diff --git a/CHANGELOG.md b/CHANGELOG.md index eac18a9fe..95e0b9d23 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +# Continuwuity v26.7.2 (2026-07-30) + +## Bugfixes + +- Sliding sync no longer continues streaming data to a user after they are removed from a room. Contributed by @eleboucher. (SEC10) +- Valid redaction events no longer arbitrarily soft-fail and are applied correctly as expected. +- Fixed a regression that caused the server to process events for rooms it no longer has any local users in, which caused users to be reset back *into* rooms. + # Continuwuity 26.7.0 (2026-07-27) ## Features @@ -13,7 +21,8 @@ ## Bugfixes - Fix joining restricted rooms over federation failing with signature verification error. (fix-federation-signature) -- Fixed the client space hierarchy endpoint returning a 500 "Space hierarchy is unreasonably large" error for cyclic space graphs (e.g. a space containing itself). Rooms are now deduplicated during traversal as required by the spec, and the traversal depth is bounded even when the client does not specify `max_depth`. (space-hierarchy-cycle) +- Fixed the client space hierarchy endpoint returning a 500 "Space hierarchy is unreasonably large" error for cyclic space graphs (e.g. a space containing itself). Rooms are now deduplicated during + traversal as required by the spec, and the traversal depth is bounded even when the client does not specify `max_depth`. (space-hierarchy-cycle) - Fixed simplified sliding sync holding account data for up to 30 seconds, which made encryption setup and cross-signing resets appear to hang. (sss-account-data-longpoll) - Fixed local invites and invite acceptances not being reflected in sync promptly. Contributed by @eleboucher (wake-local-member-sync) - Fixed the deeplink redirect for deleting devices. Contributed by @koen (#1965) @@ -21,7 +30,8 @@ - Exempt m.room.create from auth_events check. Contributed by @eleboucher (#1987) - Fixed `create` being returned as a supported prompt value regardless of if registration is enabled or not. Contributed by @ginger (#1994) - Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop. (#2006) -- Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt. (#2015) +- Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from + starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt. (#2015) - Deactivated users and appservice puppets are no longer counted by `/_continuwuity/local_user_count`. Contributed by @ginger. (#2040) - Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update. (#2057) - Appservices are now properly able to create devices for E2EE. @@ -30,22 +40,22 @@ - Fixed freshly left room failing to sync. - Fixed newly created rooms failing to sync properly in clients using legacy sync. - Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync. -- Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher +- Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on + internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher - Resolve alias service by correct name for auto-join. Contributed by @eleboucher ## Improved Documentation - Updated an out-of-date statement about Oracle Linux release cadences. (#1999) - # Continuwuity 26.6.2 (2026-07-12) ## Bugfixes - Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975) - Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided. -- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them. - +- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, + use `!admin users reset-password --convert-to-local-account` to reactivate them. # Continuwuity 26.6.1 (2026-07-12) @@ -61,7 +71,6 @@ - Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration. - Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`. - # Continuwuity 26.6.0 (2026-07-10) ## Features @@ -71,19 +80,15 @@ - Added config option for default room ACLs. Contributed by @eve. (#1691) - Added support for fallback encryption keys. (#1710) - Add `!admin users reject-all-invites` to clean invite spam (#1741) -- Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed - within some Continuwuity rooms. - Also resolved several bugs related to both soft-failing events, and event backfilling, which should - improve state resolution stability. - The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and - `!admin debug show-auth-chain` was added to visually display event auth chains, which may assist - developers in debugging strangely complex events. +- Implemented event rejection, which should resolve and prevent future netsplits of the kinds observed within some Continuwuity rooms. Also resolved several bugs related to both soft-failing events, + and event backfilling, which should improve state resolution stability. The `!admin debug get-pdu` command was updated to disambiguate event acceptance status, and + `!admin debug show-auth-chain` was added to visually display event auth chains, which may assist developers in debugging strangely complex events. Contributed by @nex. (#1747) - Added full support for [MSC4168: Update `m.space.*` state on room upgrade](https://github.com/matrix-org/matrix-spec-proposals/pull/4168). Contributed by @nex. (#1807) -- Improved the performance and reliability of fetching missing events, improving network partition recovery. Contributed - by @nex. (#1818) -- Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you are on NixOS. Contributed by @Henry-Hiles (QuadRadical). (#1853) +- Improved the performance and reliability of fetching missing events, improving network partition recovery. Contributed by @nex. (#1818) +- Added static builds using Nix, allowing for Continuwuity on musl. During this, we also introduced a `max-perf-haswell` package, separating it from `max-perf`, so you may want to swap to this if you + are on NixOS. Contributed by @Henry-Hiles (QuadRadical). (#1853) - Added support for MSC4380 invite blocking, which has become part of the Matrix specification in v1.18. Contributed by @nex. (#1875) - Added `!admin debug get-state-at` command (#1877) - Added a configuration option to allow choosing a client IP source that is not the TCP connecting IP. Contributed by @nex. (#1931) @@ -95,10 +100,12 @@ ## Bugfixes -- Adjusted legacy sync logic to allow the `roomsynctoken_shortstatehash` database column to be dropped, massively reducing database sizes, especially for old deployments. Contributed by @ginger. (#917) +- Adjusted legacy sync logic to allow the `roomsynctoken_shortstatehash` database column to be dropped, massively reducing database sizes, especially for old deployments. Contributed by @ginger. + (#917) - Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex. (#1711) - fix `!admin query account-data account-data-get` not returning the content (#1742) -- Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles (QuadRadical) (#1752) +- Fixed an issue where Continuwuity would only advertise support for the unstable endpoint for Mutual Rooms (MSC2666), despite only supporting the stable endpoint. Contributed by @Henry-Hiles + (QuadRadical) (#1752) - Fixed admin commands being ignored when they had leading whitespace before admin commands. Contributed by @kitvonsnookerz. (#1804) - Fixed several bugs in the `POST /_matrix/client/v3/rooms/{roomId}/upgrade` endpoint. Contributed by @nex. (#1807) - Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout. @@ -125,8 +132,8 @@ - #1505, #1829, #1927, #1933, #1934 - Switched from Continuwuity's fork of Ruma back to upstream Ruma. Contributed by @ginger. -- The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used on distro versions from before 2025-01-30 - +- The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used + on distro versions from before 2025-01-30 # Continuwuity 0.5.8 (2026-04-24) @@ -144,7 +151,6 @@ - Updated config docs to state we support room version 12, and set it as default. Contributed by @ezera. (#1622) - Improve instructions for generic deployments, removing unnecessary parts and documenting the new initial registration token flow. Contributed by @stratself (#1677) - # Continuwuity v0.5.7 (2026-04-17) ## Features @@ -186,7 +192,6 @@ - Fixed compiler warning in cf_opts.rs when building in release. Contributed by @ezera. (#1620) - # Continuwuity 0.5.6 (2026-03-03) ## Security @@ -196,22 +201,33 @@ ## Features -- Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts. Contributed by @nex. ([#1399](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1399)) -- Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted work. Contributed by @nex and @Jade. ([#1428](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1428)) -- Added [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202) Device masquerading (not all of MSC3202). This should fix issues with enabling [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) for some Mautrix bridges. Contributed by @Jade ([#1435](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1435)) -- Added [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814) Dehydrated Devices - you can now decrypt messages sent while all devices were logged out. ([#1436](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1436)) -- Implement [MSC4143](https://github.com/matrix-org/matrix-spec-proposals/pull/4143) MatrixRTC transport discovery endpoint. Move RTC foci configuration from `[global.well_known]` to a new `[global.matrix_rtc]` section with a `foci` field. Contributed by @0xnim ([#1442](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1442)) +- Outgoing presence is now disabled by default, and the config option documentation has been adjusted to more accurately represent the weight of presence, typing indicators, and read receipts. + Contributed by @nex. ([#1399](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1399)) +- Improved the concurrency handling of federation transactions, vastly improving performance and reliability by more accurately handling inbound transactions and reducing the amount of repeated wasted + work. Contributed by @nex and @Jade. ([#1428](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1428)) +- Added [MSC3202](https://github.com/matrix-org/matrix-spec-proposals/pull/3202) Device masquerading (not all of MSC3202). This should fix issues with + enabling [MSC4190](https://github.com/matrix-org/matrix-spec-proposals/pull/4190) for some Mautrix bridges. Contributed by @Jade + ([#1435](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1435)) +- Added [MSC3814](https://github.com/matrix-org/matrix-spec-proposals/pull/3814) Dehydrated Devices - you can now decrypt messages sent while all devices were logged out. + ([#1436](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1436)) +- Implement [MSC4143](https://github.com/matrix-org/matrix-spec-proposals/pull/4143) MatrixRTC transport discovery endpoint. Move RTC foci configuration from `[global.well_known]` to a new + `[global.matrix_rtc]` section with a `foci` field. Contributed by @0xnim ([#1442](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1442)) - Updated `list-backups` admin command to output one backup per line. ([#1394](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1394)) -- Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview ` command to clear cached URL previews that were stuck and broken. ([#1434](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1434)) +- Improved URL preview fetching with a more compatible user agent for sites like YouTube Music. Added `!admin media delete-url-preview ` command to clear cached URL previews that were stuck and + broken. ([#1434](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1434)) ## Bugfixes - Removed non-compliant nor functional room alias lookups over federation. Contributed by @nex ([#1393](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1393)) -- Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160. ([#1418](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1418)) -- Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers` config option is set correctly. Contributed by @katie. ([#1421](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1421)) +- Removed ability to set rocksdb as read only. Doing so would cause unintentional and buggy behaviour. Contributed by @Terryiscool160. + ([#1418](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1418)) +- Fixed a startup crash in the sender service if we can't detect the number of CPU cores, even if the `sender_workers` config option is set correctly. Contributed by @katie. + ([#1421](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1421)) - Removed the `allow_public_room_directory_without_auth` config option. Contributed by @0xnim. ([#1441](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1441)) -- Fixed sliding sync v5 list ranges always starting from 0, causing extra rooms to be unnecessarily processed and returned. Contributed by @0xnim ([#1445](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1445)) -- Fixed a bug that (repairably) caused a room split between continuwuity and non-continuwuity servers when the room had both `m.room.policy` and `org.matrix.msc4284.policy` in its room state. Contributed by @nex ([#1481](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1481)) +- Fixed sliding sync v5 list ranges always starting from 0, causing extra rooms to be unnecessarily processed and returned. Contributed by @0xnim + ([#1445](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1445)) +- Fixed a bug that (repairably) caused a room split between continuwuity and non-continuwuity servers when the room had both `m.room.policy` and `org.matrix.msc4284.policy` in its room state. + Contributed by @nex ([#1481](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1481)) - Fixed `!admin media delete --mxc ` responding with an error message when the media was deleted successfully. Contributed by @lynxize - Fixed spurious 404 media errors in the logs. Contributed by @benbot. - Fixed spurious warn about needed backfill via federation for non-federated rooms. Contributed by @kraem. @@ -221,19 +237,15 @@ ## Features - Added unstable support for [MSC4406: - `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406). - Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308)) -- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by - @Omar007 ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349)) -- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by - @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368)) -- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be - rejected. Contributed by @trashpanda ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372)) + `M_SENDER_IGNORED`](https://github.com/matrix-org/matrix-spec-proposals/pull/4406). Contributed by @nex ([#1308](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1308)) +- Introduce a resolver command to allow flushing a server from the cache or to flush the complete cache. Contributed by @Omar007 + ([#1349](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1349)) +- Improved the handling of restricted join rules and improved the performance of local-first joins. Contributed by @nex. ([#1368](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1368)) +- You can now set a custom User Agent for URL previews; the default one has been modified to be less likely to be rejected. Contributed by @trashpanda + ([#1372](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1372)) - Improved the first-time setup experience for new homeserver administrators: - - Account registration is disabled on the first run, except for with a new special registration token that is logged - to the console. - - Other helpful information is logged to the console as well, including a giant warning if open registration is - enabled. + - Account registration is disabled on the first run, except for with a new special registration token that is logged to the console. + - Other helpful information is logged to the console as well, including a giant warning if open registration is enabled. - The default index page now says to check the console for setup instructions if no accounts have been created. - Once the first admin account is created, an improved welcome message is sent to the admin room. @@ -241,10 +253,10 @@ ## Bugfixes -- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or - broken invites should clear their client caches after updating to make them appear. ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249)) -- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured. - Contributed by @Jade ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307)) +- Fixed invites sent to other users in the same homeserver not being properly sent down sync. Users with missing or broken invites should clear their client caches after updating to make them appear. + ([#1249](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1249)) +- LDAP-enabled servers will no longer have all admins demoted when LDAP-controlled admins are not configured. Contributed by @Jade + ([#1307](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1307)) - Fixed sliding sync not resolving wildcard state key requests, enabling Video/Audio calls in Element X. ([#1370](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1370)) ## Misc @@ -255,100 +267,78 @@ ## Features -- The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other - misc improvements. Contributed by @Jade ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288)) -- Drastically improved the performance and reliability of account deactivations. Contributed by - @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314)) -- Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets - and improves performance). Contributed by - @nex ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316)) -- Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex - ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301)) +- The announcement checker will now announce errors it encounters in the first run to the admin room, plus a few other misc improvements. Contributed by @Jade + ([#1288](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1288)) +- Drastically improved the performance and reliability of account deactivations. Contributed by @nex ([#1314](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1314)) +- Refuse to process requests for and events in rooms that we no longer have any local users in (reduces state resets and improves performance). Contributed by @nex + ([#1316](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1316)) +- Added server-specific admin API routes to ban and unban rooms, for use with moderation bots. Contributed by @nex ([#1301](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1301)) ## Bugfixes -- Fix the generated configuration containing uncommented optional sections. Contributed by - @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290)) -- Fixed specification non-compliance when handling remote media errors. Contributed by - @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298)) -- UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in - the logs. Contributed by @ginger ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305)) -- Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`. - Contributed - by @aprilgrimoire. ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340)) -- Fixed backtraces being swallowed during panics. Contributed by - @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337)) -- Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join - and knock process. Contributed by @nex, reported by violet & [mat](https://matdoes.dev). -- Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server. - Contributed by @nex, reported by violet & [mat](https://matdoes.dev). +- Fix the generated configuration containing uncommented optional sections. Contributed by @Jade ([#1290](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1290)) +- Fixed specification non-compliance when handling remote media errors. Contributed by @nex ([#1298](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1298)) +- UIAA requests which check for out-of-band success (sent by matrix-js-sdk) will no longer create unhelpful errors in the logs. Contributed by @ginger + ([#1305](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1305)) +- Use exists instead of contains to save writing to a buffer in `src/service/users/mod.rs`: `is_login_disabled`. Contributed by @aprilgrimoire. + ([#1340](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1340)) +- Fixed backtraces being swallowed during panics. Contributed by @jade ([#1337](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1337)) +- Fixed a potential vulnerability that could allow an evil remote server to return malicious events during the room join and knock process. Contributed by @nex, reported by + violet & [mat](https://matdoes.dev). +- Fixed a race condition that could result in outlier PDUs being incorrectly marked as visible to a remote server. Contributed by @nex, reported by violet & [mat](https://matdoes.dev). - ACLs are no longer case-sensitive. Contributed by @nex, reported by [vel](matrix:u/vel:nhjkl.com?action=chat). ## Docs -- Fixed Fedora install instructions. Contributed by - @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342)) +- Fixed Fedora install instructions. Contributed by @julian45 ([#1342](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1342)) # Continuwuity 0.5.3 (2026-01-12) ## Features -- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by - @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279)) +- Improve the display of nested configuration with the `!admin server show-config` command. Contributed by @Jade ([#1279](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1279)) ## Bugfixes -- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by - @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286)) +- Fixed `M_BAD_JSON` error when sending invites to other servers or when providing joins. Contributed by @nex ([#1286](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1286)) ## Docs -- Improve admin command documentation generation. Contributed by - @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280)) +- Improve admin command documentation generation. Contributed by @ginger ([#1280](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1280)) ## Misc -- Improve timeout-related code for federation and URL previews. Contributed by - @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278)) +- Improve timeout-related code for federation and URL previews. Contributed by @Jade ([#1278](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1278)) # Continuwuity 0.5.2 (2026-01-09) ## Features -- Added support for issuing additional registration tokens, stored in the database, which supplement the existing - registration token hardcoded in the config file. These tokens may optionally expire after a certain number of uses or - after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is - superseded by this feature and **has been removed**. Use the new `!admin token` command family to manage registration - tokens. Contributed by @ginger (#783). -- Implemented a configuration defined admin list independent of the admin room. Contributed by - @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253)) -- Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam. - Contributed by @nex. ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263)) -- Implemented account locking functionality, to complement user suspension. Contributed by - @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266)) -- Added admin command to forcefully log out all of a user's existing sessions. Contributed by - @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271)) +- Added support for issuing additional registration tokens, stored in the database, which supplement the existing registration token hardcoded in the config file. These tokens may optionally expire + after a certain number of uses or after a certain amount of time has passed. Additionally, the `registration_token_file` configuration option is superseded by this feature and **has been removed**. + Use the new `!admin token` command family to manage registration tokens. Contributed by @ginger (#783). +- Implemented a configuration defined admin list independent of the admin room. Contributed by @Terryiscool160. ([#1253](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1253)) +- Added support for invite and join anti-spam via Draupnir and Meowlnir, similar to that of synapse-http-antispam. Contributed by @nex. + ([#1263](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1263)) +- Implemented account locking functionality, to complement user suspension. Contributed by @nex. ([#1266](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1266)) +- Added admin command to forcefully log out all of a user's existing sessions. Contributed by @nex. ([#1271](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1271)) - Implemented toggling the ability for an account to log in without mutating any of its data. Contributed by @nex. ( [#1272](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1272)) -- Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs. - Contributed by @nex. ([#1277](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1277)) -- Certain potentially dangerous admin commands are now restricted to only be usable in the admin room and server - console. Contributed by @ginger. +- Add support for custom room create event timestamps, to allow generating custom prefixes in hashed room IDs. Contributed by @nex. + ([#1277](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1277)) +- Certain potentially dangerous admin commands are now restricted to only be usable in the admin room and server console. Contributed by @ginger. ## Bugfixes -- Fixed unreliable room summary fetching and improved error messages. Contributed by - @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257)) -- Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now - also concurrent. Contributed by @nex. ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261)) -- Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by - @nex. ([#1276](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1276)) +- Fixed unreliable room summary fetching and improved error messages. Contributed by @nex. ([#1257](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1257)) +- Client requested timeout parameter is now applied to e2ee key lookups and claims. Related federation requests are now also concurrent. Contributed by @nex. + ([#1261](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1261)) +- Fixed the whoami endpoint returning HTTP 404 instead of HTTP 403, which confused some appservices. Contributed by @nex. ([#1276](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1276)) ## Misc -- The `console` feature is now enabled by default, allowing the server console to be used for running admin commands - directly. To automatically open the console on startup, set the `admin_console_automatic` config option to `true`. - Contributed by @ginger. +- The `console` feature is now enabled by default, allowing the server console to be used for running admin commands directly. To automatically open the console on startup, set the + `admin_console_automatic` config option to `true`. Contributed by @ginger. - We now (finally) document our container image mirrors. Contributed by @Jade # Continuwuity 0.5.0 (2025-12-30) @@ -357,12 +347,9 @@ ## Features -- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. ( - @Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251)) +- Enabled the OTLP exporter in default builds, and allow configuring the exporter protocol. (@Jade). ([#1251](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1251)) ## Bug Fixes -- Don't allow admin room upgrades, as this can break the admin room ( - @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245)) -- Fix invalid creators in power levels during upgrade to v12 ( - @timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245)) +- Don't allow admin room upgrades, as this can break the admin room (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245)) +- Fix invalid creators in power levels during upgrade to v12 (@timedout) ([#1245](https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1245)) diff --git a/changelog.d/sec10.bugfix.md b/changelog.d/sec10.bugfix.md deleted file mode 100644 index a14ef4128..000000000 --- a/changelog.d/sec10.bugfix.md +++ /dev/null @@ -1 +0,0 @@ -**TODO - embargoed until next release** (maintainers see security issue 10 when writing rls notes). Contributed by @eleboucher.