Changelog: Cal.com v6.4 - Our origin story, Changes to Open Source license & performance improvements & more...

We're finally telling our origin story

Curious how Cal.com started? Go behind the scenes, including how Peer and Bailey met and how it all began.

Changes to open source license

We’re making changes to the way we are distributing our software, due to the rise of AI and industry-wide impact to open source.

Starting today, Cal.com will relaunch all free and open-source code as Cal.diy under MIT License, widely considered the most liberal and popular open-source license. This new community edition is only for self-hosting and use at your own risk.

AI coding assistants have drastically changed the way engineers write code, but it also made finding vulnerabilities in software much easier, especially publicly available code.

To address this new risk, moving forward the codebase of the commercial edition of Cal.com, that you are currently a customer of, will no longer be publicly available. (It was “source-available” before, which is now “closed source”.)

For hobbyists: you can now access all of Cal.diy code and instructions for free, forever.

For Cal.com users: nothing changes to your access or account. This is primarily a license change only. If you are self-hosting the enterprise edition, you will receive invites to the private GitHub repository.

Performance improvements

We've made some significant speed improvements for large organizations this month. Loading the bookings page used to be noticeably slow for orgs with hundreds of members — in some cases taking over 20 seconds. We've reworked how that data gets fetched under the hood, and it's now up to 20x faster. The same goes for event type configuration, which follows the same pattern of improvement. If your org has grown and things have felt sluggish, you should notice a real difference.

New features:

• We’ve added the full routing trace to Insights to show exactly why a round robin host was selected, especially useful for complex routing setups using Salesforce ownership routing.

• We’ve added a new setting that lets organizations decide whether bookings marked as spam should have their CRM events deleted.

• We’ve added the ability to rotate your OAuth client secret in case it’s compromised or lost.

• We now allow you to set up your OAuth clients with multiple redirect URIs.

• We’ve added a new feature that detects unreachable routes in your routing forms to prevent misrouted bookings.

• We’ve added a new home screen for the settings page with a search box to quickly find what you need.

• We’ve added several improvements to our Salesforce integration to support more advanced ownership routing (e.g. fuzzy domain matching, record type filtering).

• We've added the ability for hosts to reschedule a booking even when their calendar shows as busy, so hosts are never blocked by availability conflicts.

Improvements & fixes

• We've fixed an issue where two people confirming the same pending booking at the same time could result in a double-booking. Concurrent confirmations are now handled safely.

• We've fixed an issue where CalDAV calendar users (Fastmail, iCloud, and others) were receiving duplicate meeting invitations for the same booking.

• We've fixed an issue where SMS reminders were silently failing when the scheduled send time was in the near-immediate future. They now send right away instead.

• We've fixed an issue where attendees were still receiving reminders with the old host's details after a booking was reassigned to a different round-robin host.

• We've made a security fix to prevent HTML from being injected through booking note fields.

• We've fixed an issue where the "hide organizer email" setting could be bypassed via certain booking fields, potentially exposing the organizer's email to attendees.

• We've added retry logic with exponential backoff for Google Calendar syncing, so bookings no longer fail when Google's rate limits are hit during heavy use.

• We've fixed an issue where recurring bookings could fall out of sync with the calendar due to timezone and time-handling edge cases.

• We've made a security fix to add proper authorization checks to the payment charge endpoint.

Cheers,

Milos from Cal.com