From cefb2edb558b28ff34339eca97ff17183cecd8af Mon Sep 17 00:00:00 2001 From: timedout Date: Fri, 14 Aug 2026 00:12:40 +0100 Subject: [PATCH] chore: Release v26.8.0-alpha.1 --- CHANGELOG.md | 40 ++++++++++++++++++++++++++++++++++++++++ Cargo.lock | 24 ++++++++++++------------ Cargo.toml | 2 +- 3 files changed, 53 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 19d88edc6..98e6ad47b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,43 @@ +# Continuwuity v26.8.0-alpha.1 (2026-08-14) + +## Features + +- Added MSC4354 sticky events, behind the `allow_sticky_events` config option. Contributed by @eleboucher. +- Added MSC4480 sticky events to simplified sliding sync. Contributed by @eleboucher. +- Added scoped typing updates to simplified Sliding Sync (MSC4508). Contributed by @eleboucher. + +## Bugfixes + +- Fixed a vulnerability that enabled the server to leak certain events over federation. Contributed by @eleboucher. (SEC26) +- Fixed an issue that allowed an attacker to take over another account on the same server under certain conditions. ([GHSA-v2x6-m99h-vqxx](https://github.com/continuwuity/continuwuity/security/advisories/GHSA-v2x6-m99h-vqxx)) Contributed by @gingershaped and reported by GlitchedAxiom. (SEC28) +- Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update. (#2057) +- Resolve membership service by correct name for auto-join. Contributed by @Aranjedeath (#2082) +- Plugged a logic gap that may have been allowing Continuwuity to process events with incorrect room versions under certain conditions. Contributed by @nex. (#2106) +- The OAuth 2.0 device authorization endpoint now rejects clients which did not register the device code grant type, instead of issuing them a device code. The token endpoint now returns the `unauthorized_client` error code when a client requests a grant type it did not register, instead of `invalid_grant`. Contributed by @mmaudet. (#2110) +- Added MSC4186 direct, encrypted, and room-type list filters, resolving invited rooms from their stripped invite state. Contributed by @eleboucher. +- Fixed left/banned rooms sometimes not coming down sync. +- Fixed missed wake-ups and stale responses in legacy and sliding sync long polls. Contributed by @eleboucher. +- Fixed sync loops being woken before membership changes are fully committed. +- Fixed typing notifications not interrupting a sync long poll. Contributed by @eleboucher. +- Preserve all users' read receipts when batching room receipt updates. + +## Improved Documentation + +- Refactor TURN docs and remove unsafe setups. Polish LiveKit docs. Add guidance for TURNS-over-443 multiplexing for both LiveKit and legacy calls. Contributed by @stratself (#1740) +- Updated the docs to reflect the current default User-Agent for URL previews (#2079) +- Added missing documentation to config parameters. Contributed by @renegadespork (#2107) +- Generic deployment documentation: Use `/etc/caddy/Caddyfile` instead of `/etc/caddy/conf.d/*` paths, which do not exist on a majority of Caddy installations. (#2117) +- Add caveat and workaround for container resolution (e.g. for dockerized appservices) when using mounted `/etc/resolv.conf`. Contributed by @stratself +- Livekit docs: `room.auto_create: false` is now included in default `livekit.yaml`, following `lk-jwt-service` recommendation. +- Replace deprecated `docker-compose` commands with `docker compose` to reflect latest Docker changes. +- Update backup instructions: the right paths for `.sst` files are now in `$DATABASE_BACKUP_PATH/private/` path instead of `$DATABASE_BACKUP_PATH/`. Contributed by @stratself + +## Misc + +- #2033 +- Updated Ruma dependencies. Contributed by @eleboucher. + + # Continuwuity 26.7.3 (2026-08-11) ## Bugfixes diff --git a/Cargo.lock b/Cargo.lock index a8155e82a..1a341d06e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -816,7 +816,7 @@ dependencies = [ [[package]] name = "conduwuit" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "aws-lc-rs", "clap", @@ -854,7 +854,7 @@ dependencies = [ [[package]] name = "conduwuit_admin" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "assign", "clap", @@ -880,7 +880,7 @@ dependencies = [ [[package]] name = "conduwuit_api" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "assign", "async-trait", @@ -918,7 +918,7 @@ dependencies = [ [[package]] name = "conduwuit_build_metadata" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "built", "cargo_metadata", @@ -926,7 +926,7 @@ dependencies = [ [[package]] name = "conduwuit_core" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "argon2", "arrayvec", @@ -994,7 +994,7 @@ dependencies = [ [[package]] name = "conduwuit_database" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "async-channel", "conduwuit_core", @@ -1015,7 +1015,7 @@ dependencies = [ [[package]] name = "conduwuit_macros" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "cargo_toml", "itertools 0.15.0", @@ -1026,7 +1026,7 @@ dependencies = [ [[package]] name = "conduwuit_router" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "assign", "axum", @@ -1063,7 +1063,7 @@ dependencies = [ [[package]] name = "conduwuit_service" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "askama", "assign", @@ -1115,7 +1115,7 @@ dependencies = [ [[package]] name = "conduwuit_web" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "askama", "assign", @@ -4765,7 +4765,7 @@ dependencies = [ [[package]] name = "ruminuwuity" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "assign", "ruma", @@ -6873,7 +6873,7 @@ dependencies = [ [[package]] name = "xtask" -version = "26.7.3" +version = "26.8.0-alpha.1" dependencies = [ "askama", "cargo_metadata", diff --git a/Cargo.toml b/Cargo.toml index f40fab415..9cb9edb83 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -12,7 +12,7 @@ license = "Apache-2.0" # See also `rust-toolchain.toml` readme = "README.md" repository = "https://forgejo.ellis.link/continuwuation/continuwuity" -version = "26.7.3" +version = "26.8.0-alpha.1" [workspace.metadata.crane] name = "conduwuit"