zulip/zulip 4.0

Zulip Server 4.0

on GitHub

4.0 -- 2021-05-13

Highlights

• Code blocks now have a copy-to-clipboard button and can be
  integrated with external code playgrounds, making it convenient to
  work with code while discussing it in Zulip.
• Added a new organization Moderator role.
  Many permissions settings for sensitive features now support only
  allowing moderators and above to use the feature.
• Added a native Giphy integration for sending animated GIFs.
• Added support for muting another user.
• Recent topics is no longer beta, no longer an overlay, supports
  composing messages, and is now the default view. The previous
  default view, "All messages", is still available, and the default
  view can now be configured via "Display settings".
• Completed API documentation for Zulip's real-time events system. It
  is now possible to write a decent Zulip client with minimal
  interaction with the Zulip server development team.
• Added new organization settings: wildcard mention policy.
• Integrated Smokescreen, an outgoing proxy designed to
  help protect against SSRF attacks; outgoing HTTP requests that can
  be triggered by end users are routed through this service.
  We recommend that self-hosted installations configure it.
• This release contains more than 30 independent changes to the Zulip
  API, largely to support new
  features or make the API (and thus its documentation) clearer and
  easier for clients to implement. Other new API features support
  better error handling for the mobile and terminal apps.
• The frontend internationalization library was switched from i18next
  to FormatJS.
• The button for replying was redesigned to show the reply recipient
  and be more obvious to users coming from other chat apps.
• Added support for moving topics to private streams, and for configuring
  which roles can move topics between streams.

Upgrade notes for 4.0

• Changed the Tornado service to use 127.0.0.1:9800 instead of
  127.0.0.1:9993 as its default network address, to simplify support
  for multiple Tornado processes. Since Tornado only listens on
  localhost, this change should have no visible effect unless another
  service is using port 9800.
• Zulip's top-level puppet classes have been renamed, largely from
  zulip::foo to zulip::profile::foo. Configuration referencing
  these /etc/zulip/zulip.conf will be automatically updated during
  the upgrade process, but if you have a complex deployment or you
  maintain zulip.conf is another system (E.g. with the manual
  configuration option for
  docker-zulip), you'll want to manually update the
  puppet_classes variable.
• Zulip's supervisord configuration now lives in /etc/supervisor/conf.d/zulip/
• Consider enabling Smokescreen
• Private streams can no longer be default streams (i.e. the ones new
  users are automatically added to).
• New scripts/start-server and scripts/stop-server mean that
  one no longer needs to use supervisorctl directly for these tasks.
• As this is a major release, we recommend carefully updating the
  inline documentation in your
  /etc/zulip/settings.py. Notably, we rewrote the
  template to be better organized and more readable in this release.
• The webapp will now display a warning in the UI if the Zulip server
  has not been upgraded in more than 18 months.
  template to be better organized and more readable.
• The next time users log in to Zulip with their password after
  upgrading to this release, they will be logged out of all active
  browser sessions (i.e. the web and desktop apps). This is a side
  effect of improved security settings (increasing the minimum entropy
  used when salting passwords from 71 bits to 128 bits).
• We've removed the partial Thumbor integration from Zulip. The
  Thumbor project appears to be dead upstream, and we no longer feel
  comfortable including it in Zulip from a security perspective. We
  hope to introduce a fully supported thumbnailing integration in our next
  major release.

Full feature changelog

• Added new release lifecycle documentation.
• Added support for subscribing another stream's membership to a stream.
• Added RealmAuditLog for most settings state changes in Zulip; this
  data will fascilitate future features showing a log of activity by
  a given user or changes to an organization's settings.
• Added support for using Sentry for processing backend exceptions.
• Added documentation for using wal-g for continuous PostgreSQL backups.
• Added loading spinners for message editing widgets.
• Added live update of compose placeholder text when recipients change.
• Added keyboard navigation for popover menus that were missing it.
• Added documentation for all zulip.conf settings.
• Added dozens of new notification sound options.
• Added menu option to unstar all messages in a topic.
• Added confirmation dialog before unsubscribing from a private stream.
• Added confirmation dialog before deleting your profile picture.
• Added types for all parameters in the API documentation.
• Added API endpoint to fetch user details by email address.
• Added API endpoint to fetch presence details by user ID.
• Added new LDAP configuration options for servers hosting multiple organizations.
• Added new @**|user_id** mention syntax intended for use in bots.
• Added preliminary support for Zulip on Debian Bullseye; this
  release is expected to support Bullseye without any further changes.
• Added several useful new management commands, including
  change_realm_subdomain and delete_user.
• Added support for subscribing all members of a user group to a stream.
• Added support for sms: and tel: links.
• Community topic editing time limit increased to 3 days for members.
• New integrations: Freshping, JotForm, Uptime Robot, and a JSON
  formatter (which is particularly useful when developing a new
  integration).
• Updated integrations: ClubHouse, NewRelic, Bitbucket, Zabbix.
• Improved formatting of GitHub and GitLab integrations.
• Improved the user experience for multi-user invitations.
• Improved several rendered-message styling details.
• Improved design of <time> widgets.
• Improved format of nginx logs to include hostname and request time.
• Redesigned the left sidebar menu icons (now \vdots, not a chevron).
• The Zoom integration is now stable (no longer beta).
• Favicon unread counts are more attractive and support large numbers.
• Zulip now displays the total number of starred messages in the left
  sidebar by default; over 20% of users had enabled this setting manually.
• Presence circles for users are now shown in mention typeahead.
• Email notifications for new messages are now referred to as a
  "Message notification email", not a "Missed message email".
• Zulip now sets List-Unsubscribe headers in outgoing emails with
  unsubscribe links.
• Password forms now have a "Show password" widget.
• Fixed performance issues when creating hundreds of new users in
  quick succession (E.g. at the start of a conference or event).
• Fixed performance issues in organizations with thousands of online users.
• Fixed numerous rare exceptions when running Zulip at scale.
• Fixed several subtle installer bugs.
• Fixed various UI and accessibility issues in the registration and new
  user invitation flows.
• Fixed live update and UI bugs with streams being deactivated or renamed.
• Fixed a subtle Firefox bug with Esc breaking keyboard accessibility.
• Fixed name not being populated currently with Apple authentication.
• Fixed several subtle bugs in the "Stream settings" UI.
• Fixed error handling for incoming emails that fail to send.
• Fixed a subtle bug with timestamps for messages that take a long
  time to send.
• Fixed missing horizontal scrollbar for overflowing rendered LaTeX.
• Fixed visual issues with bottoms areas of both sidebars.
• Fixed several error handling bugs with outgoing webhooks.
• Fixed bugs with recipient bar UI for muting and topic editing.
• Fixed highlighting of adjacent alert words.
• Fixed many settings API endpoints with unusual string encoding.
• Fixed wildcard mentions in blockquotes not being treated as silent.
• Increased size of typeahead box for mentions from 5 to 8.
• Typeahead now always ranks exact string matches first.
• Tooltips have been migrated from Bootstrap to TippyJS, and added
  in many places that previously just had title attributes.
• Zulip now consistently uses the Source Code Pro font for code
  blocks, rather than varying by operating system.
• Redesigned "Alert words" settings UI.
• Linkifiers can now be edited in their settings page.
• Tables in settings UI now have sticky headers.
• Confirmation dialogs now consistently use Confirm/Cancel as button labels.
• Refactored typeahead and emoji components to be shareable with the
  mobile codebase.
• Switched to orjson for JSON serialization, resulting in better
  performance and more standards-compliant validation.
• Outgoing webhooks now enforce a 10 second timeout.
• Image previews in a Zulip message are now unconditionally proxied by
  Camo to improve privacy, rather than only when the URL was not HTTPS.
• Replaced the old CasperJS frontend test suite with Puppeteer.
• Split the previous api_super_user permission into
  can_create_user and can_forge_sender (used for mirroring).
• Various API endpoints creating objects now return the ID of the
  created object.
• Fixed screenreader accessibility of many components, including
  the compose box, message editing, popovers, and many more.
• Fixed transparency issues uploading some animated GIFs as custom emoji.
• Improved positioning logic for inline YouTube previews.
• Improved performance of several high-throughput queue processors.
• Improved performance of queries that fetch all active subscribers to
  a stream or set of streams.
• Improved performance of sending messages to streams with thousands
  of subscribers.
• Upgraded our ancient forked version of bootstrap, on a path towards
  removing the last forked dependencies from the codebase.
• Upgraded Django to 3.1 (as well as essentially every other dependency).
• Updated webapp codebase to use many modern ES6 patterns.
• Upgraded Zulip's core font to Source Sans 3, which supports more languages.
• Relabeled 😄 and 😛 emoji to use better codepoints.
• Reduced the size of Zulip's main JavaScript bundle by removing moment.js.
• Server logs now display the version number for Zulip clients.
• Simplified logic for responsive UI with different browser sizes.
• Fixed several subtle bugs in the compose and message-edit UIs.
• Reduced the steady-state load for an idle Zulip server.
• Removed HipChat import tool, because HipChat has been long EOL.
• Reformatted the Python codebase with Black, and the frontend
  codebase with Prettier.
• Migrated testing from CircleCI to GitHub Actions.