chore: Release

CHANGELOG.md

@@ -1,3 +1,73 @@
+# Continuwuity v26.11.0-alpha.1 (2026-11-10)
+
+## Features
+
+- Added opt-in OpenTelemetry metrics, exported over OTLP or scraped by Prometheus from `/_continuwuity/metrics`, and a Grafana dashboard. Contributed by @eleboucher. (prometheus-metrics)
+- Add support for using custom DNS servers instead of using /etc/resolv.conf. Contributed by @s1lv3r. ([#2056](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2056))
+- Continuwuity now supports configuring additional trusted audience values for deployments using OIDC with an IDP that sends them. Contributed by @ginger ([#2226](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2226))
+- "!admin users list" now hides deactivated users by default, but can display them with the optional "--show-deactivated" flag. "--hide-suspended" and "--hide-locked" have been added as well, which stop suspended and locked users from being displayed respectively. Contributed by @Clubs. ([#2292](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2292))
+- Added support for [MSC4494: Membership-based invite blocking](https://github.com/matrix-org/matrix-spec-proposals/pull/4494) ([#2297](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2297))
+- Appservices now receive typing indicators and read receipts. Contributed by @Jade ([#2327](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2327))
+- Added support for [MSC4363](https://github.com/matrix-org/matrix-spec-proposals/pull/4363) (OAuth step-up authentication). Contributed by @ginger.
+- Added support for [MSC4484](https://github.com/matrix-org/matrix-spec-proposals/pull/4484). Clients which use the built-in Matrix server administration APIs will need to ask for the appropriate scope when signing in with OAuth. Contributed by @ginger.
+- Implemented unstable support for [MSC4560] (Stripped state requests over federation). Contributed by @ginger.
+
+  [MSC4560]: https://github.com/matrix-org/matrix-spec-proposals/pull/4560
+- Profile banners are now treated as images when imported from OIDC claims, like avatars already were.
+- The first-run version of the web UI now includes a link to the registration page. Contributed by @ginger
+
+## Bugfixes
+
+- Invitees are now added as room creators when creating a v12+ trusted private chat. Contributed by @ginger. ([#2162](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2162))
+- Fixed push gateway URLs containing the configured notification path outside of their suffix. Contributed by @eleboucher. ([#2261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2261))
+- "!admin users change-email" now verifies a user exists before attempting to change their email. Contributed by @Clubs. ([#2298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2298))
+- Fixed URL preview image MIME types and rejected failed downloads. Contributed by @eleboucher. ([#2308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2308))
+- Correctly set RocksDB column options, including enabling block caches. Contributed by @Jade ([#2345](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2345))
+- Fix some possible deadlocks/freezes and reduce lock contention (improving performance). Contributed by @Jade ([#2351](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2351))
+- Once again fixed how room extremities are handled, fixing a problem that made continuwuity gradually make rooms needlessly complex, which also caused more frequent state resets. ([#2356](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2356))
+- The OAuth identity reset page is no longer linked from the account management UI to reduce confusion. Contributed by @ginger. ([#2383](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2383))
+- Fixed a worker panic when knocking on a room over federation. Contributed by @eleboucher. ([#2387](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2387))
+- Perform more validation on events received during atomic gapfill from remote servers, fixing a panic if bad data was persisted by another server and later lazily fetched by us. ([#2400](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2400))
+- Redirect URIs in OAuth clients' metadata are now properly validated to be on a subdomain of the OAuth issuer URL domain. Contributed by @ginger. ([#2421](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2421))
+- Fix v12 rooms created by the same user in the same millisecond ending up as the same room. Contributed by @eleboucher. ([#2424](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2424))
+- Client-server API endpoints are now properly ratelimited for unauthenticated requests. Contributed by @ginger. ([#2444](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2444))
+- Setting a profile key longer than 255 bytes now returns 400 `M_KEY_TOO_LARGE` as required by the spec, instead of 413 `M_TOO_LARGE`. ([#2451](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2451))
+- Setting `m.fully_read` via the account data endpoints now returns 405 `M_BAD_JSON` as required by the spec, instead of 400. ([#2451](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2451))
+- Appservices masquerading as a device that does not exist now receive 400 `M_UNKNOWN_DEVICE` as required by the spec, instead of 403 `M_FORBIDDEN`. ([#2451](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2451))
+- Setting profile data that would make the profile exceed 64 KiB now returns 400 `M_PROFILE_TOO_LARGE` as required by the spec, instead of a 500 error. ([#2451](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2451))
+- The `m.forget_forced_upon_leave` capability now reflects the `forget_forced_upon_leave` config option instead of always being advertised as enabled. ([#2452](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2452))
+- Fixed push notifications for membership events setting `user_is_target` based on the sender rather than the user being notified. ([#2454](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2454))
+- Ensure HTTP clients actually follow the `dns_servers` config option. Contributed by @silversys ([#2460](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2460))
+- Reworked event relations to follow the spec more closely. Pagination of `/relations` now returns the correct pages and `next_batch` tokens, recursive relations are returned in the right order without duplicates, and bundled `m.reference` aggregations now include every reference. Contributed by @Henry-Hiles (QuadRadical). ([#2465](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2465))
+- Read receipts are now more spec compliant, will work better in threads and are less likely to end up causing loops with other software. Contributed by @Jade ([#2481](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2481))
+- Fix gap filling skipping outlier events that are missing their previous events. Contributed by @eleboucher.
+- Fix incoming federation events losing state changes when predecessors share the same state-before snapshot. Contributed by @eleboucher.
+- Fix new devices sometimes never reaching other users' device lists. Contributed by @eleboucher.
+- Fix state resolution applying events out of order, which could undo room joins. Contributed by @eleboucher.
+- Fix to-device messages, including room keys, sometimes being lost before delivery. Contributed by @eleboucher.
+- For deployments using OIDC with `profile_key_import_mode` set to `on_login`, users' avatars will no longer be clobbered if they didn't change their avatar since their last login.
+- Room summary visibility checks are no longer incorrectly applied for remote rooms. Contributed by @ginger.
+- The userinfo endpoint is now accessible even if federation is disabled, allowing LiveKit to be used on servers with federation disabled without using the server name whitelist.
+- `!admin token issue` can no longer issue registration tokens when `allow_registration` is false. Contributed by @Clubs.
+
+## Improved Documentation
+
+- Add the Authentication section to document available auth methods for Continuwuity. The "delegated authentication" guide has also been migrated to here. Contributed by @stratself. ([#2234](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2234))
+- Add a guide for push notifications, detailing how it works, push gateway specifics, troubleshooting common issues, and pointing to external guides for UnifiedPush backends. Contributed by @stratself ([#2244](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2244))
+- The deploying page now includes vital general information about installing Continuwuity: release tracks, update steps, and post-installation recommendations. Contributed by @stratself ([#2252](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2252))
+- Add some missing instructions on configuring Continuwuity on the RPM page. Users are encouraged to use the [generic deploying docs](https://continuwuity.org/deploying/generic) for the bulk of guidance anyhow. Contributed by @stratself ([#2275](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2275))
+- Better, more succinct [introduction page](https://continuwuity.org/introduction.html). Contributed by @stratself ([#2279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2279))
+- Add a section on [troubleshooting Docker issues](https://continuwuity.org/troubleshooting#docker-issues). Contributed by @stratself. ([#2324](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2324))
+- Instructions for Authelia added to the [OIDC guide](https://continuwuity.org/authentication/oidc.html). Contributed by @fhoekstra ([#2341](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2341))
+- Docker compose examples now use bind mounts by default, instead of Docker volumes, as they are easier to work with esp. for backup/restore. Contributed by @stratself. ([#2353](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/2353))
+- The documentation now refers to the Continuwuity Docker service as `continuwuity` instead of `homeserver`.
+
+## Misc
+
+- Updated internal Sentry integration setup to the new pattern required by the SDK. #2423
+- Upgraded rocksdb from 11.1.1 to 11.12.0 and jemalloc to 5.4.0.
+
+
 # Continuwuity v26.9.1 (2026-09-28)
 
 ## Features

Cargo.lock

@@ -865,7 +865,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "clap",
  "conduwuit_build_metadata",
@@ -897,7 +897,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "clap",
  "conduwuit_api",
@@ -921,7 +921,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "axum",
  "base64 0.23.1",
@@ -953,7 +953,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "built",
  "cargo_metadata",
@@ -961,7 +961,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_core"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -1031,7 +1031,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1051,7 +1051,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "itertools 0.15.0",
  "proc-macro2",
@@ -1061,7 +1061,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "axum",
  "axum-server",
@@ -1094,7 +1094,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "askama",
  "assign",
@@ -1150,7 +1150,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "askama",
  "async-trait",
@@ -5167,7 +5167,7 @@ dependencies = [
 
 [[package]]
 name = "ruminuwuity"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "assign",
  "http",
@@ -7351,7 +7351,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 dependencies = [
  "askama",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.9.1"
+version = "26.11.0-alpha.1"
 
 [workspace.metadata.crane]
 name = "conduwuit"