Merge pull request #14188 from nocodb/nc-feat/gcal-sync

fix: accept non-zero-padded dates in Date/DateTime cells and prevent paste data loss

fix(nocodb): disambiguate paired link column on V2 upgrade by fk_index_name

feat(nc-gui): support Lookup fields as form "Show on conditions" sources

refactor(comments-webhook): reuse insert/update/delete operation tokens

feat(nc-gui): show field description on hover in expanded record form

feat(nc-gui): enable calendar view on mobile

feat(comments): switch comment toolbar to Lucide icons

feat(nc-gui): extend sheet exclusion to upload-into-existing import

refactor(sdk): type LTAR filter return as FilterTypeWithMeta

fix(nc-gui): prevent duplicate record at infinite-scroll buffer boundary

feat(nc-gui): preview OpenDocument files (odt/ods/odp) in attachment carousel

fix(nocodb): guard null colOptions in Column.delete2 formula loop

feat: grid presence

fix: render HEIC preview in page designer and lookup preview panel

feat(links): convert self-referential link's reverse system field to a regular field

fix(kanban-optimised): skip the upfront full load that defeated windowed loading

ci(helm): chart-testing lint/install on kind and OCI publish

fix(filter): make LongText `like` filter case-insensitive on Postgres

fix(security): restrict shared-view /mm/ /hm/ related columns to the LTAR target-view

fix: alphabetize multi-select cell values on save when isAlphabetized is on

refactor(mail): properly type renderMail template invocation

chore(oauth): TODO to align refresh-grant errors on RFC-6749 codes

feat(realtime-sort): DB-computed per-view sort anchor for live repositioning

fix(formula): don't persist dry-run short-circuit sentinel as column error

fix(nc-gui): don't duplicate attachment base64 in shared form submit payload

fix(plugins): skip adapter test when deactivating/resetting a plugin

fix(nocodb): honor display_field_id in V3 table update

fix(nocodb): add uuid indexes on bases and views tables, scope FileReference bulk deletes to base

fix(nc-gui): honor team & workspace roles in cross-base link base picker

fix(internal-api-batch): capture + log unhandled sub-op exceptions

fix(nocodb): block hidden-column leak via query-param aliases in public shared views

fix: nc sync

fix(nocodb): block IPv6 transition-encoding SSRF bypass in DB host validation

fix(nc-gui): copy record URL works for records expanded from linked-record cells

fix(nocodb): address review on junction system-link cleanup

fix: include LTAR custom display value column in lookup-of-link responses

New translations en.json (Nepali)

chore(renovate): Security update Update dependency @nestjs/core to ^10.4.22 [SECURITY]

fix: block public shared-base audit reads and shared-form redirect XSS

feat(payment): consolidate workflow retention into automation retention

feat: sync ui in shared view

fix(nocodb): apply EXIF orientation to attachment thumbnails

chore(deps): patch remaining critical/high advisories (vitest, lodash, minimatch, tar-fs, playwright)

feat: add Undo toast after deleting a sync from Manage Syncs

fix(nocodb): collapse TableCreateField in V3 validation patch

fix(field-agent): pass getColor and isDark to AISelectCellRenderer from index.ts

fix(token-expiry): treat SQLite unix-ms numeric strings as parseable dates

fix(nocodb): strip hidden-column filters from public CSV export

fix: surface section-inheritance hint on the view permissions picker

fix(nocodb): reject expired reset and invite tokens

fix (nocodb): add data upload acl to editor access

fix: packages/nc-gui/package.json to reduce vulnerabilities

fix(base-user): type getProjectsList params and forward workspaceId in v3

fix(nocodb): coerce axios response headers to string

chore: bump migration filename to current date

chore: lint

remove duplicated OperationSource

fix: packages/nocodb/package.json to reduce vulnerabilities

fix(nc-gui): gate expanded-form record actions on URL-addressable rowId

fix(nocodb): move Docs v3 API routes under /api/v3/meta/bases/:baseId

refactor generateCastQuery to use object prop as args

fix(nocodb): duplicate virtual columns on meta-diff sync

fix: remap V2 cross-base HM/BT links to junction-based types in nested insert

fix: drop context arg from getProto Lookup branch and restore refContext in multipleHmListCount

chore(renovate): Security update Update dependency ajv@<6.12.3 to >=6.12.6 [SECURITY]

chore(renovate): Update minor

Replace dependency eslint-plugin-eslint-comments with @eslint-community/eslint-plugin-eslint-comments 3.2.0

chore(renovate): Security update Update dependency glob [SECURITY]

chore(renovate): Security update Update dependency diff to v8 [SECURITY]

chore(renovate): Security update Update dependency vite@>=6.0.0 <=6.1.5 to >=6.4.2 [SECURITY]

chore(renovate): Security update Update dependency nuxt to v3.19.0 [SECURITY]

chore(renovate): Security update Update dependency ajv to ^8.20.0 [SECURITY]

chore(renovate): Security update Update dependency vite@>=6.1.0 <6.1.5 to >=6.1.6 [SECURITY]

chore(renovate): Security update Update dependency vite@>=6.1.0 <6.1.4 to >=6.1.6 [SECURITY]

chore(renovate): Security update Update dependency vite@>=6.1.0 <6.1.3 to >=6.1.6 [SECURITY]

chore(renovate): Security update Update dependency vite@>=6.1.0 <6.1.2 to >=6.1.6 [SECURITY]

chore(renovate): Security update Update dependency tar-fs@<2.1.2 to >=3.0.10 [SECURITY]

chore(renovate): Security update Update dependency qs@<6.14.1 to >=6.14.2 [SECURITY]

chore(renovate): Security update Update dependency axios@>=0.8.1 <0.28.0 to >=0.28.1 [SECURITY]

chore(renovate): Security update Update dependency axios to v1.13.6 [SECURITY]

test(installer): update bats assertions for new compose layout

chore: remove legacy docker-compose templates superseded by examples/

fix: missing deleted col index

fix(audit): drop CE 30-day retention limit and FE notice

validate snapshot name so it matches validateEntityName and can be restored

fix: plan badges

chore(renovate): Update major

fix ui gb null comparison

removed as any cast

operationSource via prop drilling ncRecordId ncRecordHash only set system when operationSource is AT_IMPORT

strip ncRecordHash when duplicate

mark slim meta cache and fetch when reopening

fix the definition for ee

refactor: master to production

refactor to use extractDisplayNameFromEmail

prevent ssrf on migrate service

sso user cannot enable 2fa

fix: migration correction

refactor: restore ~/ import + widen EE extract-ids.helpers to export * (F2 + F3)