     """Convert a string or None to a list for uniform handling."""
     if not obj:
         return []
-    if isinstance(obj, (str, bytes)):
+    if isinstance(obj, str | bytes):
         return [obj]
     return list(obj)
 

caldav/calendarobjectresource.py

@@ -662,7 +662,7 @@ def copy(self, keep_uid: bool = False, new_parent: Any | None = None) -> Self:
         obj = self.__class__(
             parent=new_parent or self.parent,
             data=self.data,
-            id=self.id if keep_uid else str(uuid.uuid1()),
+            id=self.id if keep_uid else str(uuid.uuid4()),
         )
         if new_parent or not keep_uid:
             obj.url = obj._generate_url()
@@ -843,7 +843,7 @@ def _find_id_path(self, id=None, path=None) -> None:
             ## TODO: do we ever get here?  Perhaps this if is completely moot?
             id = re.search("(/|^)([^/]*).ics", str(path)).group(2)
         if id is None:
-            id = str(uuid.uuid1())
+            id = str(uuid.uuid4())
 
         i.pop("UID", None)
         i.add("UID", id)

caldav/collection.py

@@ -473,7 +473,7 @@ def freebusy_request(self, dtstart, dtend, attendees):
         freebusy_ical.add("prodid", "-//tobixen/python-caldav//EN")
         freebusy_ical.add("version", "2.0")
         freebusy_ical.add("method", "REQUEST")
-        uid = uuid.uuid1()
+        uid = uuid.uuid4()
         freebusy_comp = icalendar.FreeBusy()
         freebusy_comp.add("uid", uid)
         freebusy_comp.add("dtstamp", datetime.now())
@@ -568,7 +568,7 @@ def _create(
             return self._async_create(name, id, supported_calendar_component_set, method)
 
         if id is None:
-            id = str(uuid.uuid1())
+            id = str(uuid.uuid4())
         self.id = id
 
         if method is None:
@@ -636,7 +636,7 @@ async def _async_create(
     ) -> None:
         """Async implementation of _create."""
         if id is None:
-            id = str(uuid.uuid1())
+            id = str(uuid.uuid4())
         self.id = id
 
         if method is None:

caldav/lib/vcal.py

@@ -209,7 +209,7 @@ def create_ical(ical_fragment=None, objtype=None, language="en_DK", **props):
     if not component.get("dtstamp") and not props.get("dtstamp"):
         component.add("dtstamp", datetime.datetime.now(tz=datetime.timezone.utc))
     if not component.get("uid") and not props.get("uid"):
-        component.add("uid", uuid.uuid1())
+        component.add("uid", uuid.uuid4())
 
     alarm = {}
     for prop in props:

caldav/operations/calendarobject_ops.py

@@ -469,7 +469,7 @@ def _get_primary_component(icalendar_instance: Any) -> Any | None:
     for comp in components:
         if isinstance(
             comp,
-            (icalendar.Event, icalendar.Todo, icalendar.Journal, icalendar.FreeBusy),
+            icalendar.Event | icalendar.Todo | icalendar.Journal | icalendar.FreeBusy,
         ):
             return comp
 

examples/scheduling_examples.py

@@ -76,7 +76,7 @@ def cleanup(self, calendar_name, calendar_id):
 caldata.add("prodid", "-//tobixen//python-icalendar//en_DK")
 caldata.add("version", "2.0")
 
-uid = uuid.uuid1()
+uid = uuid.uuid4()
 event = Event()
 event.add("dtstamp", datetime.now())
 event.add("dtstart", datetime.now() + timedelta(days=4000))
@@ -89,7 +89,7 @@ def cleanup(self, calendar_name, calendar_id):
 caldata2.add("prodid", "-//tobixen//python-icalendar//en_DK")
 caldata2.add("version", "2.0")
 
-uid = uuid.uuid1()
+uid = uuid.uuid4()
 event = Event()
 event.add("dtstamp", datetime.now())
 event.add("dtstart", datetime.now() + timedelta(days=4000))