WebCalendar

fix(tools): handle mixed latin1/UTF-8 data in charset converter The latin1->utf8 converter (issue #626) assumed all non-ASCII bytes were UTF-8 wrongly stored in a latin1 column, and used a column-wide binary->utf8mb4 reinterpret. Databases upgraded over many years often hold a MIX: genuine latin1 bytes (e.g. “a-umlaut”=0xE4, “sharp-s”=0xDF) alongside double-encoded UTF-8 (0xC3A4) in the same column. Genuine latin1 bytes are not valid UTF-8, so the reinterpret step threw “Incorrect string value: \xE4…” and aborted (issue #649). Decide per value instead of per column (“fix-then-reinterpret”): 1. MODIFY column to a binary type (lossless) 2. per distinct value: keep if already valid UTF-8, else transcode latin1->UTF-8 3. MODIFY to utf8mb4 (all bytes now valid, never errors) 4. set table default charset Also: – mysqli_report(OFF) + per-column error handling so one bad column no longer aborts the run; failed columns keep raw bytes and are re-runnable – optional WEBCALENDAR_DB_* env overrides for container/test use – detection summary now counts ASCII / valid-UTF-8 / genuine-latin1 Add tests/test-latin1-conversion.sh: seeds MariaDB 10.5 with the exact failing values from #649 (plus double-encoded, ASCII, and a TEXT column), runs dry-run then conversion, and asserts the resulting bytes and charset.

docs: remove dead references to deleted HTML docs The v2.0 doc modernization (cc0d41cf) deleted WebCalendar-SysAdmin.html and UPGRADING.html in favor of Markdown guides, but several stale references remained (surfaced by issue #648). – config.php: update die_miserable_death docblock to reference docs/troubleshooting.md and the #anchor behavior – settings.php.orig: point http-auth FAQ comment at docs/admin-guide.md – bump_version.sh: drop update_upgrading_html() and its call; the function targeted a deleted file and emitted a warning on every bump – release SKILL.md: remove UPGRADING.html from the touched-files notes

fix(mcp): return event times in user’s local timezone list_events and search_events returned the raw GMT cal_time straight from the database, so timed events came back shifted by the user’s UTC offset (an 8 AM EDT appointment was reported as noon). WebCalendar stores cal_time as a GMT clock time and the web UI always converts it to the user’s TIMEZONE on display (view_entry.php: display_time(…, 2)), independent of GENERAL_USE_GMT; the MCP tools now do the same. – Add mcp_gmt_to_local() and mcp_shift_date() pure helpers in functions.php (unit-testable, no globals/env mutation). – list_events: convert each event to the user’s timezone, widen the GMT date-range query by +/-1 day and re-filter by local date so events that cross a day boundary during the shift aren’t dropped, then re-sort by local date/time. – search_events: convert results to local time and re-sort newest-first. – Untimed/all-day events (cal_time = -1) are left unchanged. – Add 12 tests covering EDT/EST offsets, midnight date rollback, untimed passthrough, unpadded-time normalization, UTC identity, invalid-tz fail-safe, and date-shift month/year/leap-day boundaries.

fix(mcp): repair add_event & rate limiting, isolate the test suite mcp.php: – Fix add_event() id generation: remove the double INSERT and the RETURNING / LOCK TABLES branches that failed against the production schema (cal_id INT NOT NULL, no auto-increment). Generate ids with a portable MAX(cal_id)+1 retry-on-collision loop. – Delegate JSON-RPC handling to mcp_dispatch_request(); the inline switch, tool definitions, and initialize payload now live in functions.php. includes/functions.php: – validate_mcp_token(): strip a “Bearer ” prefix defensively. – check_mcp_rate_limit(): count MCP actions in SQL with a correct, GMT-based one-hour window (previously compared YYYYMMDD to a Unix timestamp, so rate limiting never triggered) and drop dead code. – Add mcp_initialize_result(), mcp_list_tools(), get_mcp_tool_schema(), and mcp_dispatch_request(); load_settings() gains $force_reload. tests: – Add/repair the MCP unit + integration suite and a shared schema fixture at tests/fixtures/test_schema.sql. – Run the installer and php -S server in WEBCALENDAR_USE_ENV mode and put test SQLite DBs in the system temp dir, so the live includes/settings.php and the repo are never read or written by tests. – Harden server teardown against a missing pcntl extension. Full PHPUnit suite (456 tests) and the shell integration harness pass.

Merge pull request #638 from craigk5n/dependabot/github_actions/actions/setup-python-6 chore(deps): bump actions/setup-python from 5 to 6