0.5.0-alpha.1 (2026-08-29)
⚠ BREAKING CHANGES
- authz: flatten interaction read permission (#2175)
- proto: separate internal storage contracts (#2162)
- proto: relocate live-only user payloads (#2153)
- account-deletion: let admins delete other users (#2134)
- profile: add rich user profiles and local time (#2149)
- auth: keep active users signed in (#2102)
- api: prevent bots from starting DMs (#2113)
- rbac: require message.read for channel content (#2100)
- auth: add renewable bearer sessions (#2092)
- auth: remove legacy cookie sessions (#2087)
- push: support remote-server web push (#2055)
- notifications: replace Notifications 1.0 with persistent notifications (#2061)
- notifications: replace Notifications 1.0 with persistent notifications (#2020)
- auth: require CIMD clients for remote access (#2013)
- search: rank cross-server Cmd-K results (#1862)
- cli: remove passphrase argument flags (#1705)
- metrics: retire legacy service inventory (#1703)
- video: add seekable HLS playback (#1624)
- realtime: add resumable server projection stream (#1588)
Features
- account-deletion: let admins delete other users (#2134) (37c9d89)
- add native social post previews (#1569) (3a1a72f)
- admin: expose asset cleanup health (#1401) (66d7de3)
- admin: report durable worker health (#1979) (cb697c9)
- api: add client-server compatibility discovery (#1586) (13e5318)
- api: support GET server discovery (#1396) (cf1a373)
- appconfig: extract shared configuration loading (#1856) (732d7b2)
- auth: add CIMD-enabled development stack (#1881) (5e0f471)
- auth: add renewable bearer sessions (#2092) (af87cc1)
- auth: add server invite links (#1983) (ce6b525)
- auth: allow operators to disable password login (#2042) (1df8f3e)
- auth: identify OAuth clients through CIMD (#2012) (8ac44de)
- auth: manage member-authorized OAuth clients (#2014) (2e6f1d0)
- auth: require CIMD clients for remote access (#2013) (792f9bb)
- auth: transfer Authling profiles to Chatto (#2076) (c91cac7)
- authz: add interaction-scoped message reads (#2114) (06396c1)
- bots: activate bots through notifications (#2127) (71b4577)
- bots: add baseline bot accounts (#2060) (3a66bcd)
- bots: add multiple incoming webhooks (#2137) (80a1126)
- bots: support owner reassignment (#2085) (d8d3dd9)
- calls: show lifecycle events in room timelines (#2032) (033130d)
- core: accelerate projection startup with encrypted snapshots (#1549) (0a1417d)
- core: add encrypted projection snapshot canary (#1488) (835737e)
- core: bound projection snapshot cleanup (#1538) (3e332d3)
- datacrypto: extract shared encryption primitives (#1853) (4235d7c)
- desktop: adapt game streams with simulcast (#2028) (dda3eb7)
- desktop: add experimental Deno CEF app (#1893) (ab25ca8)
- desktop: replace Deno Desktop with Electron (#1939) (362204f)
- desktop: sign and notarise macOS releases (#2048) (a0b4c0e)
- desktop: sign Windows releases (#2050) (6f0c875)
- desktop: stream macOS games through LiveKit (#2024) (ff3842b)
- desktop: unify native and browser screen sharing (#2034) (59aee59)
- dev: add bind-mounted Compose watch stack (#2038) (ab945c9)
- dev: add compiled Conductor run task (#1696) (6c3b83b)
- dev: replace Compose stack with Pitchfork (#2047) (41f4424)
- docs: publish stable and development channels (#1490) (67e15b1)
- email: add JMAP delivery transport (#1443) (49a090d)
- events: add durable pull-worker execution (#1972) (8777064)
- events: add selectable mutation consistency boundaries (#1962) (3db6575)
- events: extract shared framework module (#1833) (3195ffd)
- frontend: add Arabic and Hebrew translations (#1929) (3ca9bc4)
- frontend: add Chatto laser clicker easter egg (#1605) (8b5119d)
- frontend: add Chinese translations (#1745) (0c3b74b)
- frontend: add composer formatting shortcuts (#2103) (d7e36ad)
- frontend: add context menus for visible rooms (#1637) (9dbb684)
- frontend: add context-menu copy actions (#2090) (7cc495d)
- frontend: add inline message timestamps (#1558) (70fe404)
- frontend: add regional English locales (#1532) (adea7d1)
- frontend: add responsive resizable thread pane (#1927) (76e4757)
- frontend: add room group context menu (#1672) (942d117)
- frontend: add room-scoped message search (#1863) (0848a50)
- frontend: add server and room context menus (#1580) (fea2d34)
- frontend: add six language translations (#1908) (1787ded)
- frontend: add visual and Markdown composers (#2078) (fc7b4be)
- frontend: adopt TanStack Query for snapshot reads (#1870) (c747f83)
- frontend: animate segmented control selection (#1938) (b52e944)
- frontend: animate video processing state (#1718) (ba68708)
- frontend: authenticate remote servers in a popup (#1560) (8d5354c)
- frontend: consolidate app preferences into settings (#2126) (772e0f2)
- frontend: copy message text from action menus (#1598) (4e91f4e)
- frontend: debounce server message search (#1867) (81fb048)
- frontend: enforce Content Security Policy (#2143) (2b8a2f8)
- frontend: expand lazy-loaded locale support (#1537) (ffc9470)
- frontend: frame preference forms (#2104) (5b79973)
- frontend: highlight rich composer mode (#1412) (468cf14)
- frontend: improve pinned message presentation (#2016) (2f566ff)
- frontend: keep screen awake during calls (#2054) (98b0d9f)
- frontend: link user menu to server admin (#2147) (a2944f5)
- frontend: open created threads automatically (#2108) (4b909a1)
- frontend: open profiles in direct messages (#2164) (023bab1)
- frontend: polish navigation feedback (#2166) (2707586)
- frontend: prepare client shell for RTL locales (#1910) (06e4e24)
- frontend: refine permissions and scroll UI (#1685) (8a32ee0)
- frontend: refine room and thread dialogs (#2106) (5601b70)
- frontend: refine room group sidebar sections (#2037) (58e9daf)
- frontend: refresh semantic colors and buttons (#2159) (9d611a9)
- frontend: remove implicit auto-away presence (#2136) (2a0f470)
- frontend: render GFM tables (#1612) (c36644b)
- frontend: replace Paraglide with Lingua (#1918) (c55ea79)
- frontend: restructure settings and preferences (#2097) (53599fb)
- frontend: show attachment upload progress (#1689) (d6cb466)
- frontend: show inline message state markers (#2110) (53712e2)
- frontend: show server re-login status (#2105) (5111c2e)
- frontend: show user ID in account settings (#1921) (f189952)
- frontend: smooth sliding pane motion (#1936) (74859a7)
- frontend: submit dialog actions with Enter (#2107) (5f19ecf)
- frontend: suppress previews for angle-bracket links (#2144) (815299b)
- frontend: unify collapsible sidebar sections (#2045) (c8f9ec9)
- frontend: unify interactive control styling (#1708) (135c94e)
- frontend: unify message action menus (#1811) (38fe1cb)
- management: add resource-scoped room administration (#1630) (1647794)
- messages: add pinned channel messages (#1990) (2b3b187)
- natsruntime: extract embedded NATS lifecycle (#1845) (cb24279)
- notifications: add Badge and room-message delivery (#2119) (3dde347)
- notifications: add scoped policy matrix (#2111) (631c1f5)
- notifications: add test push action (#1480) (add1590)
- notifications: replace Notifications 1.0 with persistent notifications (#2020) (29c88d9)
- notifications: replace Notifications 1.0 with persistent notifications (#2061) (1f63f0f)
- profile: add rich user profiles and local time (#2149) (1203310)
- push: support remote-server web push (#2055) (4f7fbfc)
- rbac: require message.read for channel content (#2100) (f340f3b)
- rbac: treat everyone as scoped permission baseline (#1614) (0446d01)
- realtime: add resumable server projection stream (#1588) (a886853)
- rooms: add joinable room previews (#1546) (0e96593)
- rooms: add slow mode (#1980) (fd385b2)
- rooms: allow flexible Unicode names (#1986) (4b5d84c)
- rooms: manage channel room members (#1713) (2125b37)
- rooms: support Unicode room names (#1739) (1d1e850)
- search: add pluggable message search (#1632) (a9e1224)
- search: rank cross-server Cmd-K results (#1862) (73912ad)
- search: support filter-only queries (#1868) (0b14c9a)
- shields: add Shields.io community badges (#1467) (c6b5752)
- threading: add configurable room threading modes (#2091) (cf04c6d)
- threads: let authors create threads with root messages (#1906) (55ace4e)
- video: add durable asset processing workers (#1931) (9d66dc2)
- video: add seekable HLS playback (#1624) (1c07057)
Bug Fixes
- api: batch presence hydration (#1597) (8812cb9)
- api: omit deleted users from room member reads (#1964) (793d41c)
- api: prevent bots from starting DMs (#2113) (50d6d38)
- api: redact password verifiers from audit payloads (#2039) (f1eed9b)
- assets: mark NATS streams as non-seekable (#1607) (96febb8)
- auth: allow configured browser origin aliases (#2123) (6dba2ee)
- auth: keep active users signed in (#2102) (7227c87)
- auth: preserve legacy browser login (#2120) (65f929b)
- calls: share browser tab audio (4f27dd8)
- calls: show active DM calls in sidebar (#1676) (d894882)
- ci: publish desktop releases without checkout (#2033) (45f8a16)
- ci: time out media environment setup (#1486) (6e2373f)
- config: configure API response compression (#1502) (443f26f)
- core: decrypt projected user PII on demand (#1551) (879c39d)
- core: enforce exclusive asset attachments (#2041) (ee40655)
- core: fence message lifecycle mutations (#1925) (5c01511)
- core: forbid threads in direct messages (#1583) (896c74b)
- core: harden CallModel state ownership (#1771) (b698e72)
- core: make user key shredding crash-safe (#1973) (63f014f)
- core: migrate projection snapshot pointer lineage (#1572) (c6ca943)
- core: preserve cleared RBAC defaults (#1543) (be7b4d9)
- core: publish room layout after projection catch-up (#1966) (ccc31f9)
- core: re-authorize message mutations on OCC retries (#1960) (6df5f6e)
- core: recheck message authorization during OCC (#1922) (43219b3)
- core: recover safely after NATS outages (#1891) (2fd9674)
- core: retry link previews across validated IPs (#1577) (1fc1a19)
- desktop: identify bundled frontend builds (#2036) (cb8ebd8)
- desktop: make release verification reliable (#1902) (898eec2)
- desktop: require immutable GitHub OIDC subjects (#2051) (fdb260d)
- dev: bootstrap alice and bob in compose (#1907) (d67b4da)
- dev: build Lingua during workspace setup (#1951) (c23205d)
- dev: clean up archived workspace processes (#2121) (39100e8)
- dev: clean up Compose stack on archive (#1932) (5260dd7)
- dev: isolate Pitchfork workspace services (#2067) (967f0cc)
- dev: keep Conductor tasks in process group (#1699) (483f802)
- dev: release Conductor workspace ports (#1704) (356ca89)
- dev: restore mise chatto command routing (#1707) (8781cbe)
- dm: hide empty conversations until first message (#1635) (56b1916)
- dockercompose: restart services unless stopped (#2052) (0fcd020)
- dockercompose: use muxed LiveKit UDP port (#1503) (4974c63)
- dockercompose: validate init-env arguments (#2023) (f413260)
- docker: use real service health checks (#1761) (58d52d9)
- events: add bounded subject reads (#2002) (1a15202)
- events: require pointer projections (#2000) (4ee0c2b)
- events: validate snapshot bindings (#2001) (d323298)
- forward-port 0.4.9 changes (#1477) (e7119f7)
- frontend: accept all uploadable composer drops (#2066) (8f2821a)
- frontend: add direct thread message routes (#1524) (68bba96)
- frontend: align pane header actions (#2161) (9210ec8)
- frontend: allow app-wide mobile sidebar swipes (#1534) (a78110e)
- frontend: avoid blank line when enabling rich mode (#1548) (09aa9e3)
- frontend: balance room directory card padding (#2173) (aac58c8)
- frontend: cache PWA assets on demand (#1786) (ded8061)
- frontend: collapse invisible markdown spacing (#1539) (d3c8d19)
- frontend: default room sidebar to closed (#1633) (c751eb7)
- frontend: enforce mono voice call audio (#1489) (ae686d4)
- frontend: enforce server description limit (#1587) (17693d7)
- frontend: expire empty attachment tombstones (#1952) (410492c)
- frontend: hide context-free tombstones immediately (#2142) (54aa45e)
- frontend: hide deleted users from membership events (#1504) (65fa9a0)
- frontend: hydrate desktop server statuses on startup (#2029) (ef7375f)
- frontend: improve thread badge interaction (#1935) (3b9d4c7)
- frontend: keep emoji picker open on new messages (#1603) (2042625)
- frontend: keep mobile bottom sheets open on input focus (#1750) (54b8b57)
- frontend: keep permission matrices stable during refresh (#2178) (2329ead)
- frontend: keep realtime active while looking offline (#1606) (7cbbd9b)
- frontend: keep remote sessions live without origin auth (#1877) (55aed52)
- frontend: keep video close button within iOS safe area (#1618) (cf4210a)
- frontend: lazily load room attachments (#1615) (6a5b7e0)
- frontend: log auth/session degradation events with console.warn (#2093) (811e624)
- frontend: move account settings to top (#2125) (02fa2b8)
- frontend: parse pasted markdown in composer (#1714) (c571f70)
- frontend: preserve composer drag selections (#2053) (ededb95)
- frontend: preserve expanded timeline groups (#1483) (599696e)
- frontend: preserve inline ordered-list content (#2010) (27980b2)
- frontend: preserve pasted Markdown links (#1639) (40a496b)
- frontend: preserve pasted message line breaks (#1609) (07eb5c2)
- frontend: preserve unusual video aspect ratios (#1521) (106ab5f)
- frontend: preserve video playback on reactions (#1622) (2b75984)
- frontend: prevent premature attachment URL refreshes (#1920) (034eb49)
- frontend: proxy OAuth token endpoint in development (#2101) (38da936)
- frontend: reduce production build memory (#1912) (1f108cf)
- frontend: restore branded PWA install icons (#1478) (5c915b1)
- frontend: restore neutral server selection (#2170) (769b3de)
- frontend: restore POST server discovery (#1528) (8534ba7)
- frontend: restore subtle design colors (#1545) (659be37)
- frontend: scope thread click-outside dismissal (#1595) (ae5b9f9)
- frontend: separate member sidebar scrolling (#2177) (c41c124)
- frontend: shorten server navigation heading (#2148) (f57af58)
- frontend: show pending permission updates (#1540) (a33a25e)
- frontend: simplify copy ID affordance (#2088) (8d1ba0c)
- frontend: size ordered list markers adaptively (#1911) (862f49c)
- frontend: stabilise composer word wrapping (#1636) (0e7dde0)
- frontend: stabilise sign-in and chat landing states (#2160) (5e46cd3)
- frontend: support remote-only sessions (#1530) (e7b90c3)
- frontend: unify admin panel and table surfaces (#1677) (0289c34)
- frontend: use origin host for message links (#1526) (b4b872c)
- frontend: use server logo for browser icons (#1506) (63c7fde)
- i18n: restore regional locale fallback chains (#1987) (d98ecf7)
- media: stabilize attachment URLs and playback (#1626) (8b8c63b)
- notifications: avoid authorization fence events (#2115) (003f54a)
- presence: handle constant wrong-sequence errors (#1511) (07a87f1)
- push: prevent authenticated SSRF (#2040) (b6aa43c)
- push: prioritize visible notifications (#1928) (548aca2)
- pwa: restore DM-specific dock badges (#1631) (df96e94)
- pwa: simplify app badge synchronization (#1616) (ac17b36)
- pwa: use server name for installed app (#1542) (c574036)
- reactions: cap reactions per user and message (#1919) (79be46c)
- realtime: avoid duplicate viewer state on reset (#1959) (373256f)
- realtime: defer retained timeline hydration (#2109) (80a7a6b)
- realtime: recover after deleting processing videos (#1894) (7db7d9c)
- realtime: refresh active calls after room access (#2031) (1c0ae04)
- release: develop prereleases on main (#1419) (a33d440)
- release: make next prerelease alpha (#1596) (5ad172b)
- security: restrict public server assets (#1499) (2ada7d2)
- threads: reject echoes as thread roots (#1757) (e81f585)
- video: harden HLS playback and transcoding (#1694) (3646898)
- workers: harden durable recovery (#1978) (c1c6f3e)
Performance Improvements
- api: accelerate first-load viewer state (#1756) (4773539)
- build: shrink bundled Chatto binary (#1890) (021254c)
- connect: reuse DEKs across request hydration (#1554) (b5a8249)
- core: accelerate cold projection replay (#1717) (437521d)
- core: defer server member detail hydration (#1977) (41d2a6d)
- frontend: defer custom status editor (#1829) (d7a589f)
- frontend: defer room interaction bundles (#1834) (04f82ee)
- frontend: preserve lazy chunk boundaries (#1820) (cc58883)
- frontend: reduce initial route bundles (#1825) (936162e)
- frontend: skip dev-only production work (#1914) (9e874f8)
- frontend: speed up Paraglide compilation (#1562) (185f306)
- frontend: stabilise room member presence grouping (#1903) (3f6eaab)
- projections: compact timeline body state (#1720) (59b9dd3)
- realtime: centralize myEvents fanout (#1513) (1c46f88)
Code Refactoring
- auth: remove legacy cookie sessions (#2087) (0e30804)
- authz: flatten interaction read permission (#2175) (8f4e86c)
- cli: remove passphrase argument flags (#1705) (bb84c8a)
- metrics: retire legacy service inventory (#1703) (a5c31a7)
- proto: relocate live-only user payloads (#2153) (bb01e27)
- proto: separate internal storage contracts (#2162) (9e935d4)