0.1.0-alpha.3 (2026-06-08)
⚠ BREAKING CHANGES
- graphql: consolidate list field shapes (#770)
Features
- add compact encrypted data envelopes (#704) (4c6b7b6)
- add ES rollout observability (#709) (2c0cb34)
- add explicit room thread creation events (#722) (2de3459)
- add server-admin system diagnostics (#720) (64e23f0)
- add server-side cookie sessions (#732) (3a0b224)
- add shreddable message body events (#729) (ea05797)
- audit auth token workflows (#697) (fce12a4)
- auth: use OTP codes for email verification (#771) (0bf1905)
- frontend: polish service worker shell caching (#773) (b842901)
- graphql: clean up schema hygiene (#724) (f68ae54)
- harden encryption key storage (#710) (0bf76e7)
- move presence and calls to memory cache (#702) (c98aacf)
- store link preview cache in runtime state (#708) (d5832c4)
Bug Fixes
- add GraphQL length validation (#751) (715a3b4)
- add HTTP server timeout hardening (#723) (880628e)
- add report-only CSP header (#728) (74e6200)
- auth: revoke credentials after password changes (#752) (e1adcbd)
- autofocus login identifier field (#727) (f349bba)
- clamp room event query limits (#735) (75bf8e0)
- clean up cached asset derivatives on deletion (#766) (f7a6d04)
- core: consolidate NATS asset storage (#768) (1eaca2b)
- disable video uploads when processing is off (#695) (4a31d1a)
- enforce core string length limits (#741) (3c64b17)
- frontend: disable composer submit while attachments stage (#711) (fdb1831)
- frontend: keep failed server icons visible (#772) (7b974d6)
- graphql: widen event log total count (#760) (79ebf41)
- harden OIDC avatar fetching (#739) (7b82ad7)
- hide echoes on direct retraction (#701) (035601b)
- limit GraphQL JSON request body size (#740) (8cae516)
- make message ES importer non-atomic (#733) (651780b)
- paginate unbounded GraphQL list fields (#726) (1e7d5e8)
- require mandatory SMTP TLS by default (#725) (ecad9c5)