chore: release v1.3.3 - security patches, community contributions

Next.js 16.2.0 security update, plus merged PRs #33-#40 from
rensreinders and wrenix (calendar improvements, contacts UX, navigation)

Author: ma2t

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.3.3 (2026-03-20)
+
+### Fixes
+
+- **Security**: Update Next.js 16.1.6 -> 16.2.0 (CSRF bypass, HTTP request smuggling, image disk cache DoS, resume buffering DoS, dev HMR CSRF)
+- **Calendar**: Participant/invitation handling aligned with Stalwart JMAP, deduplicate self-attendees (#36)
+- **Calendar**: Double-click to create event from month view with smart time suggestion (#37)
+- **Calendar**: Week numbers column in month view, respects firstDayOfWeek setting (#38)
+- **Calendar**: Replace inline delete confirms with centered modal dialog (#34)
+- **Calendar**: Sticky week headers aligned with calendar grid (#33)
+- **Contacts**: Simplified bulk selection actions into compact dropdown menu (#39)
+- **Navigation**: Hide vertical nav rail on tablet to avoid duplicate navigation (#40)
+
 ## 1.3.2 (2026-03-17)
 
 ### Fixes

VERSION

@@ -1 +1 @@
-1.3.2
+1.3.3

components/calendar/calendar-week-view.tsx

@@ -92,7 +92,8 @@ export function CalendarWeekView({
   useEffect(() => {
     if (scrollRef.current) {
       const now = new Date();
-      scrollRef.current.scrollTop = Math.max(0, (now.getHours() - 1) * HOUR_HEIGHT);
+      const headerHeight = scrollRef.current.querySelector<HTMLElement>(".sticky")?.offsetHeight ?? 0;
+      scrollRef.current.scrollTop = Math.max(0, headerHeight + (now.getHours() - 1) * HOUR_HEIGHT);
     }
   }, []);
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "jmap-webmail",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "A modern JMAP webmail client built for Stalwart Mail Server",
   "author": "Matthieu MALVACHE <matthieu@root.cloud>",
   "license": "MIT",