0xchat-app/0xchat-app-main v1.5.6-release

v1.5.6 release

on GitHub

Verify your download

Every asset below is listed in SHA256SUMS. Download it next to them and run:

sha256sum -c SHA256SUMS      # macOS: shasum -a 256 -c SHA256SUMS

Windows PowerShell has no -c equivalent; compare a single file with
Get-FileHash -Algorithm SHA256 <file>.

21b1042105d9a757328ba8e55c4e228cd32995a30bbe4c3e92722399c482c74a  oxchat-1.5.6-linux-x64.tar.gz
fe5adc5a3743c5eb6b7b912e58eee7d29bd23ff9c6f2b9bc3d40e6d4e64e8869  oxchat-1.5.6-macos.zip
c1d05e334501f76ecbc0b796941f91cc3f581c08a7d77e6512965af9cc050f24  oxchat-1.5.6-windows-x64-setup.exe
b7b49a41606fa26af8508ca12af7b00fa1ae151d8d185b3851292c3b20c3323e  oxchat-1.5.6-windows-x64.zip
e9c1f2c474115bf71df0c10352c72668aae5489370c43bd0fe5d27c2e1bc1cf3  oxchat-play-signed-109.apk

What's Changed

• [fix] Add 'Disabled' sound option & clean up .gitmodules (#66)
• fix: block HTTP/WS connections when Tor proxy is configured but not r… (#67)
• fix: block system-proxy leak and validate TLS certs for non-onion hosts (#69)
• ci: package Android and desktop builds, and fix what blocked them (#71)
• fix: stop the app aborting at launch without an audio backend (#82)
• fix: correct the SOCKS proxy address type (#75)
• fix: stop a failed account login from wiping the logged in account (#74)
• fix: stop notifying the user about their own messages (#77)
• ci: publish to Play and fetch back the Play-signed APK (#83)
• ci: publish SHA-256 checksums with every release asset (#79)
• ci: build the Windows installer from source (#80)
• chore: drop the dead flutter_sound package, and fix the macOS build (#78)
• chore: finish the monorepo consolidation (#81)
• fix: stop re-initiating the NIP-55 signer connection on every app start (#76)
• fix: install libunwind-dev so the Linux job can resolve gstreamer (#84)
• ci: cache Gradle and pub so builds stop starting from cold (#85)
• ci: ship the Play-signed APK in the release, not one built here (#86)
• fix(ci): give Windows a native PUB_CACHE path so pub can resolve git deps (#88)
• chore: bump to 1.5.6+109 for the next release (#90)
• fix: security fixes for Cashu P2PK oracle, gift-wrap forgery, config redirect, WebView signing (#92)

Also in this release

These changes went into main directly rather than through pull requests, so they are not in the list above.

Security & privacy

• Release builds no longer write logs to the device console. Some log lines could include upload credentials, purchase receipts, the Cashu database password and freshly created ecash tokens.
• Framework errors are reported again, and the opt-in developer log (the one you can send from Settings) records errors again.

Reliability

• Failed zap, ecash and text sends now show an error instead of failing silently. A text message that fails to send stays in the input box, and sharing a Cashu token from the wallet stays on the page so the token can be copied again.
• Relay reconnects back off (from 3 s up to 5 min) instead of retrying every 3 s forever, and duplicate reconnect loops are gone.
• Subscriptions no longer get stuck after a relay reconnects, and requests sent while a relay is still connecting are delivered once it is up.
• Switching accounts no longer piles up relay listeners that re-subscribed everything several times.
• Wallet: unexpected swap errors are shown, and a failed mint lookup no longer blocks that mint until the app restarts.
• Screens no longer keep text fields, animations and listeners alive after they are closed, and closing the ecash dialog during a redeem no longer disturbs the page underneath.

Performance

• Faster start: auto-login now runs while the launch animation plays, with the key decryption off the UI thread.
• Smoother chats: the message list no longer rebuilds on every keyboard animation frame or on unrelated updates, and the chat list keeps its rows when sessions update.
• Less data and battery: video messages no longer re-fetch the video when scrolled back into view, avatars get their own cache, and the start-up profile sync is batched.
• Less work at start-up and on resume: the event cache loads only ids, database lookups use their indexes, and returning to the foreground no longer spawns extra background isolates.
• Large uploads are hashed off the UI thread.

Size

• About 6 MB smaller: oversized images were resized and unused fonts removed. The unused just_audio plugin is no longer bundled.

Full Changelog: v1.5.5-release...v1.5.6-release