Release Notes - v0.9.5-alpha

A release that adds a new cloud transcription provider, in-app video capture, and recording filters, alongside a round of security and reliability hardening. It is backwards compatible with the v0.9.x line, and all database changes run automatically on startup.

New Features

• AssemblyAI transcription connector (Discussion #96). AssemblyAI is now a built-in provider. Set TRANSCRIPTION_CONNECTOR=assemblyai and TRANSCRIPTION_API_KEY, and Speakr runs AssemblyAI's own upload-and-poll flow, diarizes through speaker labels, and handles long files in a single job (up to ten hours, no chunking). Hotwords map to word boosting and minimum/maximum speaker hints to the speaker options. The connector uses its own ASSEMBLYAI_BASE_URL and ASSEMBLYAI_SPEECH_MODEL settings so a shared TRANSCRIPTION_BASE_URL or model from another provider can no longer leak into it. New accounts receive free credits with no card required. See the installation guide for setup.

• Tab, window, and screen video capture (Discussion #303). When the server has VIDEO_RETENTION=true, the System Audio and Mic + System recording modes gain an optional "Also record video" toggle that keeps the shared surface as a video recording alongside the audio. A live preview shows while recording, the result is stored as a video file, and it plays back through the same docked video player used for uploaded video files. Transcription still uses only the audio track. Long captures run through the server-side recording-session pipeline, and the video bitrate is capped by RECORDING_VIDEO_KBPS (default 2500 kbps) so an hour of capture stays near a gigabyte.

• Recording filters: Needs Transcription, Needs Summary, Needs Speakers (#317). The sidebar filter panel gains three toggles that surface recordings still missing a transcript, a summary, or speaker identification, including recordings whose transcription or summary failed. Contributed by @fxfitz.

Improvements

• Reliable pre-upload review for recordings. After stopping an in-app recording, the review player now reports the correct length and allows seeking for both audio and video. Raw browser recordings carry no duration metadata, which previously left the timeline at zero; Speakr now normalizes it before you review or upload.

• Recorder Upload Settings are applied on server-streamed recordings. Tags chosen in the recording view's Upload Settings panel, and the transcription defaults those tags or the target folder imply, are now attached when the recording is finalized. Previously they could be dropped on the server-side recording path.

• Long recordings are no longer rate limited. The server-side recording-session endpoints, which stream one chunk every few seconds and are the recommended path for multi-hour sessions, are now exempt from the global request rate limit, so a long recording can no longer be throttled partway through.

Bug Fixes

• Invalid date and missing voice samples on the speaker page (#319). The speaker endpoint returned raw datetime values the frontend could not parse, showing "Invalid Date"; it now serializes them correctly. Voice sample previews were only generated from the ten most recent recordings, so a speaker whose recordings were older showed a sample count with nothing to play. The lookup now searches the recordings where the speaker actually appears.

• Meeting date shifting on each edit (#320). The date picker and the date display used different timezone conventions, so editing a meeting date shifted it by the timezone offset every time. Meeting dates now follow one convention end to end (stored as UTC, rendered in the viewer's timezone): the picker opens at the time shown on the recording, and applying without changes leaves it unchanged. Existing dates render as before, and a date that drifted through earlier edits can be corrected once and will hold.

Security and Reliability

• Authentication rate limits are now enforced. The per-endpoint limits on login, registration, and password reset were previously inert; they now apply, reducing brute-force and password-spray exposure. Rate limiting can be turned off with RATELIMIT_ENABLED=false for deployments that rate limit at a reverse proxy.

• Bulk inbox/highlight toggle is access-checked. The bulk toggle endpoint now verifies access to each recording, closing a cross-user recording-id oracle and preventing per-user status rows from being created against recordings a caller cannot see.

• Webhook delivery re-validates its target. A webhook URL is now checked against its resolved address at delivery time, not only at creation, blocking a DNS-rebinding path to internal or loopback addresses.

• Media processing cannot hang a worker. All FFmpeg and ffprobe invocations are now bounded by a timeout (FFMPEG_TIMEOUT_SECONDS, default one hour), so a malformed or adversarial file can no longer stall a processing worker indefinitely.

• Temporary files are cleaned up on every path. Audio extracted from video and format-converted audio are now removed on both success and failure, including in incognito mode, where derived files were previously left behind.

• Completed recordings are protected from post-processing errors. A failure in an after-completion step such as auto-share or auto-export can no longer overwrite a finished recording's summary or mark it failed.

• Recording resource cleanup. The recording audio context and any screen-share stream are now released on stop, discard, and error, so repeated record-and-stop cycles no longer exhaust the browser's audio context pool.

Compatibility

Backwards compatible with the v0.9.x line. Database migrations run automatically on startup. No configuration changes are required; the new ASSEMBLYAI_*, RECORDING_VIDEO_KBPS, FFMPEG_TIMEOUT_SECONDS, and RATELIMIT_ENABLED settings are all optional with safe defaults.