✨ Add iCal feed for upcoming events on the my events page

The /events/my route now supports both HTML and ICS responses depending on the Accept header. The iCal feed exposes the next 500 upcoming events for the signed-in account, rendered through the shared _events_ical partial with a customizable calendar name.

A small feed icon is displayed next to the "Upcoming events" heading, linking to the iCal URL with the user's API key, so external calendar apps can subscribe to personal upcoming events.

✨ Add Mailgun MCP server configuration to example files

⬆️ (Gemfile.lock): bump concurrent-ruby & net-imap patch versions

⬆️ (Gemfile.lock): bump faraday from 2.14.2 to 2.14.3

⬆️ Gemfile.lock: bump nokogiri from 1.19.3 to 1.19.4 for security/stability improvements

💄 Add drag handle grip icon to ticket types for clearer reordering

🐛 Fix transferred order not reflecting updated event state by clearing new event cache

The order was being transferred between events, but the new event's cache wasn't being cleared, leading to stale data being displayed. The original event cache was being cleared but the destination event's cache wasn't being refreshed after the transfer.

Install Render CLI in Cursor Docker image

♻️ Rename @minimal_subscribe to @skip_minimal_head

The variable name now accurately reflects its purpose of skipping the minimal head content rendering in the layout, rather than suggesting it only applies to the subscribe view.

🐛 fix field name from 'anonymise' to 'anonymous' in event feedback aggregation

Add organisation referral links and clear return_to after redirect.

Referrers can share /invite/:id links that auto-credit them on org creation; also fix stale session[:return_to] persisting across subsequent sign-ins/signups.

Fix ticket group pmail list test to match rendered label.

The pmail list shows "Ticket group Backstage", not "Ticket group: Backstage".

🔒️ Hide sign-in token in ticket emails when viewed on web

Always show the sign-in link in ticket emails, but omit the sign-in token when the email is rendered for web viewing. This prevents the sensitive sign-in token from being exposed through web-based email viewers, where URLs may be cached, indexed, or shared.

• Remove the viewing_on_web guard from the sign-in link conditional in tickets.erb
• Replace the token placeholder with an empty string in orders.rb when rendering for the web

🔒️ add protected_attributes to event and expand organisation's

Hide sign-in link on web ticket confirmation page.

Rename pdf_link to viewing_on_web so the order page can show the PDF download without exposing magic sign-in links in the browser.

Skip low delivery rate alerts for unknown Mailgun providers.

update Puma

✨ (Pmail): add ticket group as new pmail recipient option, scoped to event ticket groups
♻️ (Pmail): extract mailable lookup into a helper to consolidate id parsing and error handling
🐛 (Pmail): persist deleted ticket group reference so existing pmails don't fall back to whole event recipients
🚑️ (Pmail): block duplicating a pmail whose ticket group has been removed, surfacing an error instead of silently misaddressing
🩹 (pmails controller): render build view with errors when duplicate fails for an unsavable to option
💄 (_to.erb, _to_options.erb): surface ticket group in pmail recipients list and dropdown, including a deleted group placeholder
✅ (pmails_test): cover ticket group pmail fallback, deletion behaviour, duplication guard, and list label

Clarify show_emails help text to say organisation event creators.

Move Release date column after Patch on frontend dependencies stats page.