User changelog

This release mainly brings improvements in five areas:

• improved privacy protection
• optimized and fixed networking layer
• support for website authors
• better user experience
• clean ups and code purges

Privacy

The privacy improvements are reduced pings and DNS lookups. These make
it less likely that a node gets detected by pings it sends for other
nodes that use DNS addresses to have permanent addresses. Also thanks
to Torusrxxx SSL support is updated and when setting up a node for
access via SSL, unencrypted HTTP links now get upgraded to secured
HTTPS automatically.

Networking

The networking layer got a fix for very fast nodes. On these the bulk
queue could be starved when realtime requests were received faster
than they could be completed. Also bertm fixed bulk backoff getting
ignored.

Juiceman removed unnecessary boxing and unboxing to reduce CPU load
and Torusrxxx improved IPv6 handling.

Website

Torusrxxx also added webp support to the content sanitation (filters),
so you can now use webp images on freesites and depending on the study
reduce the storage by around 30%. Minimizing storage is more critical
on Hyphanet compared to the clearnet, so webp can improve performance
for all sites.

In addition to webp, Torusrxxx also added support for more CSS
keywords: border-{top,bottom}-{left,right}-radius, color-scheme,
dominant-baseline, margin-block, margin-block-end, margin-block-start,
margin-bottom, margin-inline, margin-inline-end, margin-inline-start,
margin-right, math-style, padding-block, padding-block-end,
padding-block-start, padding-inline, padding-inline-end,
padding-inline-start, padding-right, padding-right, padding-top,
padding-top, scroll-behavior, scroll-snap-align, scroll-snap-stop,
scroll-snap-type, text-combine-upright, text-decoration-thickness,
text-orientation, text-underline-offset.

And font settings: monospace, system-ui, ui-serif, ui-sans-serif,
ui-monospace, ui-rounded, emoji, math, fangsong. Color keywords are
now checked case insensitively.

Ban link as well as visited (these can cause requests depending on
interaction), replace with any-link. Also add more CSS selectors:
default, disabled, empty, enabled, focus-visible, indeterminate,
in-range, invalid, only-child, only-of-type, optional, out-of-range,
placeholder-shown, read-only, read-write, required, root. The
combination of :root and color-scheme enables settings for
dark-mode. The MIME types image/avif, heic, and heif are now known
(but have no validation).

Also the :checked selector is now supported, so freesites can have
some CSS-based interactivity.

There’s one loss: Chrome removed Theora support in 2024 and Firefox
followed suit in version 130 (which broke brasilian banking OTPs ).
Firefox ESR (128) will still get support until may 27th 2025. Until
then we need sanitation for modern video formats like vp8 or vp9 and
webm to keep our video on demand (streaming) working.

User experience

There are two improvements of the interface itself: Qupo1 updated the
Japanese localization and bertm polished the bookmark editor and
directory listing in the Winterfacey theme.

And thanks to Bombe the Freemail plugin now has a settings page for
the SMTP and IMAP address and port to use.

The defunct new load management statistics are now gone — thanks to
Torusrxxx. These were just distracting.

When you change the auto-updater key, updates are now checked
instantly, not only after update (for example to get updates via a
testing key for checking an update before release).

And a bug was fixed that could lead to plugins being killed early
during shutdown.

Cleanups

Thanks to qupo1, Christophe, and Bombe, our gradle setup is more up to
date and cleaner.

And thanks to Bombe, Bertm, Venfernand, and Juiceman we purged a lot
of outdated code that is no longer needed on modern JVMs (the code
base once had to work with Java 1) or replaced it with more recent
paradigms. Those make it quite a bit more enjoyable to work with the
affected parts of the code.

Finally qupo1 fixed links and code badges in our readme and Bertm made
sure that our IPv6 preference setting keeps working in Java 24 and
later.

Technical changelog

Privacy and Security

• Reduce pings and DNS lookups — thanks to bertm for the careful review!
• Improve SSL: Fix SSL self-signed certificate, update cipher suite, Add HSTS header setting to upgrade FMS links to HTTPS — thanks to Torusrxxx!

Networking layer and Optimization

• Fix bulk backoff being ignored — thanks to bertm!
• Only prefer the realtime queue to bulk with 90% probability to avoid starving bulk on very fast nodes
• Avoid unnecessary boxing and unboxing — thanks to Juiceman!
• Improve IPv6 handling, thanks to Torusrxxx!

Expanded website support

• Add webp filter, so you can use webp on sites, thanks to Torusrxxx!
• Add many CSS options — thanks to Torusrxxx!
• recognize MIME types image/avif, heic, heif (no filters yet) — thanks to Torusrxxx!
• Do not recommend disabling js helpers in fproxy (these are reviewed, so they can be used)

User Experience

• Update Japanese localization, thanks to qupo1!
• Fix bookmark editor indentation on Winterfacey theme and improve directory listing layout — thanks to bertm!
• Hide no longer relevant new load management statistics, thanks to Torusrxxx!
• Ensure that the updater searches for updates from an updated update key without restart.
• Add more resilient plugin list exception handling to avoid problems on shutdown

Development support

• Update Gradle wrapper validation to latest version — thanks to qupo1!
• Update Gradle to 8.11 thanks to Christophe!
• Fix build info with gradle daemon, thanks to Bombe!
• Avoid duplicate files in jar file and and add checks — thanks to Bombe!
• Fix update.sh version in dependencies.properties (no longer pull in an older version with auto-update)

Cleanup and refresh code

• Kill no longer useful MemoryChecker with 🔥 — thanks to Bombe and bertm for the reviews!
• Remove SHA-256 special case in PluginManager — thanks to bertm!
• Improve MultiValueTable — thanks to venfernand!
• do not check for long gone JVM bugs — thanks to bertm!
• do not intern byte arrays — thanks to bertm!
• reduce stream handling duplication in FileUtil — thanks to bertm!
• replace Logger.OSThread-based PID logging that was always disabled by NOOP — thanks to bertm!
• Remove code related to NLM load sending — thanks to bertm!
• Remove unused but dangerous Logger.fatal(...) method — thanks to bertm!
• Remove gc meddling that hasn’t been necessary for many Java releases
• replace length = 0 checks with isEmpty() — thanks to Juiceman!

Misc

• Simplify peers parsing code
• Fix readme links and code badges — thanks to qupo1!
• Support IPV6_ADDR_PREFERENCES until Java 24 and beyond (move from reflection to unsafe) — thanks to bertm!
• Add copy of the cryptics general license (2-clause BSD)

Plugins

• Freemail plugin: add settings page, thanks to Bombe!