3 people cb36fc201f fix: add URL validation to webhook endpoints (#26593) ...

Validates webhook URLs on create and update:
- HTTPS required (HTTP allowed for self-hosted and E2E)
- Blocks private IP ranges and localhost
- Blocks cloud metadata endpoints

Existing webhooks are preserved: validation only applies when URL is created or changed.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-02-05 16:18:10 -03:00

..

__mocks__

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

__tests__

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

apps

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

auth

refactor: remove @calcom/features dependency from @calcom/prisma (#23820)

2025-09-18 16:40:39 +00:00

bookings

refactor: calEventParser CalendarEvent ISP (#25890)

2026-01-17 10:40:01 +05:30

browser

fix: Scrolling to timeslot issue on Safari with inline-embeds (#22547)

2025-07-23 04:26:08 -03:00

builders/CalendarEvent

icalsequence fix (#26815)

2026-01-14 10:08:19 +05:30

components

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

crmManager

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

crypto

feat: add encryptedKey column to Credential table for calendar integrations (#27154)

2026-01-30 09:15:13 -03:00

cva

…

dayjs

fix: resolve useLiteralKeys biome lint issues (#26851)

2026-01-14 19:13:13 -03:00

domainManager

fix: improve Vercel domain 'forbidden' error message and add schema fields (#25520)

2025-12-05 05:26:42 +00:00

dto

feat(flags): add @Memoize and @Unmemoize decorators for declarative caching (#27063)

2026-01-22 16:26:27 +01:00

holidays

feat(holidays): improve UI/UX and add contextual emojis (#25895)

2025-12-16 00:40:04 +00:00

hooks

feat: add multi-step download app dropdown with platform-specific options (#27211)

2026-01-26 16:17:32 +00:00

idempotencyKey

fix: Generate new idempotency key when round robin reassigning (#22065)

2025-06-26 17:43:31 +00:00

intervalLimits

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

payment

refactor: circular deps between app store and lib [3] (#23742)

2025-09-14 11:24:16 -03:00

raqb

refactor: Move attribute and routing-forms code from app-store/lib to features (#26025)

2025-12-29 21:51:06 -03:00

schedules/transformers

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

server

fix: Improve the error handling in Stripe collectCard method (#27249)

2026-01-27 06:47:11 +00:00

service

refactor: Move attribute and routing-forms code from app-store/lib to features (#26025)

2025-12-29 21:51:06 -03:00

sync

…

tasker

feat: add monthly proration processing (#27002)

2026-01-22 11:23:38 +00:00

test

feat: add redirect option for non-routed visits to event types (#27468)

2026-02-02 15:48:23 -03:00

tracing

feat: distributed tracing - 2 (#24861)

2025-11-13 11:51:54 +00:00

tracking

feat: store utm tags in stripe on signup (#26838)

2026-01-22 08:13:47 -03:00

unstable_cache

perf: server-fetch data for all pages in /settings/my-account (#20712)

2025-07-24 22:36:40 +01:00

zod

fix: add URL validation to webhook endpoints (#26593)

2026-02-05 16:18:10 -03:00

array.test.ts

…

array.ts

…

availability.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

buildCalEventFromBooking.ts

feat: add custom calendar reminder for Google Calendar events (#26078)

2026-01-14 12:32:00 +01:00

CalendarAppError.ts

…

CalendarService.test.ts

fix: prevent CalDAV duplicate invitations with RFC-compliant SCHEDULE-AGENT (#22434)

2026-01-22 16:23:06 +05:30

CalendarService.ts

fix: prevent CalDAV duplicate invitations with RFC-compliant SCHEDULE-AGENT (#22434)

2026-01-22 16:23:06 +05:30

CalEventParser.test.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

CalEventParser.ts

refactor: calEventParser CalendarEvent ISP (#25890)

2026-01-17 10:40:01 +05:30

checkIfItFallbackImage.ts

…

checkRateLimitAndThrowError.test.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

checkRateLimitAndThrowError.ts

chore: system wide ratelimit per path (#25080)

2025-11-12 22:01:59 +00:00

CloseCom.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

CloseComeUtils.ts

…

connectedCalendar.ts

…

constants.ts

feat: add Cloudflare URL Scanner for malicious URL detection (#26387)

2026-01-21 12:28:57 -03:00

contructEmailFromPhoneNumber.ts

…

convertToNewDurationType.ts

…

cookie.ts

feat: google ads conversion tracking (#25198)

2025-11-25 12:58:10 +00:00

crypto.test.ts

fix: handle non-deterministic AES-256-CBC decryption in crypto test (#26383)

2026-01-01 23:18:35 -03:00

crypto.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

csvUtils.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [1] (#24399)

2025-10-13 12:01:02 -03:00

currencyConversions.ts

refactor: circular deps between app store and lib [5] (#23936)

2025-09-19 10:16:56 -03:00

dateTimeFormatter.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

dateTimeFormatter.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

dbReadResponseSchema.ts

refactor: Remove circular deps between @calcom/lib and @calcom/features [2] (#24438)

2025-10-17 06:48:08 -03:00

default-cookies.ts

refactor: cookie domain logic in defaultCookies (#22168)

2025-06-30 20:21:16 +00:00

defaultAvatarImage.ts

…

delegationCredential.ts

refactor: circular deps between app store and lib [6] (#23971)

2025-10-09 14:02:12 +00:00

deriveAppDictKeyFromType.ts

…

emailSchema.ts

fix: Hotfix in change from @spammer.com to spammer.com (#24479)

2025-10-15 15:38:14 +01:00

entityPermissionUtils.shared.ts

refactor: prevents mixed server/clients imports (#21499)

2025-05-25 09:07:49 +00:00

env.ts

…

errorCodes.ts

fix: Improve the error handling in Stripe collectCard method (#27249)

2026-01-27 06:47:11 +00:00

errors.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

extract-base-email.ts

…

fetch-wrapper.ts

feat: Allow reschedule when max booker bookings have been reached (#21778)

2025-06-13 23:54:33 +00:00

fetchUsername.ts

…

fetchWithTimeout.ts

fix: refactor i18n loadTranslations and set timeout to 3s (#22878)

2025-08-04 10:30:18 +01:00

findDurationType.ts

…

formatCalendarEvent.ts

fix: different calendar hosts (#24000)

2025-10-01 12:15:34 +03:00

formatPhoneNumber.ts

refactor: small improvements for cal ai (#23444)

2025-08-29 17:42:15 +05:30

formbricks.ts

feat: custom feedback dialog for feature opt-in (#27578)

2026-02-05 11:01:14 +00:00

fromEntriesWithDuplicateKeys.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

generateHashedLink.ts

…

getAdditionalEmailHeaders.ts

…

getAvatarUrl.ts

fix: avatar URL breaking for team/orgs in BookerEmbed atom (#27424)

2026-02-03 17:19:48 +00:00

getBooking.tsx

fix: resolve useLiteralKeys biome lint issues (#26851)

2026-01-14 19:13:13 -03:00

getBrandColours.test.ts

…

getBrandColours.tsx

…

getCalcomUrl.ts

fix: Add cal.eu to IS_CALCOM (#23111)

2025-08-18 16:04:48 +05:30

getClientErrorFromUnknown.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

getIP.ts

fix: replace console logging with logger across services and features (#26127)

2025-12-23 08:24:23 +00:00

getMetadataHelpers.ts

…

getOrgIdFromMemberOrTeamId.ts

fix: cal ai webhook (#24368)

2025-11-05 13:31:55 +04:00

getReplyToEmail.test.ts

feat: custom reply To Email (#20771)

2025-04-23 06:44:44 -07:00

getReplyToEmail.ts

fix: replyTo includes the correct email (#21843)

2025-06-17 10:45:44 +00:00

getReplyToHeader.ts

fix: replyTo includes the correct email (#21843)

2025-06-17 10:45:44 +00:00

getSafe.ts

feat: Upgrade to Next 15 (#18834)

2025-03-20 21:30:51 -03:00

getSafeRedirectUrl.test.ts

…

getSafeRedirectUrl.ts

fix: correct bookingUrl for EU instance in API responses (#27046)

2026-01-20 12:48:30 +00:00

getTeamIdFromEventType.ts

feat: optimize Prisma queries by replacing findFirst with findUnique where applicable (#21826)

2025-06-17 09:52:02 +03:00

getTldPlus1.ts

fix: correct bookingUrl for EU instance in API responses (#27046)

2026-01-20 12:48:30 +00:00

getValidRhfFieldName.test.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

getValidRhfFieldName.ts

feat: normalize routing form identifier field with URL-safe format (#25128)

2025-11-18 11:24:33 +05:30

gtm.ts

…

hasEditPermissionForUser.ts

refactor: remove tRPC references from packages/lib (#24553)

2025-10-27 18:13:25 +00:00

hashedLinksUtils.ts

feat: Enhance private link expiration with usage and date limits (#22304)

2025-07-24 19:54:44 +01:00

hasKeyInMetadata.ts

…

http-error.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

i18n.ts

…

intervalTree.ts

perf: optimize filterRedundantDateRanges from O(n²) to O(n log n) (#22093)

2025-07-03 10:59:33 +01:00

invertLogoOnDark.ts

…

isEqual.ts

…

isEventTypeColor.ts

…

isKeyInObject.ts

…

isMac.ts

…

isOutOfBounds.timezone.test.ts

fix: Stores the DateRange in UTC instead of user machine that caused the bug (#26900)

2026-01-19 10:41:53 +02:00

isOutOfBounds.tsx

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

isPrismaObj.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

isProblematicTimezone.ts

…

isRecurringEvent.ts

…

isSmsCalEmail.ts

…

jest.config.json

…

jsonUtils.ts

…

logger.server.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

logger.ts

Add DI for BookingAudit (#25123)

2025-11-28 09:14:48 +00:00

markdownIt.ts

…

markdownToSafeHTML.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

markdownToSafeHTMLClient.ts

fix: unordered list issue (#23454)

2025-08-30 15:37:10 +00:00

navigateInTopWindow.ts

…

next-seo.config.ts

…

notEmpty.ts

…

objectKeys.ts

…

OgImages.tsx

feat: Introduce biome (#25664)

2025-12-29 19:41:41 -03:00

package.json

fix: add URL validation to webhook endpoints (#26593)

2026-02-05 16:18:10 -03:00

parse-dates.ts

…

parse-zone.ts

…

perf.ts

fix: replace console logging with logger across services and features (#26127)

2025-12-23 08:24:23 +00:00

piiFreeData.ts

chore: Upgrade prisma to 6.7.0 (#21264)

2025-09-11 15:27:50 +01:00

pkce.test.ts

feat: OAuth PKCE (#25313)

2025-11-26 17:02:42 +01:00

pkce.ts

Prefix node protocol (#26391)

2026-01-02 12:47:00 +00:00

random.test.ts

…

random.ts

…

rateLimit.ts

fix: added conditional check for the unkey logger to reduce the number of logs (#25858)

2025-12-14 12:35:57 +00:00

recentImpersonations.ts

feat: implement recent impersonations list with localStorage storage (#23610)

2025-09-06 19:56:08 +05:30

recurringStrings.ts

fix: Recurring events set to "yearly" don't recur (#24361)

2025-11-03 16:20:15 +00:00

redactError.ts

Avoid using prisma types on client (#23566)

2025-09-04 00:58:13 +00:00

redactSensitiveData.test.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redactSensitiveData.ts

feat: add missing sensitive fields to redactSensitiveData (#24121)

2025-10-01 20:26:58 -03:00

redirect.ts

…

retellAIFetcher.ts

…

safeStringify.ts

…

sanitizeCalendarObject.ts

…

sdk-event.ts

…

Sendgrid.ts

…

sentryWrapper.ts

feat(calendar-subscription): add telemetry metrics for cache performance and webhook calls (#26501)

2026-01-07 11:27:40 +00:00

serverConfig.ts

…

slugify-lenient.ts

slugify lenient (#25923)

2025-12-16 14:01:54 +00:00

slugify.test.ts

…

slugify.ts

fix: replace @ts-ignore with @ts-expect-error to fix biome lint errors (#26849)

2026-01-14 19:05:57 -03:00

smsLockState.ts

fix: resolve noNonNullAssertion and noImplicitAnyLet lint issues (#27021)

2026-01-19 20:07:18 -03:00

ssrfProtection.test.ts

fix: add URL validation to webhook endpoints (#26593)

2026-02-05 16:18:10 -03:00

ssrfProtection.ts

fix: add URL validation to webhook endpoints (#26593)

2026-02-05 16:18:10 -03:00

stripe-error.ts

refactor: Error code - remove circular dep between app store <-> lib (#23669)

2025-09-08 07:31:28 -03:00

stripMarkdown.ts

…

telemetry.ts

chore: Remove next-collect package (#25146)

2025-11-19 13:54:26 +00:00

testEmails.ts

…

testSMS.ts

…

text.test.ts

…

text.ts

…

timeFormat.ts

refactor: event type builder (#19459)

2025-03-20 07:49:14 -07:00

timeShift.ts

feat: add time shift badge for recurring events with shifted local times (#25568)

2025-12-11 20:18:00 +00:00

timezone.ts

fix: timezone-dropdown (#23469)

2025-08-31 08:20:19 +00:00

timezoneConstants.ts

…

timeZones.ts

feat(companion): new availability detail and actions pages for ios (#26424)

2026-01-04 12:48:37 -03:00

totp.ts

…

triggerDevLogger.ts

feat: Booking EmailAndSms Notifications Tasker (#24944)

2025-11-28 14:00:04 +00:00

tsconfig.json

perf: Remove tRPC types from @calcom/lib (#24551)

2025-10-19 13:14:25 +00:00

tsconfig.test.json

…

turndownService.ts

…

validateBookerLayouts.ts

…

videoTokens.ts

feat: Introduce biome (#25664)

2025-12-29 19:41:41 -03:00

WebAppURL.ts

…

webstorage.ts

refactor: Use sessionStorage instead of localStorage for decoy booking data (#24450)

2025-12-12 07:42:44 -03:00

weekday.test.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

weekday.ts

fix: add Icelandic, Lithuanian, and Norwegian locale support for Booker (#25519)

2026-01-13 08:47:39 -03:00

weekstart.test.ts

…

weekstart.ts

…