v3.3.0

.github/workflows/audit.yml

@@ -0,0 +1,48 @@
+---
+name: audit
+
+# Dependency vulnerability audit (pip-audit, see the `audit` env in tox.ini).
+#
+# This is deliberately *not* wired into the `tests` workflow: a new advisory
+# can be published against an unchanged dependency tree, so the audit is
+# time-triggered rather than change-triggered.  The pull_request trigger is
+# narrowed to the files that can change the dependency tree.
+on:
+  pull_request:
+    paths:
+      - pyproject.toml
+      - tox.ini
+      - .github/workflows/audit.yml
+  workflow_dispatch:
+  schedule:
+    # Mondays 04:17 UTC, well clear of the nightly link check (22:03).
+    - cron: "17 4 * * 1"
+
+# Least privilege for GITHUB_TOKEN: this workflow only reads the repository.
+# Flagged by CodeQL, see https://github.com/python-caldav/caldav/pull/694
+permissions:
+  contents: read
+
+concurrency:
+  group: audit-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # hatch-vcs derives the version from git tags; without them the
+          # project metadata pip-audit reads cannot be built.
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
+      - run: pip install tox
+      - name: Audit dependencies for known vulnerabilities
+        run: tox -e audit

.github/workflows/linkcheck.yml

@@ -7,29 +7,65 @@ on:
   schedule:
    - cron: "03 22 * * *"
 
+concurrency:
+  group: linkcheck-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   linkcheck:
     runs-on: ubuntu-latest
     permissions:
       issues: write
     steps:
     - uses: actions/checkout@v5
+    - name: Restore lychee cache
+      uses: actions/cache@v4
+      with:
+        path: .lycheecache
+        key: cache-lychee-${{ github.run_id }}
+        restore-keys: cache-lychee-
     - name: Check links with Lychee
       id: lychee
       uses: lycheeverse/lychee-action@v2
       with:
         fail: false
         args: >-
           --root-dir "$(pwd)"
-          --timeout 20
-          --max-retries 3
+          --timeout 30
+          --max-retries 6
+          --retry-wait-time 2
           --cache
           --max-cache-age 14d
           .
-    - name: Create Issue From File
-      if: steps.lychee.outputs.exit_code != 0
-      uses: peter-evans/create-issue-from-file@v5
-      with:
-        title: Link Checker Report
-        content-filepath: ./lychee/out.md
-        labels: report, automated issue
+    # The exit_code comparisons are quoted on purpose.  A missing output is the
+    # empty string, and GitHub coerces '' to 0 when comparing against a number -
+    # so an unquoted `== 0` would treat "lychee did not run" as "all links are
+    # healthy" and close every open report.  Comparing two strings does no
+    # coercion.
+    - name: Create or update Link Checker issue
+      if: steps.lychee.outputs.exit_code != '' && steps.lychee.outputs.exit_code != '0' && github.ref == 'refs/heads/master'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        # Keep the oldest open report issue as canonical, fold duplicates in.
+        # Both labels are required: `gh issue list` ANDs them, so a
+        # human-written issue that merely carries "report" cannot become the
+        # canonical one and have its body overwritten by lychee output.
+        ISSUES=$(gh issue list --label "report" --label "automated issue" --state open --json number --jq '.[].number' | sort -n)
+        CANON=$(printf '%s\n' "$ISSUES" | head -1)
+        for n in $(printf '%s\n' "$ISSUES" | tail -n +2); do
+          gh issue close "$n" --comment "Duplicate of #${CANON} - auto-closed by the link checker."
+        done
+        if [ -n "$CANON" ]; then
+          gh issue edit "$CANON" --body-file ./lychee/out.md
+        else
+          gh issue create --title "Link Checker Report" --body-file ./lychee/out.md --label "report" --label "automated issue"
+        fi
+    - name: Close Link Checker issue if all links are healthy
+      if: steps.lychee.outputs.exit_code == '0' && github.ref == 'refs/heads/master'
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        for n in $(gh issue list --label "report" --label "automated issue" --state open --json number --jq '.[].number'); do
+          gh issue close "$n" --comment "All links are now healthy."
+        done

.github/workflows/package.yml

@@ -0,0 +1,62 @@
+---
+name: package
+
+# Builds the release artifacts and verifies their contents.
+#
+# Nothing in CI used to build an sdist at all, so what actually went into a
+# release was only ever discovered after it was published: caldav-3.2.1.tar.gz
+# shipped .claude/settings.json and 1755 files under venv/.  The check runs on
+# every change to the packaging configuration, and nightly, so a stray file in
+# a contributor's tree cannot ride along into a tarball unnoticed.
+#
+# See tests/tools/check_dist.py for what is verified.
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    paths:
+      - pyproject.toml
+      - tox.ini
+      - MANIFEST.in
+      - .gitignore
+      - tests/tools/check_dist.py
+      - .github/workflows/package.yml
+  workflow_dispatch:
+  schedule:
+    # Sundays 05:23 UTC, clear of the Monday audit (04:17) and the nightly
+    # link check (22:03).
+    - cron: "23 5 * * 0"
+
+concurrency:
+  group: package-${{ github.ref }}
+  cancel-in-progress: true
+
+# Least privilege for GITHUB_TOKEN: this workflow only reads the repository.
+# Flagged by CodeQL, see https://github.com/python-caldav/caldav/pull/694
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          # hatch-vcs derives the version from git tags.
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
+      - run: pip install tox
+      - name: Build sdist and wheel, and check what is in them
+        run: tox -e package
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: .tox/package/tmp/dist/*
+          if-no-files-found: error

.github/workflows/tests.yaml

@@ -97,7 +97,7 @@
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - name: Configure Baikal with pre-seeded database
         run: |
@@ -183,13 +183,28 @@
           docker exec ${{ job.services.nextcloud.id }} php occ config:system:set ratelimit.whitelist.0 --value='172.17.0.0/16' || true
           docker exec ${{ job.services.nextcloud.id }} php occ config:system:set ratelimit.whitelist.1 --value='127.0.0.1' || true
 
-          # Clear rate limit cache
-          docker exec ${{ job.services.nextcloud.id }} php -r "
-          \$db = new PDO('sqlite:/var/www/html/data/nextcloud.db');
-          \$db->exec('DELETE FROM oc_ratelimit_entries');
-          \$db->exec('DELETE FROM oc_bruteforce_attempts');
-          echo 'Cleared rate limit and bruteforce caches\n';
-          " || true
+          # Clear rate limit cache.  The SQLite file is named after the `dbname`
+          # config value, which defaults to `owncloud` — look it up rather than
+          # guessing, and check it exists first: PDO creates a missing SQLite
+          # file, so a wrong path silently yields "no such table" for every
+          # DELETE below.
+          DB_NAME=$(docker exec ${{ job.services.nextcloud.id }} php occ config:system:get dbname 2>/dev/null | tr -d '\r\n')
+          DB_PATH="/var/www/html/data/${DB_NAME:-owncloud}.db"
+          if docker exec ${{ job.services.nextcloud.id }} test -f "$DB_PATH"; then
+            docker exec ${{ job.services.nextcloud.id }} php -r "
+            \$db = new PDO('sqlite:$DB_PATH');
+            foreach (['oc_ratelimit_entries', 'oc_bruteforce_attempts'] as \$table) {
+                try {
+                    \$db->exec(\"DELETE FROM \$table\");
+                } catch (PDOException \$e) {
+                    fwrite(STDERR, \"skipping \$table: \" . \$e->getMessage() . \"\n\");
+                }
+            }
+            echo \"Cleared rate limit and bruteforce caches\n\";
+            " || true
+          else
+            echo "No database found at $DB_PATH — skipping cache cleanup"
+          fi
 
           echo "Nextcloud is configured!"
       - name: Configure Cyrus
@@ -326,7 +341,7 @@
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - run: tox -e docs
   style:
@@ -339,7 +354,7 @@
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
@@ -356,7 +371,7 @@
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pip
-          key: pip|${{ hashFiles('setup.py') }}|${{ hashFiles('tox.ini') }}
+          key: pip|${{ hashFiles('pyproject.toml') }}|${{ hashFiles('tox.ini') }}
       - run: pip install tox
       - run: tox -e deptry
   # The three async-* jobs below exist to test the async backend *selection* logic,
@@ -418,7 +433,42 @@
           "
       - name: Run async tests with httpxyz
         run: pytest tests/test_async_davclient.py -v
+  async-httpx2:
+    # Uninstalls niquests and httpxyz and installs httpx2 - Pydantic's
+    # continuation of httpx, a separate package rather than a new httpx release.
+    # Unlike httpxyz it does not register itself in sys.modules as "httpx", so
+    # this job is what catches code that reaches for httpx by name.
+    # Runs unit tests plus the Xandikos async integration tests (embedded, no
+    # service container needed), so the backend is exercised over real HTTP.
+    name: async (httpx2 fallback)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install dependencies with httpx2, without niquests or httpxyz
+        run: |
+          pip install --editable .[test]
+          pip uninstall -y niquests httpxyz httpx
+          pip install httpx2
+      - name: Verify httpx2 is used
+        run: |
+          python -c "
+          from caldav.async_davclient import _HTTPX_FLAVOUR, _USE_HTTPX, _USE_HTTPXYZ, _USE_NIQUESTS
+          assert not _USE_NIQUESTS, 'niquests should not be available'
+          assert not _USE_HTTPXYZ, 'httpxyz should not be available'
+          assert _USE_HTTPX, '_USE_HTTPX should be set when httpx2 is used'
+          assert _HTTPX_FLAVOUR == 'httpx2', f'expected httpx2, got {_HTTPX_FLAVOUR}'
+          print('✓ Using httpx2 for async HTTP')
+          "
+      - name: Run async tests with httpx2
+        # Xandikos runs embedded, so no service container is needed; the
+        # selection is deliberately narrow rather than "everything not baikal",
+        # since the runner has docker and would otherwise auto-discover the
+        # docker test servers.
+        run: pytest tests/test_async_davclient.py tests/test_async_integration.py -v -k "xandikos or Xandikos"
   async-httpx:
     # Uninstalls both niquests and httpxyz to force the plain-httpx fallback path.
     # Runs unit tests + a real integration test against Baikal (the lightest server)
     # to verify end-to-end async HTTP with this backend.

.gitignore

@@ -21,16 +21,23 @@ accountific.db
 tests/.noseids
 *.bak
 *~
-#*#
+# Emacs auto-save files.  The backslashes are required: a bare "#" starts a
+# comment, so the pattern was silently a no-op.
+\#*\#
 caldav.egg-info/
 tests/conf_private.py
 .tox
 .eggs
 .venv
+venv
 caldav/_version.py
 tests/docker-test-servers/baikal/baikal-backup/
 tests/docker-test-servers/*/baikal-backup/
 # But keep the pre-configured Specific directory for Baikal
 !tests/docker-test-servers/baikal/Specific/
 # Local test server configuration (may contain credentials)
 tests/caldav_test_servers.yaml
+# Lychee link checker cache
+.lycheecache
+# Scratch files from AI sessions (review notes, draft commit messages)
+docs/design/tmp-*

.lycheeignore

@@ -2,6 +2,7 @@
 https?://your\.server\.example\.com/.*
 https?://.*\.example\.com(:\d+)?(/.*)?$
 https?://domain/.*
+https?://evil.attacker.com/caldav/
 
 # Localhost URLs for test servers (not accessible in CI)
 http://localhost:\d+/.*
@@ -17,6 +18,7 @@ https://caldav\.gmx\.net/.*
 https://caldav\.icloud\.com/.*
 https://p\d+-caldav\.icloud\.com/.*
 https://posteo\.de:\d+/.*
+https://sync\.infomaniak\.com/.*
 https://purelymail\.com/.*
 https://webmail\.all-inkl\.com/.*
 https://www\.google\.com/calendar/dav/.*
@@ -36,6 +38,10 @@ https://oauth2\.googleapis\.com/.*
 # Personal/demo test server (may be down)
 https?://davical\.bekkenstenveien53c\.oslo\.no/.*
 
+# Sites that serve 403 to non-browser clients.  The links are fine in a
+# browser; lychee just isn't one.
+https://stackoverflow\.com/.*
+
 # Dead or broken links we can't fix
 http://fsf\.org/.*
 http://oxpedia\.org/.*

.pre-commit-config.yaml

@@ -1,21 +1,21 @@
 ---
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.4
+    rev: v0.15.20
     hooks:
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
       - id: ruff-format
 
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
-      - id: check-byte-order-marker
+      - id: fix-byte-order-marker
       - id: trailing-whitespace
       - id: end-of-file-fixer
 
   - repo: https://github.com/pycalendar/ai-prompt-auto-commit
-    rev: v0.0.5
+    rev: v0.0.8
     hooks:
       - id: unstage-ai-prompts
       - id: append-ai-prompts
@@ -26,13 +26,13 @@ repos:
         stages: [manual]
 
   - repo: https://github.com/compilerla/conventional-pre-commit
-    rev: v3.4.0
+    rev: v4.4.0
     hooks:
       - id: conventional-pre-commit
         stages: [commit-msg]
 
   - repo: https://github.com/lycheeverse/lychee
-    rev: lychee-v0.24.1
+    rev: lychee-v0.24.2
     hooks:
       - id: lychee
         args: ["--no-progress", "--timeout", "10", "--exclude-path", ".lycheeignore", "--max-cache-age=30d", "--cache"]