Easy!Appointments 1.6.1 - Beta Release

Sep 7, 2026

Update: The stable Easy!Appointments 1.6.1 release is out. Use it instead of this beta.

A new 1.6.1 beta release is now available for download and testing!

Download Easy!Appointments 1.6.1-beta.1

Attention: this is a pre-release version and is currently under active development. Please do not install, run or test this version on production environments, but only evaluate this new version on test and development servers.

Contribute to the testing rounds

Testing is a crucial aspect of software development, offering a meaningful opportunity for everyone to contribute, regardless of experience level.

You can install this package just like the original Easy!Appointments version and click through the existing and new functionality, making sure that the app works as expected.

Should you encounter any issues, please share them in the Github Issues page, in the Support Group, on the Discord Server or directly to info@easyappointments.org.

What’s New in Easy!Appointments 1.6.1

Version 1.6.1 remains a maintenance release that follows up on the 1.6 launch, and there are still no new features in the usual sense. Since the alpha, however, the release has grown well beyond validation and interface polish. Calendar synchronization received the most attention by far, six further fixes now carry a security label, and a handful of configuration values have moved to a new home.

Calendar Synchronization, Reworked

The largest part of this beta is synchronization. Google Calendar and CalDAV are now synchronized independently, so a failure on one side no longer skips the other, and a failing Google Calendar synchronization no longer removes the local appointments of the sync period: an expired token, a quota limit or an unreachable API now only interrupts the sync instead of taking appointments with it. The Google Calendar synchronization also fails with a clear error when the provider has no refresh token stored, rather than failing obscurely.

On the CalDAV side, appointment notes are no longer overwritten with the generated provider and customer details block on every run. Events that are stored under an address that does not match their UID are now found, so events created in a calendar client are no longer removed and imported again on every synchronization. Synchronizing one provider no longer removes the imported recurring events of the other providers, the synchronization period is requested in UTC so events at the edges of the period are no longer left out on installations that do not run in UTC, and moving an appointment to another provider now removes the event from the calendars of the previous provider.

Events That Should Not Block Booking

Calendar entries that were never meant to occupy a slot no longer do. Google Calendar events marked as “Free” and CalDAV events marked as free (TRANSP:TRANSPARENT) stay out of the way, so all-day events and birthdays no longer make a provider look fully booked (#1945). The Google Meet link that is generated during synchronization is also stored in the appointment record now, instead of being created and then lost (#1947).

A CalDAV Section in the Settings

CalDAV has its own section under Settings / Integrations in this release, listing the connection URLs that may point into the local network. Connecting to a server on a local network offers to allow its host right in the connection dialog, instead of requiring a trip to the settings first. And when a synchronization does fail, the calendar page explains why it failed and what has to be corrected, instead of only reporting that it did.

Security Hardening

Ten of the fixes in this release carry a security label. The CAPTCHA can no longer be bypassed by leaving the field out of a login, password recovery or booking request, login attempts are throttled again, unauthorized users are stopped from taking over or changing other people’s appointments, and unsafe links in the online meeting field are blocked so that they cannot run code on the calendar.

The integrations received their own round of hardening. Google Calendar API requests verify the TLS certificate of the remote endpoint, the Guzzle HTTP client and the phpseclib library were updated to their patched releases, the sync settings of a provider can no longer be reached without logging in first, and CalDAV URLs that point into the local network are rejected again unless the host is listed in the new CalDAV integration settings. Credentials also stop leaking through the interface: neither the calendar nor the user management pages return Google Calendar tokens, CalDAV passwords or password reset tokens of other accounts any more. Alongside those, the list of Google Calendars of a provider is no longer readable without permission, LDAP searches escape the keyword so a search term cannot alter the filter, and providers and secretaries can no longer overwrite or reassign the appointments and unavailabilities of other providers.

Configuration & Build Changes

One change needs attention before you test: the CORS origins and the cookie SameSite policy are now set in application/config/routes.php and application/config/config.php, and the root config.php keeps only the installation settings. If you have customized either value, move it over before starting. HTML texts such as the privacy policy and the terms & conditions are purified with a cache directory inside storage/cache, so installations with a read-only vendor directory no longer fail with a write error. For anyone building from source, the release build runs Composer inside the php-fpm container, the asset and release build no longer fails with permission errors on files created by the Docker containers, and the release package leaves out stylesheet sources, dependency development files and unused images, which makes the download smaller.

Stronger Validation & Clearer Errors

Invalid input is handled where it belongs. Requests with invalid parameters respond with a proper “bad request” status instead of a server error, and services can no longer be saved with a negative price or a slot interval of zero. The price, slot interval and attendants number are checked before the form is even submitted, so mistakes surface immediately. Confusing messages such as “Start date value is latter than end date.” and “The operation could not completed.” have been corrected, and an outdated database schema now produces a clear message instead of a cryptic error.

A More Predictable Appointment Dialog

Several long-standing annoyances in the appointment dialog are gone. The phone number is validated exactly like it is on the booking page, the dialog scrolls to its validation message and clears invalid fields while you type, and scheduling conflicts are confirmed before the notification question rather than after it. The conflict dialog of a new appointment is no longer titled “Appointment Update”, placing an unavailability over an already booked appointment asks for a confirmation first, and rescheduling an appointment selects its date and time again by default and can be saved without running into an appointment hash error.

Accurate Timezone Handling

Timezone labels now display the offset that is currently in effect, including during daylight saving time, so what you pick in the dropdown matches what your customers actually get. The timezone list itself has been cleaned up as well and no longer contains duplicate names, deprecated entries or malformed offsets.

Booking Page & Embedded Installations

Embedding the booking page on another website works properly again: both the booking error and the language switch error that appeared in embedded setups have been fixed. On top of that, the booking calendar switches months correctly, the page shows a message when no service or provider has been selected yet, and the cancel appointment text and button are displayed on a single line with even spacing.

Notifications & Backend Data

Appointment notes are shown correctly in email notifications again, and the “Mobile” number of providers and secretaries is saved when you create or edit them. Webhooks created or edited through the REST API can set their secret header, so the secret token is sent with the request just as it is for webhooks configured in the backend. Editing a working plan exception updates the existing entry instead of adding a duplicate one next to it (#1958), a provider’s working plan reports the affected days when it contains an invalid time range, and the automated test setup has been repaired so that the test suite runs again.

Note: The calendar integrations changed the most in this beta, so synchronization with Google Calendar and with your CalDAV server is the most valuable thing to test. Upgrades from an existing 1.6.0 installation and the login and password recovery flows are close behind.

These highlights cover the main themes of this release. To see the full list of technical fixes, please refer to the Change Log section below.

Changelog

Added

• A CalDAV section under Settings / Integrations, where the connection URLs that may point into the local network are listed
• The calendar page now explains why a CalDAV synchronization failed and what has to be corrected, instead of only reporting that it did
• Connecting to a CalDAV server on a local network now offers to allow its host right in the connection dialog, instead of requiring a trip to the settings

Changed

• The CORS origins and the cookie SameSite policy are now set in application/config/routes.php and application/config/config.php, instead of the root config.php, which keeps only the installation settings
• The release build now runs Composer inside the php-fpm container, so a Composer installation on the host machine is no longer required
• The release package no longer includes stylesheet sources, dependency development files and unused images, which makes the download smaller

Fixed

• The asset and release build no longer fails with permission errors on the files that the Docker containers create in the project directory
• A failing Google Calendar synchronization no longer removes the local appointments of the sync period, so an expired token, a quota limit or an unreachable API only interrupts the sync
• Appointment notes are no longer overwritten with the generated provider and customer details block on every CalDAV synchronization
• CalDAV events that are stored under an address that does not match their UID are now found, so events created in a calendar client are no longer removed and imported again on every synchronization
• Synchronizing one provider no longer removes the imported recurring CalDAV events of the other providers
• Moving an appointment to another provider now removes the event from the calendars of the previous provider
• The CalDAV synchronization period is now requested in UTC, so events at the edges of the period are no longer left out on installations that do not run in UTC
• Google Calendar and CalDAV are now synchronized independently, so a failure of one of them no longer skips the other
• The Google Calendar synchronization now fails with a clear error when the provider has no refresh token stored
• Security: The Google Calendar API requests now verify the TLS certificate of the remote endpoint
• HTML texts, such as the privacy policy and the terms & conditions, are now purified with a cache directory inside storage/cache, so installations with a read-only vendor directory no longer fail with a write error
• The list of Google Calendars of a provider is no longer readable without permission, so only that provider or a user who may edit providers can fetch it
• Searching the LDAP directory now escapes the keyword, so a search term can no longer alter the LDAP filter
• Webhooks created or edited through the REST API can now set their secret header, so the secret token is sent with the request as it already is for webhooks configured in the backend
• Security: Updated the Guzzle HTTP client and the phpseclib library to their patched releases, fixing outbound request and certificate handling advisories that affected the webhook, CalDAV and Google Calendar integrations
• Editing a working plan exception now updates the existing entry, instead of adding a duplicate one next to it (#1958)
• Google Calendar events marked as “Free” no longer block booking, so all-day events and birthdays stay bookable (#1945)
• CalDAV Calendar events marked as free (TRANSP:TRANSPARENT) no longer block booking (#1945)
• Providers and secretaries can no longer overwrite or reassign the appointments and unavailabilities of other providers
• Requests with invalid parameters now respond with a “bad request” status instead of a server error
• Services can no longer be saved with a negative price or with a slot interval of zero
• The price, slot interval and attendants number of a service are now checked before the form is submitted
• Show a message with the affected days when the working plan of a provider has an invalid time range
• Ask for a confirmation when an unavailability is placed over an already booked appointment
• The appointment dialog now validates the phone number, just like the booking page does
• Timezone labels display the offset that is currently in effect, also during daylight saving time
• The timezone list no longer contains duplicate names, deprecated entries or malformed offsets
• When saving an appointment, the scheduling conflict is now confirmed before the notification question
• The scheduling conflict dialog of a new appointment is not titled “Appointment Update” anymore
• Show a message on the booking page when no service or provider has been selected yet
• The appointment dialog scrolls to its validation message and clears invalid fields while typing
• Fix the “Start date value is latter than end date.” and “The operation could not completed.” messages
• Security: The CalDAV and Google Calendar sync settings of a provider can no longer be reached without logging in first
• Security: CalDAV URLs that point into the local network are rejected again, unless the host is listed in the new CalDAV integration settings
• Security: The CAPTCHA can no longer be skipped by leaving the field out of the login, recovery or booking request
• Security: Login attempts are throttled again, so repeated wrong passwords are blocked as intended
• Security: Stop unauthorized users from taking over or changing other people’s appointments
• Security: Block unsafe links in the online meeting field so they cannot run code on the calendar
• Security: Stop the calendar from returning the Google Calendar tokens and CalDAV passwords of providers to secretary accounts
• Security: Stop the user management pages from returning the calendar sync tokens, CalDAV passwords and password reset tokens of other accounts
• When rescheduling an appointment, its date and time are selected again by default (#1940)
• Rescheduling an appointment can be saved again, instead of failing with an appointment hash error
• Show the cancel appointment text and button on a single line with even spacing
• Fix the automated test setup
• The provider and secretary “Mobile” number is now saved when you create or edit them
• Fix a booking error that appeared when the booking page was embedded on another website
• Fix a language switch error when the booking page was embedded on another website
• The booking page now works when embedded on other websites
• Show a clear message when the database needs to be updated, instead of a confusing error
• Fix the month switching on the booking calendar (#1862)
• Show appointment notes correctly in email notifications (#1881)
• Google Meet link is created but never stored in appointments.meeting_link (#1947)

Going Premium

Did you read this article, but you’re still not sure on how to proceed?

Reach out to info@easyappointments.org and have an expert take care of everything for you in zero time.

Get your free quote and get started now!

Get Started