fix: Add unstable feature flag

This also upbrades the debian version to trixie, because the new LLVM
version doesn't seem to have a build

.forgejo/actions/setup-llvm-with-apt/action.yml

@@ -17,7 +17,7 @@ inputs:
   llvm-version:
     description: 'LLVM version to install'
     required: false
-    default: '20'
+    default: '21'
 
 outputs:
   llvm-version:

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@b5fddbb5361bce8a06fb168c9d403a6cc552b084 # v2
+      uses: https://github.com/taiki-e/install-action@3771e22aa892e03fd35585fae288baad1755695c # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/auto-labeler.yml

@@ -28,7 +28,7 @@ jobs:
             const labelsToAdd = new Set();
 
             for (const file of fileNames) {
-              if (file.startsWith('docs/') || file.startsWith('theme/') || file.endsWith('.md') || file == 'rspress.config.ts') {
+              if (file.startsWith('docs/') || file.startsWith('theme/') || (file.endsWith('.md') && !file.startsWith('changelog.d/')) || file == 'rspress.config.ts') {
                 labelsToAdd.add('Documentation');
               }
               if (file.startsWith('.forgejo/')) {

.forgejo/workflows/documentation.yml

@@ -56,7 +56,7 @@ jobs:
 
       - name: Deploy to Cloudflare Pages (Production)
         if: github.ref == 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
-        uses: https://github.com/cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
         with:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Deploy to Cloudflare Pages (Preview)
         if: github.ref != 'refs/heads/main' && vars.CLOUDFLARE_PROJECT_NAME != ''
-        uses: https://github.com/cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
         with:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.forgejo/workflows/element.yml

@@ -121,7 +121,7 @@ jobs:
       - name: 🚀 Deploy to Cloudflare Pages
         if: vars.CLOUDFLARE_PROJECT_NAME != ''
         id: deploy
-        uses: https://github.com/cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
+        uses: https://github.com/cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4
         with:
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.forgejo/workflows/mirror-images.yml

@@ -55,7 +55,7 @@ jobs:
       #     repositories: continuwuity
 
       - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@f3c6d87835906c175eb6ccfc18b348b69bb447e7 # main
+        uses: https://github.com/regclient/actions/regsync-installer@c70ad64367908075211b10dcd2ab9fad4bfa1816 # main
 
       - name: Check what images need mirroring
         run: |

.forgejo/workflows/release-image.yml

@@ -216,7 +216,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@v2
+        uses: https://github.com/softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           draft: true
           files: binaries/*

.forgejo/workflows/renovate.yml

@@ -43,7 +43,7 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:43.140.0@sha256:61303c28b10a491c559529fb6f41745850e4755a43a54c04c3ae6848d6eaf5cc
+      image: ghcr.io/renovatebot/renovate:43.181.0@sha256:aa64263a30f1ef92a661f1c3421ab13f0268131ffd5bfc8e16bdd98977a67eed
       options: --tmpfs /tmp:exec
     steps:
       - name: Checkout

.pre-commit-config.yaml

@@ -24,7 +24,7 @@ repos:
         - id: check-added-large-files
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.46.1
+    rev: v1.46.2
     hooks:
       - id: typos
       - id: typos

CONTRIBUTING.md

@@ -137,9 +137,9 @@ ### Commit Messages
 
 Examples:
 ```
-feat: add user authentication
-fix(database): resolve connection pooling issue
-docs: update installation instructions
+feat: Add user authentication
+fix(database): Resolve connection pooling issue
+docs: Update installation instructions
 ```
 
 The project uses the `committed` hook to validate commit messages in pre-commit. This ensures all commits follow the conventional format.

Cargo.toml

@@ -39,10 +39,10 @@ features = ["ffi", "std", "union"]
 version = "1.1.0"
 
 [workspace.dependencies.ctor]
-version = "0.13.0"
+version = "1.0.6"
 
 [workspace.dependencies.dtor]
-version = "0.13.0"
+version = "1.0.0"
 
 [workspace.dependencies.cargo_toml]
 version = "0.22"
@@ -164,7 +164,7 @@ features = ["raw_value"]
 
 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.25"
+version = "0.0.26"
 
 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -180,7 +180,7 @@ version = "0.5.3"
 features = ["alloc", "rand"]
 default-features = false
 
-# Used to generate thumbnails for images & blurhashes
+# Used to generate thumbnails for images
 [workspace.dependencies.image]
 version = "0.25.5"
 default-features = false
@@ -191,14 +191,6 @@ features = [
     "webp",
 ]
 
-[workspace.dependencies.blurhash]
-version = "0.2.3"
-default-features = false
-features = [
-    "fast-linear-to-srgb",
-    "image",
-]
-
 # logging
 [workspace.dependencies.log]
 version = "0.4.27"
@@ -352,7 +344,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "9c9dccc93f054bbd28f23f630223fffa6289ecbc"
+rev = "3ecd80b92794d2d93f657a7b3db62d4be237526b"
 features = [
     "appservice-api-c",
     "client-api",
@@ -364,7 +356,6 @@ features = [
     "ring-compat",
     "compat-upload-signatures",
     "compat-optional-txn-pdus",
-    "unstable-msc2448",
     "unstable-msc2666",
     "unstable-msc2867",
     "unstable-msc2870",
@@ -388,12 +379,13 @@ features = [
     "unstable-msc4293",
     "unstable-msc4406",
     "unstable-msc4439",
+    "unstable-msc4466",
     "unstable-extensible-events",
 ]
 
 [workspace.dependencies.rust-rocksdb]
 git = "https://forgejo.ellis.link/continuwuation/rust-rocksdb-zaidoon1"
-rev = "31fb8f772c7afcdc0061ab6a40cfa3a1be2fccd9"
+rev = "0a25ff92f7c09b55eec496b9c192c7d5136ab2b8"
 default-features = false
 features = [
     "multi-threaded-cf",
@@ -413,20 +405,20 @@ default-features = false
 
 # optional opentelemetry, performance measurements, flamegraphs, etc for performance measurements and monitoring
 [workspace.dependencies.opentelemetry]
-version = "0.31.0"
+version = "0.32.0"
 
 [workspace.dependencies.tracing-flame]
 version = "0.2.0"
 
 [workspace.dependencies.tracing-opentelemetry]
-version = "0.32.0"
+version = "0.33.0"
 
 [workspace.dependencies.opentelemetry_sdk]
-version = "0.31.0"
+version = "0.32.0"
 features = ["rt-tokio"]
 
 [workspace.dependencies.opentelemetry-otlp]
-version = "0.31.0"
+version = "0.32.0"
 features = ["http", "grpc-tonic", "trace", "logs", "metrics"]
 
 

changelog.d/+a4f10a9b.feature.md

@@ -0,0 +1 @@
+Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.

changelog.d/+f7afb79b.misc.md

@@ -0,0 +1 @@
+The version of Debian that the Docker-based build process uses has been upgraded from Bookworm to Trixie, meaning that standalone binaries now have a minimum glibc of 2.41, and can no longer be used on distro versions from before 2025-01-30

changelog.d/+fe90cdea.removal.md

@@ -0,0 +1 @@
+Support for server-side blurhashing (part of MSC2448) has been removed.

conduwuit-example.toml

@@ -1874,24 +1874,6 @@
 #
 #support_pgp_key =
 
-[global.blurhashing]
-
-# blurhashing x component, 4 is recommended by https://blurha.sh/
-#
-#components_x = 4
-
-# blurhashing y component, 3 is recommended by https://blurha.sh/
-#
-#components_y = 3
-
-# Max raw size that the server will blurhash, this is the size of the
-# image after converting it to raw data, it should be higher than the
-# upload limit but not too high. The higher it is the higher the
-# potential load will be for clients requesting blurhashes. The default
-# is 33.55MB. Setting it to 0 disables blurhashing.
-#
-#blurhash_max_raw_size = 33554432
-
 [global.matrix_rtc]
 
 # A list of MatrixRTC foci (transports) which will be served via the
@@ -1977,8 +1959,10 @@
 #
 #sender =
 
-# Whether to require that users provide an email address when they
-# register.
+# Whether to allow public registration with an email address.
+#
+# Note that, if this option is enabled, anyone will be able to register an
+# account with just an email address.
 #
 # If either this option or `require_email_for_token_registration` are set,
 # users will not be allowed to remove their email address.
@@ -1986,6 +1970,7 @@
 #require_email_for_registration = false
 
 # Whether to require that users who register with a registration token
-# provide an email address.
+# provide an email address. This option is independent of
+# `require_email_for_registration`.
 #
 #require_email_for_token_registration = false

docker/Dockerfile

@@ -1,5 +1,5 @@
 ARG RUST_VERSION=1
-ARG DEBIAN_VERSION=bookworm
+ARG DEBIAN_VERSION=trixie
 
 FROM --platform=$BUILDPLATFORM docker.io/tonistiigi/xx AS xx
 FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-slim-${DEBIAN_VERSION} AS base
@@ -10,7 +10,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean
 
 # Match Rustc version as close as possible
 # rustc -vV
-ARG LLVM_VERSION=21
+ARG LLVM_VERSION=22
 # ENV RUSTUP_TOOLCHAIN=${RUST_VERSION}
 
 # Install repo tools
@@ -22,7 +22,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y \
     pkg-config make jq \
-    wget curl git software-properties-common \
+    wget curl git lsb-release gpg \
     file
     # golang cmake
 

docs/advanced/dns.mdx

@@ -74,13 +74,11 @@ ## Unbound
 
 - Increase `discard-timeout` to something like `4800` to wait longer for upstream resolvers, as recursion can take a long time to respond to some domains. Continuwuity default to `dns_timeout = 10` seconds, so dropping requests early would lead to unnecessary retries and/or failures.
 
-### Using a forwarder (optional)
+### Recursion versus forwarding
 
-Unbound by default employs **recursive resolution** and contacts many servers around the world. If this is not performant enough, consider forwarding your queries to public resolvers to benefit from their CDNs and get faster responses.
+Unbound by default employs **recursive resolution** and contacts many servers around the world. While this allows updated and authoritative answers and are generally viable for most users, sometimes these recursive queries can be too slow to fully resolve. As an alternative, you can consider **forwarding** your queries to public resolvers, and benefit from faster responses from their CDNs.
 
-However, most popular upstreams (such as Google DNS or Quad9) employ IP ratelimiting, so a generous cache is still needed to avoid making too many queries.
-
-DNS-over-TLS forwarders may also be used should you need on-the-wire encryption, but TLS overhead causes some speed penalties.
+Do note that most popular upstreams (such as Google DNS or Quad9) employ IP ratelimiting, so a generous cache is still needed to avoid making too many queries.
 
 If you want to use forwarders, configure it as follows:
 
@@ -99,6 +97,8 @@ # Use cloudflare public resolvers as an example
     # forward-addr: 2606:4700:4700::1111@53
 
 # alternatively, use DNS-over-TLS for forwarders.
+# this will encrypt traffic between you and the forwarder,
+# but takes more time due to TLS overhead.
 # forward-zone:
     # name: "."
     # forward-tls-upstream: yes
@@ -133,9 +133,11 @@ ### dnsmasq
 
 [arch-linux-dnsmasq]: https://wiki.archlinux.org/title/Dnsmasq
 
-### Technitium
+### Technitium DNS
 
-[Technitium][technitium] supports recursion as well as a myriad of forwarding protocols, allows saving cache to disk natively, and does work well with Continuwuity. Its default configurations however ratelimits single-IP requests by a lot, and hence must be changed. You may consult this [community guide][technitium-continuwuity] for more details on setting up a dedicated Technitium for Continuwuity.
+[Technitium DNS Server][technitium] supports recursion as well as a myriad of forwarding protocols, allows saving cache to disk natively, and does work well with Continuwuity. Its out-of-the-box configs however ratelimits single-IP requests by a lot, and hence must be changed.
+
+You may consult this [community guide][technitium-continuwuity] for more details on setting up and fine-tuning a dedicated Technitium instance for Continuwuity.
 
 [technitium]: https://github.com/TechnitiumSoftware/DnsServer
 [technitium-continuwuity]: https://muoi.me/~stratself/articles/technitium-continuwuity/
@@ -150,11 +152,13 @@ ## Testing
 
 ## Further steps
 
-- (Recommended) Set **`dns_cache_entries = 0`** inside Continuwuity and fully rely on the more performant external resolver.
+It is recommended to set **`dns_cache_entries = 0`** inside Continuwuity to fully rely on the external resolver. While Continuwuity does have an internal cache, it can run into reliability issues if you're federating with many domains.
+
+Additionally, you can also make the following improvements:
 
 - Consider employing **persistent cache to disk**, so your resolver can still run without hassle after a restart. Unbound, via [Cache DB module][unbound-cachedb], can use Redis as a storage backend for this feature.
 
-- Consider [enabling **Serve Stale**][unbound-serve-stale] functionality to serve expired data beyond DNS TTLs. Since most Matrix homeservers have static IPs, this should help improve federation with them especially when upstream resolvers have timed out. For dnsproxy, this corresponds to its [optimistic caching options][dnsproxy-usage].
+- Consider [enabling **Serve Stale**][unbound-serve-stale] functionality to serve expired data beyond DNS TTLs. Since most Matrix homeservers have static IPs, this should still allow federating with them when upstream resolvers have timed out. For dnsproxy, this corresponds to its [optimistic caching options][dnsproxy-usage].
 
 - If you still experience DNS performance issues, another step could be to **disable DNSSEC** (which is computationally expensive) at a cost of slightly decreased security. On Unbound this is done by commenting out `trust-anchors` config options and removing the `validator` module.
 

docs/calls/livekit.mdx

@@ -25,9 +25,9 @@ ### 2. Services
 :::tip Generating the secrets
 LiveKit provides a utility to generate secure random keys
 ```bash
-~$ docker run --rm livekit/livekit-server:latest generate-keys
-API Key:  APIUxUnMnSkuFWV
-API Secret:  t93ZVjPeoEdyx7Wbet3kG4L3NGZIZVEFvqe0UuiVc22A
+docker run --rm livekit/livekit-server:latest generate-keys
+# API Key:  APIUxUnMnSkuFWV
+# API Secret:  t93ZVjPeoEdyx7Wbet3kG4L3NGZIZVEFvqe0UuiVc22A
 ```
 :::
 
@@ -262,14 +262,14 @@ # livekit.yaml
 
 ## Testing
 
-To test that LiveKit is successfully integrated with Continuwuity, you will need to replicate its [Token Exchange Flow](https://github.com/element-hq/lk-jwt-service#%EF%B8%8F-how-it-works--token-exchange-flow).
+To test that LiveKit is successfully integrated with Continuwuity, you will need to replicate its [Token Exchange Flow](https://github.com/element-hq/lk-jwt-service#%EF%B8%8F-how-it-works--token-exchange-flow). Follow the steps below while checking Docker logs (`docker-compose logs --follow`), in order to help [troubleshooting](#troubleshooting) any issues.
 
 First, you will need an access token for your current login session. These can be found in your client's settings or obtained via [this website](https://timedout.uk/mxtoken.html).
 
-Then, using that token, fetch the discovery endpoints for MatrixRTC services
+Then, using that token, fetch the discovery endpoints for MatrixRTC services:
 
 ```bash
-curl -X POST -H "Authorization: Bearer <session-access-token>" \
+curl -H "Authorization: Bearer <session-access-token>" \
   https://matrix.example.com/_matrix/client/unstable/org.matrix.msc4143/rtc/transports
 ```
 
@@ -318,7 +318,7 @@ ## Testing
 You can then send this payload to the lk-jwt-service:
 
 ```bash
-~$ curl -X POST -d @payload.json https://livekit.example.com/get_token
+curl -X POST -d @payload.json https://livekit.example.com/get_token
 ```
 
 The lk-jwt-service will, after checking against Continuwuity, answer with a `jwt` token to create a LiveKit media room:
@@ -331,22 +331,31 @@ ## Testing
 
 ## Troubleshooting
 
-To debug any issues, you can place a call or redo the Testing instructions, and check the container logs for any specific errors. Use `docker-compose logs --follow` to follow them in real-time.
+To debug any issues, you can place a call or redo the Testing instructions, and check the container logs for any specific errors. Use `docker-compose logs --follow` to follow these logs in real-time.
 
 ### Common errors in Element Call UI
 
 - `MISSING_MATRIX_RTC_FOCUS`: LiveKit is missing from Continuwuity's config file
 - "Waiting for media" popup always showing: a LiveKit URL has been configured in Continuwuity, but your client cannot connect to it for some reason
 
+For browser-based clients, you can also inspect connections using DevTools' Networking tab, to see which requests are erroring out.
+
 ### Docker loopback networking issues
 
 Some distros do not allow Docker containers to connect to its host's public IP by default. This would cause `lk-jwt-service` to fail connecting to `livekit` or `continuwuity` on the same host. As a result, you would see connection refused/connection timeouts log entries in the JWT service, even when `LIVEKIT_URL` has been configured correctly.
 
+You can also test that this is the case by cURLing from a sidecar container:
+
+```bash
+docker run --rm --net container:lk-jwt-service docker.io/curlimages/curl https://livekit.example.com
+# --- some errors ---
+```
+
 To alleviate this, you can try one of the following workarounds:
 
 - Use `network_mode: host` for the `lk-jwt-service` container (instead of the default bridge networking).
 
-- Add an `extra_hosts` file mapping livekit's (and continuwuity's) domain name to a localhost address:
+- Add an `extra_hosts` file mapping livekit's (and continuwuity's) domain name to a locally-reachable address:
 
     ```diff
     # in docker-compose.yaml
@@ -360,12 +369,7 @@ ### Docker loopback networking issues
 
 - (**untested, use at your own risk**) Implement an iptables workaround as shown [here](https://forums.docker.com/t/unable-to-connect-to-host-service-from-inside-docker-container/145749/6).
 
-After implementing the changes and restarting your compose, you can test whether the connection works by cURLing from a sidecar container:
-
-```bash
-~$ docker run --rm --net container:lk-jwt-service docker.io/curlimages/curl https://livekit.example.com
-OK
-```
+After implementing the changes and restarting your compose, `lk-jwt-service` should now connect to your other services. The sidecar container test above should now return an `OK` from LiveKit.
 
 ### Workaround for non-federating servers
 

docs/deploying/docker.mdx

@@ -185,13 +185,15 @@ ## Testing
 
 Test that your setup works by following these [instructions](./generic.mdx#how-do-i-know-it-works)
 
+Check your container logs using `docker-compose logs --follow` to debug any issues. See the [Troubleshooting](../troubleshooting.mdx) page for common errors and how to fix them.
+
 ## Other deployment methods
 
 ### Docker - Quick Run
 
-:::note For testing only
-The instructions below are only meant for a quick demo of Continuwuity.
-For production deployment, we recommend using [Docker Compose](#docker-compose)
+:::warning For testing only
+The instructions below are only meant for a quick demo of Continuwuity with **federation disabled**.
+For production deployment, we recommend using [Docker Compose](#docker-compose).
 :::
 
 Get a working Continuwuity server with an admin user in four steps:
@@ -211,7 +213,7 @@ ### Docker - Quick Run
       -e CONTINUWUITY_SERVER_NAME="example.com" \
       -e CONTINUWUITY_DATABASE_PATH="/var/lib/continuwuity" \
       -e CONTINUWUITY_ADDRESS="0.0.0.0" \
-      -e CONTINUWUITY_ALLOW_REGISTRATION="false" \
+      -e CONTINUWUITY_ALLOW_FEDERATION="false" \
       --name continuwuity \
       forgejo.ellis.link/continuwuation/continuwuity:latest \
       /sbin/conduwuit
@@ -233,9 +235,9 @@ ### Docker - Quick Run
     Pick your own username and password!
     ```
 
-4. Configure your reverse proxy to forward HTTPS traffic to Continuwuity at port 8008. See [Docker Compose](#docker-compose) for examples.
+4. Configure your reverse proxy to forward HTTPS traffic to Continuwuity at port 8008. See [Docker Compose](#docker-compose) or the [Generic instructions](./generic.mdx#setting-up-the-reverse-proxy) for examples.
 
-Once configured, log in to your server with any Matrix client, and register for an account with the registration token from step 3. You'll automatically be invited to the admin room where you can [manage your server](../reference/admin).
+Once configured, log in to your server with any Matrix client, and register for an account with the registration token from step 3. If you did not configure step 4., log in via the `http://<your_server_ip>:8008` address. You will be automatically invited to the admin room where you can [manage your server](../reference/admin).
 
 ### (Optional) Building Custom Images
 
@@ -269,4 +271,5 @@ ## Next steps
 
 - For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
 - To set up Audio/Video communication, see the [**Calls**](../calls.mdx) page.
+- Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.mdx).

docs/deploying/generic.mdx

@@ -260,7 +260,7 @@ ## Starting Your Server
 ```
 
 You can then open [a Matrix client][matrix-clients],
-enter your homeserver address, and try to register with the provided token.
+enter your homeserver address, and register with the provided token.
 By default, the first user is the instance's first admin. They will be added
 to the `#admin:example.com` room and be able to [issue admin commands](../reference/admin/index.md).
 
@@ -296,4 +296,5 @@ ## What's next?
 
 - For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
 - For Audio/Video call functionality see the [**Calls**](../calls.md) page.
+- Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.md).

engage.toml

@@ -146,7 +146,7 @@ cargo clippy \
     --locked \
     --profile test \
     --no-default-features \
-    --features=console,systemd,element_hacks,direct_tls,perf_measurements,brotli_compression,blurhashing \
+    --features=console,systemd,element_hacks,direct_tls,perf_measurements,brotli_compression \
     --color=always \
     -- \
     -D warnings

flake.lock

@@ -3,11 +3,11 @@
     "advisory-db": {
       "flake": false,
       "locked": {
-        "lastModified": 1777645914,
-        "narHash": "sha256-P1T7QVQS13OvkXEuEhI91CLaQfyv6iqV9vW8IBLLDYg=",
+        "lastModified": 1778915282,
+        "narHash": "sha256-iqXYpuCoWoGypnpM5ceXN748QlYeBXDtZx0uI98qFLo=",
         "owner": "rustsec",
         "repo": "advisory-db",
-        "rev": "d6ba1f7070ba91f45efe372d68eb648be67d0417",
+        "rev": "f2ae5fc8e5d208373b6c838f9676434525327a72",
         "type": "github"
       },
       "original": {
@@ -18,11 +18,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1777335812,
-        "narHash": "sha256-bEg5xoAxAwsyfnGhkEX7RJViTIBIYPd8ISg4O1c0HFc=",
+        "lastModified": 1778106249,
+        "narHash": "sha256-cM/AuKy5tMhwOOQIbha8ZRRMHVfNf7cv2aljIw+qoCg=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "5e0fb2f64edff2822249f21293b8304dedaaf676",
+        "rev": "6d015ea29630b7ad2402841386da2cb617a470a7",
         "type": "github"
       },
       "original": {
@@ -39,11 +39,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1777624102,
-        "narHash": "sha256-thSyElkje577x/kAbP72nHlfiFc1a+tCudskLPHXe9s=",
+        "lastModified": 1778919578,
+        "narHash": "sha256-+z+jgTly48gsAiX8rOe/vs8C/2G4vdCpcEtqMJUpFqw=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "4d81601e0b73f20d81d066754ad0e7d1e7f75a06",
+        "rev": "ecd6d4ff22cfdb1339b2915455a2ff4dc85bf52e",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1778869304,
+        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
         "type": "github"
       },
       "original": {
@@ -105,11 +105,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
         "type": "github"
       },
       "original": {
@@ -132,11 +132,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1777583169,
-        "narHash": "sha256-dVJ4+wrRKc8oIgp3rLOFSq1obt/sCKlXy3h47qof/w0=",
+        "lastModified": 1778854817,
+        "narHash": "sha256-iG+VuMy8W585geVVCUd7pR025WsY3ZkgSv5Yt5bxDmQ=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "aa64e4828a2bbba44463c1229a81c748d3cce583",
+        "rev": "1a68212c5683555ad80f0eab71db9715c6d52145",
         "type": "github"
       },
       "original": {

nix/packages/continuwuity.nix

@@ -9,6 +9,7 @@
   rustPlatform,
   cargoExtraArgs ? "",
   rustflags ? "",
+  target_cpu ? null,
   rocksdb ? callPackage ./rocksdb.nix { },
   profile ? "release",
 }:
@@ -39,7 +40,10 @@ let
       ROCKSDB_LIB_DIR = "${rocksdb}/lib";
       CARGO_PROFILE = profile;
       RUSTFLAGS = rustflags;
-    };
+    }
+    // (lib.optionalAttrs (target_cpu != null) {
+      TARGET_CPU = target_cpu;
+    });
   };
 in
 craneLib.buildPackage (

nix/packages/default.nix

@@ -22,11 +22,13 @@
           rustflags = "--cfg reqwest_unstable";
         };
         # users may also override this with other cargo profiles to build for other feature sets
-        #
-        # other examples include:
-        #
-        # - release-high-perf
-        max-perf = self'.packages.default.override {
+        # for features configuration see `default` package which enables http3 by default
+
+        # example: different compilation profile and different target_cpu
+        max-perf-haswell = self'.packages.default.override {
+          # compiles explicitly for haswell arch cpus
+          target_cpu = "haswell";
+          # compiles slower but with more thorough optimizations
           profile = "release-max-perf";
         };
       };

nix/packages/rocksdb.nix

@@ -16,13 +16,13 @@
   enableJemalloc = stdenv.hostPlatform.isLinux;
 }).overrideAttrs
   ({
-    version = "continuwuity-v0.5.0-unstable-2026-03-27";
+    version = "continuwuity-v0.5.0-unstable-2026-05-19";
     src = fetchFromGitea {
       domain = "forgejo.ellis.link";
       owner = "continuwuation";
       repo = "rocksdb";
-      rev = "463f47afceebfe088f6922420265546bd237f249";
-      hash = "sha256-1ef75IDMs5Hba4VWEyXPJb02JyShy5k4gJfzGDhopRk=";
+      rev = "3756b2b905e13216d8b56bcc783d814e7b073aff";
+      hash = "sha256-rSv4fr2bf9JJwdodgeuPCuceeh7k97KVxrAOC0wyPQY=";
     };
 
     # We have this already at https://forgejo.ellis.link/continuwuation/rocksdb/commit/a935c0273e1ba44eacf88ce3685a9b9831486155

nix/rust.nix

@@ -16,7 +16,7 @@
             file = inputs.self + "/rust-toolchain.toml";
 
             # See also `rust-toolchain.toml`
-            sha256 = "sha256-sqSWJDUxc+zaz1nBWMAJKTAGBuGWP25GCftIOlCEAtA=";
+            sha256 = "sha256-gh/xTkxKHL4eiRXzWv8KP7vfjSk61Iq48x47BEDFgfk=";
           };
         in
         {

package-lock.json

@@ -125,13 +125,13 @@
       }
     },
     "node_modules/@rsbuild/core": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.5.tgz",
-      "integrity": "sha512-KajO50hbXb32S8MsyDh2f+xKcVeRy9Gfzdcy0JjpMLj22djHugly6jrGo7jH7ls9X6/TDcyCTncSuNK4+D2lTw==",
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.6.tgz",
+      "integrity": "sha512-0/u7oTgPp9NsL7E7qXzYiOOPAsOJiDbOr0FmG6gizJDIpYK8nospogNrwQ00SG0had9fdhLI7XkhP160IaLnWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rspack/core": "~2.0.2",
+        "@rspack/core": "~2.0.3",
         "@swc/helpers": "^0.5.21"
       },
       "bin": {
@@ -169,28 +169,28 @@
       }
     },
     "node_modules/@rspack/binding": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.2.tgz",
-      "integrity": "sha512-0kZPplW9GWx8mfC6DfsaRY3QBIYPuUs42JfmSM6aSb8tMHZAXQeLeMB8M+h8i4SeI+aFtCgO6UuYGtyWf7+L+A==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.3.tgz",
+      "integrity": "sha512-4exVNhGhW5RFHjK87XeTKbkA/qAgI5NHJlT1jNqiJv0gcUXLqTOEU3w7f8+f9zUo4JMFvPc0c9veOi4M19YYTg==",
       "dev": true,
       "license": "MIT",
       "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.2",
-        "@rspack/binding-darwin-x64": "2.0.2",
-        "@rspack/binding-linux-arm64-gnu": "2.0.2",
-        "@rspack/binding-linux-arm64-musl": "2.0.2",
-        "@rspack/binding-linux-x64-gnu": "2.0.2",
-        "@rspack/binding-linux-x64-musl": "2.0.2",
-        "@rspack/binding-wasm32-wasi": "2.0.2",
-        "@rspack/binding-win32-arm64-msvc": "2.0.2",
-        "@rspack/binding-win32-ia32-msvc": "2.0.2",
-        "@rspack/binding-win32-x64-msvc": "2.0.2"
+        "@rspack/binding-darwin-arm64": "2.0.3",
+        "@rspack/binding-darwin-x64": "2.0.3",
+        "@rspack/binding-linux-arm64-gnu": "2.0.3",
+        "@rspack/binding-linux-arm64-musl": "2.0.3",
+        "@rspack/binding-linux-x64-gnu": "2.0.3",
+        "@rspack/binding-linux-x64-musl": "2.0.3",
+        "@rspack/binding-wasm32-wasi": "2.0.3",
+        "@rspack/binding-win32-arm64-msvc": "2.0.3",
+        "@rspack/binding-win32-ia32-msvc": "2.0.3",
+        "@rspack/binding-win32-x64-msvc": "2.0.3"
       }
     },
     "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.2.tgz",
-      "integrity": "sha512-0o7lbgBBsDlICWdjIH0q3e0BsSco4GRiImHWVfZSVEG+q2+ykZJvSvYCVhPM1Co375Z0S3VMPa/8SjcY1FHwlw==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.3.tgz",
+      "integrity": "sha512-4UyCjLJwU/WxR6K1/gG4u3+jUsoaRHJ5rNu9fto/UbvrItwdlVNULChAApqZFw6mcSetMddSjSICeuj5pSB6sA==",
       "cpu": [
         "arm64"
       ],
@@ -202,9 +202,9 @@
       ]
     },
     "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.2.tgz",
-      "integrity": "sha512-tOwxZpoPlTlRs/w6UyUinXJ4TYRVHMlR7+eQxO1R3muKpixvhXQjtvoaY16HuFyTVky5F0IfOoWr3x9FEsgdLg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.3.tgz",
+      "integrity": "sha512-K3evrbTgZNa8emEqk+AjDtbuoXZp5tPZz3pcEgETxuu3KanW8Zu+Fb+TUp1DEUcL0xOmHPPox8H2cZ3pF4Zmug==",
       "cpu": [
         "x64"
       ],
@@ -216,9 +216,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.2.tgz",
-      "integrity": "sha512-1ZD4YFhG1rmgqj+W8hfwHyKV8xDxGsc/3KgU0FwmiVEX7JfzhCkgBO/xlCG79kRKSrzuVzt4icO/G3cCKn0pag==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.3.tgz",
+      "integrity": "sha512-aPLDaaTtX1wqjLYAIHc2MGDQZtv1Hbjx47oaaefbWz5GbAnSA4P8jdYIeeGRyrqvQ0WqJXIWXgT0d/iXtes00A==",
       "cpu": [
         "arm64"
       ],
@@ -233,9 +233,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.2.tgz",
-      "integrity": "sha512-/PtTkM/DsDLjeuXTmeJeRfbjCDbcL9jvoVgZrgxYFZ28y2cdLvbChbW9uigOzs5dQEs1CIBQXMTTj7KhdBTuQg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.3.tgz",
+      "integrity": "sha512-0WulUQPop6vmSDfrTxghmVlm+6crU8/XqD2f0dOWbEniZVuDZJ5/Y/cBqTRyk3rjl0vrmUv3lc87/t7UgQJQSw==",
       "cpu": [
         "arm64"
       ],
@@ -250,9 +250,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.2.tgz",
-      "integrity": "sha512-bBjsZxMHRaPo6X9SokApm6ucs+UhXtAJFyJJyuk2BH4XJsLeCU9Dz1vMwioeohFbJUUeTASVPm6/BL+RhSaunw==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.3.tgz",
+      "integrity": "sha512-fAhiMuV5omT53YMft+f3Y9euAFgspuyBAk9ZpeW2buL2TkuUMwP07adhhvQfKdQ5gpELfzmjQaRDGqaIT8UWiA==",
       "cpu": [
         "x64"
       ],
@@ -267,9 +267,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.2.tgz",
-      "integrity": "sha512-HjlpInqzabDNkhVsUJpsHPqa9QYVWBViJoyWNjzXCAW0vKMDvwaphyUvokSinX8FGTlZi/sr5UEaHJo6XtQ35g==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.3.tgz",
+      "integrity": "sha512-0kcuFoZ8vy2iNWoISFOZt+/Ujo7LRLrzE7h07AV5r+oN/mv+/v14Sd/8NUtDIScCkrYOszYq/QS31e6t0UrVfw==",
       "cpu": [
         "x64"
       ],
@@ -284,9 +284,9 @@
       ]
     },
     "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.2.tgz",
-      "integrity": "sha512-YaRYNFLJRpkGfYjSWR7n9f+nQKtrlmrrffpAn/blc2geHcRvXoBc5SCs1idPtsLhj7H9qWWhs7ucjyHy4csWFg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.3.tgz",
+      "integrity": "sha512-x2fsw7GzNZEnw444ikj4/b8kVjM0Y0TllxmizHpYZ9gmaQrOk5OXo9RQdz+l4zzoGors0l2IZP5Cc4GJNCaSoQ==",
       "cpu": [
         "wasm32"
       ],
@@ -300,9 +300,9 @@
       }
     },
     "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.2.tgz",
-      "integrity": "sha512-d/3kTEKq+asLjRFPO96t+wfWiM7DLN76VQEPDD9bc1kdsZXlVJBuvyXfsgK8bbEvKplWXYcSsokhmEnuXrLOpg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.3.tgz",
+      "integrity": "sha512-jqlxuVPdrgMuwj/HEjSkC/jmhl4fAuKyob36zJXq2uAusn2FRJ4kClGe1fLFpfxRXFVQAWwlAOwLJg8T0suuaA==",
       "cpu": [
         "arm64"
       ],
@@ -314,9 +314,9 @@
       ]
     },
     "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.2.tgz",
-      "integrity": "sha512-161cWineq3RW+Jdm1FAfSpXeUtYWvhB3kAbm46vNT9h/YYz+spwsFMvveAZ1nsVSVL0IC5lDBGUte7yUAY8K2g==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.3.tgz",
+      "integrity": "sha512-QM4JEuyk5QaZ5gnvnAIaCwVQzCkrD2E4Sud77kx/MVGDsRkcOlMx3blMC5QNHPDamRmWGk+7314YOQvRhKuWyg==",
       "cpu": [
         "ia32"
       ],
@@ -328,9 +328,9 @@
       ]
     },
     "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.2.tgz",
-      "integrity": "sha512-y7Q0S1FE+OlkL5GMqLG0PwxrPw6E1r892KhGrGKE1Vdufe5YTEx6xTPxzZ+b7N2KPD7s9G1/iJmWHQxb1+Bjkg==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.3.tgz",
+      "integrity": "sha512-vSQNnAy0wswG6AfNRuArTHQBiXOXl+A9ddQxBFup4PMHUzXxKtsBLQzw7BgFC0EgrPeHbt+30j7sXVZKYukj4A==",
       "cpu": [
         "x64"
       ],
@@ -342,13 +342,13 @@
       ]
     },
     "node_modules/@rspack/core": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.2.tgz",
-      "integrity": "sha512-VM3UHOo26uC+4QSqY5tU1ybI7KuXY5rTof8nhFOaBY9SYau0Smvr+hMSAPmrmHwknB6dXT8yaNVxrj7I+qxE1Q==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.3.tgz",
+      "integrity": "sha512-2ufO/8FHIA/lX6UOgSsKPhpDvHr0sh9lYq/n/LsIZsTwu3973BGbu2fg1Akvuu3rEnskPqXjsqH2EPBzEA42uA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rspack/binding": "2.0.2"
+        "@rspack/binding": "2.0.3"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
@@ -383,17 +383,17 @@
       }
     },
     "node_modules/@rspress/core": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.11.tgz",
-      "integrity": "sha512-4YBOFmSMFv5GWrCa80qSIW8VxqZQQS/PknVq2r7Hb7kgfB38Fzciopn3hjb3hNwI4TTRbsi/Jev2HyRWD4bYAQ==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.12.tgz",
+      "integrity": "sha512-3ER/9zjYrjapYKx/6KA5/K7Y9jOXltRjgq5/dv53n2xf6xo1Z8CoQVMmu0YMBn4Rn6AchmAcCc/KXZZXN4fjBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@mdx-js/mdx": "^3.1.1",
         "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "^2.0.5",
+        "@rsbuild/core": "^2.0.6",
         "@rsbuild/plugin-react": "~2.0.0",
-        "@rspress/shared": "2.0.11",
+        "@rspress/shared": "2.0.12",
         "@shikijs/rehype": "^4.0.2",
         "@types/unist": "^3.0.3",
         "@unhead/react": "^2.1.15",
@@ -412,7 +412,7 @@
         "react-lazy-with-preload": "^2.2.1",
         "react-reconciler": "0.33.0",
         "react-render-to-markdown": "19.0.1",
-        "react-router-dom": "^7.15.0",
+        "react-router-dom": "^7.15.1",
         "rehype-external-links": "^3.0.0",
         "rehype-raw": "^7.0.0",
         "remark-cjk-friendly": "^2.0.1",
@@ -436,9 +436,9 @@
       }
     },
     "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.11.tgz",
-      "integrity": "sha512-DI9vod5mGccg57c19CuFpN3mGP1FEEueOUnEUz1UHXSyXg9YTj+ox7Xla4jUUzAzoPVGiWSSsfbtCTwdoxAsbg==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.12.tgz",
+      "integrity": "sha512-FGUxlS+dqgx/xp443pNzWZ82VicSXLRoX5LABipcZlqQptkALNGVEzz6Pa2zxpF+pqVw0dULZrDWmxZoEOlOMg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -449,9 +449,9 @@
       }
     },
     "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.11.tgz",
-      "integrity": "sha512-046LCHgbJXdaPipWB2SWMjZcAtIrOjXGZOD92xlTjhZ74D7Mk1Nod1MQdtOEoISWedcHdgpUVXMDbB1doKBpPQ==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.12.tgz",
+      "integrity": "sha512-gdXkw51jANjGvH4TR62HCekKGiYGWsCgswmDvn/ZSq4eIrdtGcjHm3/MOJ3cqRuH0oHzb2tFV3Y7f9Ml5H6Oyg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -462,13 +462,13 @@
       }
     },
     "node_modules/@rspress/shared": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.11.tgz",
-      "integrity": "sha512-7l5Pso4s597utJyisVEnd7n/40h053nfE8DwGQMeS8RLGtSwVgxFwNHsSrvQEGtFlLrg2aWWSITqnAVO1wfTew==",
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.12.tgz",
+      "integrity": "sha512-YTzaeMvxQRiMwCt5pk7CwkSBenp8HS+t1E82jFDhLwXPMChk7LHYazPGIuaNAoDMN1axW5EHtMUdZm7wVI8EdQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rsbuild/core": "^2.0.5",
+        "@rsbuild/core": "^2.0.6",
         "@shikijs/rehype": "^4.0.2",
         "unified": "^11.0.5"
       }
@@ -631,9 +631,9 @@
       }
     },
     "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
       "dev": true,
       "license": "MIT"
     },
@@ -700,9 +700,9 @@
       "license": "MIT"
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
-      "integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
+      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -1150,9 +1150,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/get-east-asian-width": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.5.0.tgz",
-      "integrity": "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/get-east-asian-width/-/get-east-asian-width-1.6.0.tgz",
+      "integrity": "sha512-QRbvDIbx6YklUe6RxeTeleMR0yv3cYH6PsPZHcnVn7xv7zO1BHN8r0XETu8n6Ye3Q+ahtSarc3WgtNWmehIBfA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2822,9 +2822,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.15.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.15.0.tgz",
-      "integrity": "sha512-HW9vYwuM8f4yx66Izy8xfrzCM+SBJluoZcCbww9A1TySax11S5Vgw6fi3ZjMONw9J4gQwngL7PzkyIpJJpJ7RQ==",
+      "version": "7.15.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.15.1.tgz",
+      "integrity": "sha512-R8rl9HhgikFYoPJymnUtPXWbnDb3oget6lQnfIoupbt61aT9aOhRkDsY2XRhZRyX1Z/8a5sL74fXmFNm3NRK5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2845,13 +2845,13 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.15.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.15.0.tgz",
-      "integrity": "sha512-VcrVg64Fo8nwBvDscajG8gRTLIuTC6N50nb22l2HOOV4PTOHgoGp8mUjy9wLiHYoYTSYI36tUnXZgasSRFZorQ==",
+      "version": "7.15.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.15.1.tgz",
+      "integrity": "sha512-AzF62gjY6U9rkMq4RfP/r2EVtQ7DMfNMjyOp/flLTCrtRylLiK4wT4pSq6O8rOXZ2eXdZYJPEYe+ifomiv+Igg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.15.0"
+        "react-router": "7.15.1"
       },
       "engines": {
         "node": ">=20.0.0"

renovate.json

@@ -5,7 +5,7 @@
     "osvVulnerabilityAlerts": true,
     "lockFileMaintenance": {
         "enabled": true,
-        "schedule": ["at any time"]
+        "schedule": ["* * * * 0,6"]
     },
     "platformAutomerge": true,
     "nix": {
@@ -66,6 +66,17 @@
             "matchUpdateTypes": ["minor", "patch"],
             "groupName": "github-actions-non-major"
         },
+        {
+            "description": "Batch GitHub Actions digest updates",
+            "matchManagers": ["github-actions"],
+            "matchUpdateTypes": ["digest"],
+            "groupName": "github-actions-digest",
+            "automerge": true,
+            "automergeStrategy": "fast-forward",
+            "schedule": [
+              "* 0-7 * * 2"
+            ]
+        },
         {
             "description": "Batch patch-level Node.js dependency updates",
             "matchManagers": ["npm"],
@@ -83,7 +94,10 @@
             "matchPackageNames": ["crate-ci/typos"],
             "matchUpdateTypes": ["minor", "patch"],
             "automerge": true,
-            "automergeStrategy": "fast-forward"
+            "automergeStrategy": "fast-forward",
+            "schedule": [
+              "* 0-7 * * 3"
+            ]
         },
         {
             "description": "Auto-merge renovatebot docker image updates",
@@ -91,7 +105,9 @@
             "matchPackageNames": ["ghcr.io/renovatebot/renovate"],
             "automerge": true,
             "automergeStrategy": "fast-forward",
-            "extends": ["schedule:earlyMondays"]
+            "schedule": [
+              "* 0-7 * * 1"
+            ]
         }
     ],
     "customManagers": [

rust-toolchain.toml

@@ -10,7 +10,7 @@
 
 [toolchain]
 profile = "minimal"
-channel = "1.92.0"
+channel = "1.95.0"
 components = [
     # For rust-analyzer
     "rust-src",

src/api/client/account/mod.rs

@@ -322,8 +322,6 @@ pub(crate) async fn check_registration_token_validity(
 /// Runs through all the deactivation steps:
 ///
 /// - Mark as deactivated
-/// - Removing display name
-/// - Removing avatar URL and blurhash
 /// - Removing all profile data
 /// - Leaving all rooms (and forgets all of them)
 pub async fn full_user_deactivate(

src/api/client/media.rs

@@ -21,7 +21,6 @@
 		},
 		media::create_content,
 	},
-	assign,
 };
 use service::media::mxc::Mxc;
 
@@ -76,17 +75,7 @@ pub(crate) async fn create_content_route(
 		return Err!(Request(Unknown("Failed to save uploaded media")));
 	}
 
-	let blurhash = body.generate_blurhash.then(|| {
-		services
-			.media
-			.create_blurhash(&body.file, content_type, filename)
-			.ok()
-			.flatten()
-	});
-
-	Ok(assign!(create_content::v3::Response::new(mxc.to_string().into()), {
-		blurhash: blurhash.flatten(),
-	}))
+	Ok(create_content::v3::Response::new(mxc.to_string().into()))
 }
 
 /// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`

src/api/client/membership/invite.rs

@@ -247,7 +247,6 @@ pub(crate) async fn invite_helper(
 	let mut content = RoomMemberEventContent::new(MembershipState::Invite);
 	content.displayname = services.users.displayname(recipient_user).await.ok();
 	content.avatar_url = services.users.avatar_url(recipient_user).await.ok();
-	content.blurhash = services.users.blurhash(recipient_user).await.ok();
 	content.is_direct = Some(is_direct);
 	content.reason = reason;
 

src/api/client/membership/knock.rs

@@ -343,7 +343,6 @@ async fn knock_room_helper_local(
 	let mut content = RoomMemberEventContent::new(MembershipState::Knock);
 	content.displayname = services.users.displayname(sender_user).await.ok();
 	content.avatar_url = services.users.avatar_url(sender_user).await.ok();
-	content.blurhash = services.users.blurhash(sender_user).await.ok();
 	content.reason.clone_from(&reason.clone());
 
 	// Try normal knock first
@@ -527,7 +526,6 @@ async fn knock_room_helper_remote(
 	let mut knock_content = RoomMemberEventContent::new(MembershipState::Knock);
 	knock_content.displayname = services.users.displayname(sender_user).await.ok();
 	knock_content.avatar_url = services.users.avatar_url(sender_user).await.ok();
-	knock_content.blurhash = services.users.blurhash(sender_user).await.ok();
 	knock_content.reason = reason;
 
 	knock_event_stub.insert(

src/api/client/membership/mod.rs

@@ -105,11 +105,7 @@ pub(crate) async fn banned_room_check(
 			return Err!(Request(Forbidden("This room is banned on this homeserver.")));
 		}
 	} else if let Some(server_name) = server_name {
-		if services
-			.config
-			.forbidden_remote_server_names
-			.is_match(server_name.host())
-		{
+		if services.moderation.is_remote_server_forbidden(server_name) {
 			warn!(
 				"User {user_id} who is not an admin tried joining a room which has the server \
 				 name {server_name} that is globally forbidden. Rejecting.",

src/api/client/message.rs

@@ -307,7 +307,7 @@ pub(crate) async fn is_ignored_pdu<Pdu>(
 	}
 
 	let sender_user = event.sender();
-	let type_ignored = IGNORED_MESSAGE_TYPES.binary_search(event.kind()).is_ok();
+	let type_ignored = IGNORED_MESSAGE_TYPES.contains(event.kind());
 	let server_ignored = services
 		.moderation
 		.is_remote_server_ignored(sender_user.server_name());

src/api/client/profile.rs

@@ -8,12 +8,12 @@
 	UserId,
 	api::{
 		client::profile::{
-			delete_profile_field, get_profile, get_profile_field, set_profile_field,
+			PropagateTo, delete_profile_field, get_profile, get_profile_field, set_profile_field,
 		},
 		federation,
 	},
 	assign,
-	events::room::member::{MembershipState, RoomMemberEventContent},
+	events::room::member::MembershipState,
 	presence::PresenceState,
 	profile::{ProfileFieldName, ProfileFieldValue},
 };
@@ -23,8 +23,7 @@
 
 /// # `GET /_matrix/client/v3/profile/{userId}`
 ///
-/// Returns the displayname, avatar_url, blurhash, and custom profile fields of
-/// the user.
+/// Returns the user's profile information.
 ///
 /// - If user is on another server and we do not have a local copy already,
 ///   fetch profile over federation.
@@ -63,8 +62,13 @@ pub(crate) async fn set_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}
 
-	set_profile_field(&services, &body.user_id, ProfileFieldChange::Set(body.value.clone()))
-		.await?;
+	set_profile_field(
+		&services,
+		&body.user_id,
+		ProfileFieldChange::Set(body.value.clone()),
+		body.propagate_to.clone(),
+	)
+	.await?;
 
 	Ok(set_profile_field::v3::Response::new())
 }
@@ -84,8 +88,13 @@ pub(crate) async fn delete_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}
 
-	set_profile_field(&services, &body.user_id, ProfileFieldChange::Delete(body.field.clone()))
-		.await?;
+	set_profile_field(
+		&services,
+		&body.user_id,
+		ProfileFieldChange::Delete(body.field.clone()),
+		body.propagate_to.clone(),
+	)
+	.await?;
 
 	Ok(delete_profile_field::v3::Response::new())
 }
@@ -120,7 +129,13 @@ async fn fetch_full_profile(
 			continue;
 		};
 
-		let _ = set_profile_field(services, user_id, ProfileFieldChange::Set(value)).await;
+		let _ = set_profile_field(
+			services,
+			user_id,
+			ProfileFieldChange::Set(value),
+			PropagateTo::None,
+		)
+		.await;
 	}
 
 	Some(BTreeMap::from_iter(response))
@@ -154,8 +169,13 @@ async fn fetch_profile_field(
 
 	if let Some(value) = response.get(field.as_str()).map(ToOwned::to_owned) {
 		if let Ok(value) = ProfileFieldValue::new(field.as_str(), value) {
-			let _ = set_profile_field(services, user_id, ProfileFieldChange::Set(value.clone()))
-				.await;
+			let _ = set_profile_field(
+				services,
+				user_id,
+				ProfileFieldChange::Set(value.clone()),
+				PropagateTo::None,
+			)
+			.await;
 
 			Ok(Some(value))
 		} else {
@@ -164,7 +184,13 @@ async fn fetch_profile_field(
 			)))
 		}
 	} else {
-		let _ = set_profile_field(services, user_id, ProfileFieldChange::Delete(field)).await;
+		let _ = set_profile_field(
+			services,
+			user_id,
+			ProfileFieldChange::Delete(field),
+			PropagateTo::None,
+		)
+		.await;
 
 		Ok(None)
 	}
@@ -257,6 +283,7 @@ async fn set_profile_field(
 	services: &Services,
 	user_id: &UserId,
 	change: ProfileFieldChange,
+	propagate_to: PropagateTo,
 ) -> Result<()> {
 	const MAX_KEY_LENGTH_BYTES: usize = 255;
 	const MAX_PROFILE_LENGTH_BYTES: usize = 65536;
@@ -304,6 +331,91 @@ async fn set_profile_field(
 		}
 	}
 
+	// If the user is local and changed their displayname or avatar_url, update it
+	// in all their joined rooms. This is done before updating their profile data
+	// so we can check the old value of the field if `propagate_to` is `unchanged`.
+	if matches!(field_name, ProfileFieldName::AvatarUrl | ProfileFieldName::DisplayName)
+		&& matches!(propagate_to, PropagateTo::All | PropagateTo::Unchanged)
+		&& services.globals.user_is_local(user_id)
+	{
+		let current_displayname = services.users.displayname(user_id).await.ok();
+		let current_avatar_url = services.users.avatar_url(user_id).await.ok();
+
+		let mut all_joined_rooms = services.rooms.state_cache.rooms_joined(user_id);
+
+		while let Some(room_id) = all_joined_rooms.next().await {
+			// TODO: this clobbers any custom fields on the event content
+			let mut current_membership = services
+				.rooms
+				.state_accessor
+				.get_member(&room_id, user_id)
+				.await
+				.expect("should be able to fetch membership event for joined room");
+
+			assert_eq!(
+				current_membership.membership,
+				MembershipState::Join,
+				"user should be joined"
+			);
+
+			// If `propagate_to` is `unchanged`, and the current value of the field we're
+			// updating was changed from its global value in this room, skip it.
+			if matches!(propagate_to, PropagateTo::Unchanged) {
+				let field_changed_from_global = match field_name {
+					| ProfileFieldName::AvatarUrl =>
+						current_membership.avatar_url.as_ref() != current_avatar_url.as_ref(),
+					| ProfileFieldName::DisplayName =>
+						current_membership.displayname.as_ref() != current_displayname.as_ref(),
+					| _ => unreachable!(),
+				};
+
+				if field_changed_from_global {
+					continue;
+				}
+			}
+
+			let state_lock = services.rooms.state.mutex.lock(room_id.as_str()).await;
+
+			// Preserve keys in accordance with the key copying rules
+			current_membership.reason = None;
+			current_membership.join_authorized_via_users_server = None;
+			match &change {
+				| ProfileFieldChange::Set(ProfileFieldValue::AvatarUrl(avatar_url)) => {
+					current_membership.avatar_url = Some(avatar_url.clone());
+				},
+				| ProfileFieldChange::Set(ProfileFieldValue::DisplayName(displayname)) => {
+					current_membership.displayname = Some(displayname.clone());
+				},
+				| ProfileFieldChange::Delete(ProfileFieldName::AvatarUrl) => {
+					current_membership.avatar_url = None;
+				},
+				| ProfileFieldChange::Delete(ProfileFieldName::DisplayName) => {
+					current_membership.displayname = None;
+				},
+				| _ => unreachable!(),
+			}
+
+			let _ = services
+				.rooms
+				.timeline
+				.build_and_append_pdu(
+					PartialPdu::state(user_id.to_string(), &current_membership),
+					user_id,
+					Some(&room_id),
+					&state_lock,
+				)
+				.await;
+		}
+
+		if services.config.allow_local_presence {
+			// Send a presence EDU to indicate the profile changed
+			let _ = services
+				.presence
+				.ping_presence(user_id, &PresenceState::Online)
+				.await;
+		}
+	}
+
 	match change {
 		| ProfileFieldChange::Set(ProfileFieldValue::DisplayName(displayname)) => {
 			services
@@ -322,56 +434,9 @@ async fn set_profile_field(
 			services.users.set_avatar_url(user_id, None);
 		},
 		| other =>
-			if other.field_name().as_str() == "blurhash" {
-				if let Some(Value::String(blurhash)) = other.value() {
-					services.users.set_blurhash(user_id, Some(blurhash));
-				} else {
-					services.users.set_blurhash(user_id, None);
-				}
-			} else {
-				services.users.set_profile_key(
-					user_id,
-					other.field_name().as_str(),
-					other.value(),
-				);
-			},
-	}
-
-	// If the user is local and changed their displayname or avatar_url, update it
-	// in all their joined rooms
-	if matches!(field_name, ProfileFieldName::AvatarUrl | ProfileFieldName::DisplayName)
-		&& services.users.is_active_local(user_id).await
-	{
-		let displayname = services.users.displayname(user_id).await.ok();
-		let avatar_url = services.users.avatar_url(user_id).await.ok();
-		let membership_content = assign!(
-			RoomMemberEventContent::new(MembershipState::Join), { displayname, avatar_url }
-		);
-
-		let mut all_joined_rooms = services.rooms.state_cache.rooms_joined(user_id);
-
-		while let Some(room_id) = all_joined_rooms.next().await {
-			let state_lock = services.rooms.state.mutex.lock(room_id.as_str()).await;
-
-			let _ = services
-				.rooms
-				.timeline
-				.build_and_append_pdu(
-					PartialPdu::state(user_id.to_string(), &membership_content),
-					user_id,
-					Some(&room_id),
-					&state_lock,
-				)
-				.await;
-		}
-
-		if services.config.allow_local_presence {
-			// Send a presence EDU to indicate the profile changed
-			let _ = services
-				.presence
-				.ping_presence(user_id, &PresenceState::Online)
-				.await;
-		}
+			services
+				.users
+				.set_profile_key(user_id, other.field_name().as_str(), other.value()),
 	}
 
 	Ok(())

src/api/client/report.rs

@@ -219,14 +219,14 @@ async fn is_event_report_valid(
 fn build_report(report: Report) -> RoomMessageEventContent {
 	let mut text =
 		format!("@room New {} report received from {}:\n\n", report.report_type, report.sender);
-	if report.user_id.is_some() {
-		let _ = writeln!(text, "- Reported User ID: `{}`", report.user_id.unwrap());
+	if let Some(user_id) = report.user_id {
+		let _ = writeln!(text, "- Reported User ID: `{user_id}`");
 	}
-	if report.room_id.is_some() {
-		let _ = writeln!(text, "- Reported Room ID: `{}`", report.room_id.unwrap());
+	if let Some(room_id) = report.room_id {
+		let _ = writeln!(text, "- Reported Room ID: `{room_id}`");
 	}
-	if report.event_id.is_some() {
-		let _ = writeln!(text, "- Reported Event ID: `{}`", report.event_id.unwrap());
+	if let Some(event_id) = report.event_id {
+		let _ = writeln!(text, "- Reported Event ID: `{event_id}`");
 	}
 	let _ = writeln!(text, "- Report Reason: {}", report.reason);
 

src/api/client/room/create.rs

@@ -10,7 +10,7 @@
 use futures::FutureExt;
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, Int, MilliSecondsSinceUnixEpoch, OwnedRoomAliasId,
-	OwnedRoomId, OwnedUserId, RoomAliasId, RoomId, RoomVersionId, UserId,
+	OwnedUserId, RoomAliasId, RoomId, RoomVersionId, UserId,
 	api::client::room::{self, create_room},
 	assign,
 	events::{
@@ -86,25 +86,41 @@ pub(crate) async fn create_room_route(
 	};
 	let room_version_rules = room_version.rules().unwrap();
 
-	let room_id: Option<OwnedRoomId> = match room_version_rules.room_id_format {
-		| RoomIdFormatVersion::V1 => {
-			// Check for custom room ID field
-			if let Some(CanonicalJsonValue::String(room_id)) =
-				body.json_body.as_ref().unwrap().get("room_id")
-			{
-				Some(
-					RoomId::parse(room_id)
-						.map_err(|_| err!(Request(BadJson("Malformed custom room ID"))))?,
-				)
-			} else {
-				Some(RoomId::new_v1(services.globals.server_name()))
-			}
-		},
+	// For custom room IDs, if the user is creating a room with a v1 room ID format,
+	// we can just use that ID directly. However, if it's a custom *v2* room ID, we
+	// need to make sure that we don't generate one, which would in turn trick us
+	// into generating invalid v2 room events.
+	//
+	// expect_room_id is the custom room ID that the user is expecting - for v2
+	// formatted rooms, we check that the m.room.create event's generated room ID
+	// exactly matches this, and abort if it doesn't. Otherwise, we use it as the
+	// room ID itself.
+	let expect_room_id = {
+		let body_ref = body.json_body.as_ref().unwrap();
+		if let Some(CanonicalJsonValue::String(room_id)) = body_ref
+			.get("fi.mau.room_id")
+			.or_else(|| body_ref.get("room_id"))
+		{
+			Some(
+				RoomId::parse(room_id)
+					.map_err(|e| err!(Request(BadJson("Malformed custom room ID: {e}"))))?,
+			)
+		} else {
+			None
+		}
+	};
+
+	let room_id = match room_version_rules.room_id_format {
+		| RoomIdFormatVersion::V1 => Some(
+			expect_room_id
+				.clone()
+				.unwrap_or_else(|| RoomId::new_v1(services.globals.server_name())),
+		),
 		| _ => None,
 	};
 
 	// check if room ID doesn't already exist instead of erroring on auth check
-	if let Some(ref room_id) = room_id {
+	if let Some(room_id) = room_id.as_ref().or(expect_room_id.as_ref()) {
 		if services.rooms.short.get_shortroomid(room_id).await.is_ok() {
 			return Err!(Request(RoomInUse("Room with that custom room ID already exists",)));
 		}
@@ -243,15 +259,16 @@ pub(crate) async fn create_room_route(
 
 	// Allow requesters to override the `origin_server_ts` to customize room ids
 	// from v12 onwards
-	let custom_origin_server_ts = body
-		.json_body
-		.as_ref()
-		.unwrap()
-		.get("origin_server_ts")
-		.and_then(CanonicalJsonValue::as_integer)
-		.map(Into::into)
-		.and_then(|value: i64| value.try_into().ok())
-		.map(MilliSecondsSinceUnixEpoch);
+	let custom_origin_server_ts = {
+		let body_ref = body.json_body.as_ref().unwrap();
+		body_ref
+			.get("origin_server_ts")
+			.or_else(|| body_ref.get("fi.mau.origin_server_ts"))
+			.and_then(CanonicalJsonValue::as_integer)
+			.map(Into::into)
+			.and_then(|value: i64| value.try_into().ok())
+			.map(MilliSecondsSinceUnixEpoch)
+	};
 
 	let create_event_id = services
 		.rooms
@@ -281,6 +298,13 @@ pub(crate) async fn create_room_route(
 	};
 	drop(state_lock);
 	debug!("Room created with ID {room_id}");
+	if let Some(expected_room_id) = expect_room_id
+		&& expected_room_id != room_id
+	{
+		return Err!(BadServerResponse(
+			"Room's final room ID was {room_id}, but expected {expected_room_id}"
+		));
+	}
 	let state_lock = services.rooms.state.mutex.lock(room_id.as_str()).await;
 
 	// 2. Let the room creator join
@@ -288,7 +312,6 @@ pub(crate) async fn create_room_route(
 	let mut join_event = RoomMemberEventContent::new(MembershipState::Join);
 	join_event.displayname = services.users.displayname(sender_user).await.ok();
 	join_event.avatar_url = services.users.avatar_url(sender_user).await.ok();
-	join_event.blurhash = services.users.blurhash(sender_user).await.ok();
 	join_event.is_direct = Some(body.is_direct);
 
 	debug_info!("Joining {sender_user} to room {room_id}");

src/api/client/room/upgrade.rs

@@ -271,7 +271,6 @@ pub(crate) async fn upgrade_room_route(
 				&assign!(RoomMemberEventContent::new(MembershipState::Join), {
 					displayname: services.users.displayname(sender_user).await.ok(),
 					avatar_url: services.users.avatar_url(sender_user).await.ok(),
-					blurhash: services.users.blurhash(sender_user).await.ok(),
 				}),
 			),
 			sender_user,

src/api/router/auth.rs

@@ -9,6 +9,7 @@
 			AccessToken, AccessTokenOptional, AppserviceToken, AppserviceTokenOptional,
 			AuthScheme, NoAccessToken, NoAuthentication,
 		},
+		client,
 		federation::authentication::ServerSignatures,
 	},
 };
@@ -85,10 +86,21 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 		let keys: PubKeyMap = [(output.origin.as_str().into(), keys)].into();
 
 		match output.verify_request(request, destination, &keys) {
-			| Ok(()) => Ok(Auth {
-				origin: Some(output.origin.clone()),
-				..Default::default()
-			}),
+			| Ok(()) => {
+				if services
+					.moderation
+					.is_remote_server_forbidden(&output.origin)
+				{
+					return Err!(Request(Forbidden(
+						"You are blocked from federating with this server."
+					)));
+				}
+
+				Ok(Auth {
+					origin: Some(output.origin.clone()),
+					..Default::default()
+				})
+			},
 			| Err(err) =>
 				Err!(Request(Unauthorized(warn!("Failed to verify X-Matrix header: {err}")))),
 		}
@@ -116,10 +128,9 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 					.await
 					.is_ok_and(std::convert::identity)
 				{
-					if !(route == TypeId::of::<ruma::api::client::session::logout::v3::Request>()
-						|| route
-							== TypeId::of::<ruma::api::client::session::logout_all::v3::Request>(
-							)) {
+					if !(route == TypeId::of::<client::session::logout::v3::Request>()
+						|| route == TypeId::of::<client::session::logout_all::v3::Request>())
+					{
 						return Err!(Request(Unauthorized("Your account is locked.")));
 					}
 				}
@@ -258,6 +269,19 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			err!(Request(Unauthorized(warn!("Failed to extract authorization: {}", err))))
 		})?;
 
+		// Check special access restrictions
+		if (route == TypeId::of::<client::profile::get_avatar_url::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_display_name::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile_field::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile::v3::Request>())
+			&& services.config.require_auth_for_profile_requests
+			&& token.is_none()
+		{
+			return Err!(Request(Unauthorized(
+				"This server requires authentication to access user profiles."
+			)));
+		}
+
 		<AccessTokenOptional as CheckAuth>::verify(services, token, request, query, route).await
 	}
 }

src/core/config/mod.rs

@@ -2117,10 +2117,6 @@ pub struct Config {
 	#[serde(default)]
 	pub antispam: Option<Antispam>,
 
-	/// display: nested
-	#[serde(default)]
-	pub blurhashing: BlurhashConfig,
-
 	/// Configuration for MatrixRTC (MSC4143) transport discovery.
 	/// display: nested
 	#[serde(default)]
@@ -2196,31 +2192,6 @@ pub struct WellKnownConfig {
 	pub support_pgp_key: Option<String>,
 }
 
-#[derive(Clone, Copy, Debug, Deserialize, Default)]
-#[allow(rustdoc::broken_intra_doc_links, rustdoc::bare_urls)]
-#[config_example_generator(filename = "conduwuit-example.toml", section = "global.blurhashing")]
-pub struct BlurhashConfig {
-	/// blurhashing x component, 4 is recommended by https://blurha.sh/
-	///
-	/// default: 4
-	#[serde(default = "default_blurhash_x_component")]
-	pub components_x: u32,
-	/// blurhashing y component, 3 is recommended by https://blurha.sh/
-	///
-	/// default: 3
-	#[serde(default = "default_blurhash_y_component")]
-	pub components_y: u32,
-	/// Max raw size that the server will blurhash, this is the size of the
-	/// image after converting it to raw data, it should be higher than the
-	/// upload limit but not too high. The higher it is the higher the
-	/// potential load will be for clients requesting blurhashes. The default
-	/// is 33.55MB. Setting it to 0 disables blurhashing.
-	///
-	/// default: 33554432
-	#[serde(default = "default_blurhash_max_raw_size")]
-	pub blurhash_max_raw_size: u64,
-}
-
 #[derive(Clone, Debug, Deserialize, Default)]
 #[config_example_generator(filename = "conduwuit-example.toml", section = "global.matrix_rtc")]
 pub struct MatrixRtcConfig {
@@ -2347,8 +2318,10 @@ pub struct SmtpConfig {
 	/// - `address@domain.org` to not use a name
 	pub sender: Mailbox,
 
-	/// Whether to require that users provide an email address when they
-	/// register.
+	/// Whether to allow public registration with an email address.
+	///
+	/// Note that, if this option is enabled, anyone will be able to register an
+	/// account with just an email address.
 	///
 	/// If either this option or `require_email_for_token_registration` are set,
 	/// users will not be allowed to remove their email address.
@@ -2358,7 +2331,8 @@ pub struct SmtpConfig {
 	pub require_email_for_registration: bool,
 
 	/// Whether to require that users who register with a registration token
-	/// provide an email address.
+	/// provide an email address. This option is independent of
+	/// `require_email_for_registration`.
 	///
 	/// default: false
 	#[serde(default)]
@@ -2752,13 +2726,3 @@ fn default_client_response_timeout() -> u64 { 120 }
 fn default_client_shutdown_timeout() -> u64 { 15 }
 
 fn default_sender_shutdown_timeout() -> u64 { 5 }
-
-// blurhashing defaults recommended by https://blurha.sh/
-// 2^25
-pub(super) fn default_blurhash_max_raw_size() -> u64 { 33_554_432 }
-
-pub(super) fn default_blurhash_x_component() -> u32 { 4 }
-
-pub(super) fn default_blurhash_y_component() -> u32 { 3 }
-
-// end recommended & blurhashing defaults

src/core/matrix/versions.rs

@@ -42,5 +42,6 @@ pub fn unstable_features() -> BTreeMap<String, bool> {
 		("org.matrix.simplified_msc3575".to_owned(), true), /* Simplified Sliding sync (https://github.com/matrix-org/matrix-spec-proposals/pull/4186) */
 		("uk.timedout.msc4323".to_owned(), true), /* agnostic suspend (https://github.com/matrix-org/matrix-spec-proposals/pull/4323) */
 		("org.matrix.msc4155".to_owned(), true), /* invite filtering (https://github.com/matrix-org/matrix-spec-proposals/pull/4155) */
+		("computer.gingershaped.msc4466".to_owned(), true), /* profile change propagation (https://github.com/matrix-org/matrix-spec-proposals/pull/4466) */
 	])
 }

src/core/utils/tests.rs

@@ -284,11 +284,11 @@ fn is_within_bounds() {
 	use utils::time::{TimeDirection, is_within_bounds};
 
 	let now = SystemTime::now();
-	let yesterday = now - Duration::from_secs(86400);
+	let yesterday = now - Duration::from_hours(24);
 	assert!(is_within_bounds(yesterday, now, TimeDirection::Before));
 	assert!(!is_within_bounds(yesterday, now, TimeDirection::After));
 
-	let tomorrow = now + Duration::from_secs(86400);
+	let tomorrow = now + Duration::from_hours(24);
 	assert!(is_within_bounds(tomorrow, now, TimeDirection::After));
 	assert!(!is_within_bounds(tomorrow, now, TimeDirection::Before));
 

src/database/maps.rs

@@ -376,7 +376,7 @@ pub(super) fn open_list(db: &Arc<Engine>, maps: &[Descriptor]) -> Result<Maps> {
 	},
 	Descriptor {
 		name: "userid_blurhash",
-		..descriptor::RANDOM_SMALL
+		..descriptor::DROPPED
 	},
 	Descriptor {
 		name: "userid_dehydrateddevice",

src/main/Cargo.toml

@@ -47,7 +47,6 @@ default = [
 	"bindgen-runtime", # replace with bindgen-static on alpine
 ]
 standard = [
-    "blurhashing",
 	"brotli_compression",
 	"element_hacks",
 	"gzip_compression",
@@ -71,9 +70,6 @@ full = [
     "tokio_console",
 ]
 
-blurhashing = [
-	"conduwuit-service/blurhashing",
-]
 brotli_compression = [
 	"conduwuit-api/brotli_compression",
 	"conduwuit-core/brotli_compression",

src/service/Cargo.toml

@@ -16,10 +16,6 @@ crate-type = [
 ]
 
 [features]
-blurhashing = [
-	"dep:image",
-	"dep:blurhash",
-]
 brotli_compression = [
 	"conduwuit-core/brotli_compression",
 	"reqwest/brotli",
@@ -119,8 +115,6 @@ tracing.workspace = true
 url.workspace = true
 webpage.workspace = true
 webpage.optional = true
-blurhash.workspace = true
-blurhash.optional = true
 recaptcha-verify = { version = "0.2.0", default-features = false }
 reqwest_recaptcha = { package = "reqwest", version = "0.12.28", default-features = false, features = ["rustls-tls-native-roots-no-provider"]  } # As long as recaptcha-verify's reqwest is outdated
 yansi.workspace = true

src/service/media/blurhash.rs

@@ -1,179 +0,0 @@
-#[cfg(feature = "blurhashing")]
-use conduwuit::config::BlurhashConfig as CoreBlurhashConfig;
-use conduwuit::{Result, implement};
-
-use super::Service;
-
-#[implement(Service)]
-#[cfg(not(feature = "blurhashing"))]
-pub fn create_blurhash(
-	&self,
-	_file: &[u8],
-	_content_type: Option<&str>,
-	_file_name: Option<&str>,
-) -> Result<Option<String>> {
-	conduwuit::debug_warn!("blurhashing on upload support was not compiled");
-
-	Ok(None)
-}
-
-#[implement(Service)]
-#[cfg(feature = "blurhashing")]
-pub fn create_blurhash(
-	&self,
-	file: &[u8],
-	content_type: Option<&str>,
-	file_name: Option<&str>,
-) -> Result<Option<String>> {
-	let config = BlurhashConfig::from(self.services.server.config.blurhashing);
-
-	// since 0 means disabled blurhashing, skipped blurhashing
-	if config.size_limit == 0 {
-		return Ok(None);
-	}
-
-	get_blurhash_from_request(file, content_type, file_name, config)
-		.map_err(|e| conduwuit::err!(debug_error!("blurhashing error: {e}")))
-		.map(Some)
-}
-
-/// Returns the blurhash or a blurhash error which implements Display.
-#[tracing::instrument(
-	name = "blurhash",
-	level = "debug",
-	skip(data),
-	fields(
-		bytes = data.len(),
-	),
-)]
-#[cfg(feature = "blurhashing")]
-fn get_blurhash_from_request(
-	data: &[u8],
-	mime: Option<&str>,
-	filename: Option<&str>,
-	config: BlurhashConfig,
-) -> Result<String, BlurhashingError> {
-	// Get format image is supposed to be in
-	let format = get_format_from_data_mime_and_filename(data, mime, filename)?;
-
-	// Get the image reader for said image format
-	let decoder = get_image_decoder_with_format_and_data(format, data)?;
-
-	// Check image size makes sense before unpacking whole image
-	if is_image_above_size_limit(&decoder, config) {
-		return Err(BlurhashingError::ImageTooLarge);
-	}
-
-	let image = image::DynamicImage::from_decoder(decoder)?;
-
-	blurhash_an_image(&image, config)
-}
-
-/// Gets the Image Format value from the data,mime, and filename
-/// It first checks if the mime is a valid image format
-/// Then it checks if the filename has a format, otherwise just guess based on
-/// the binary data Assumes that mime and filename extension won't be for a
-/// different file format than file.
-#[cfg(feature = "blurhashing")]
-fn get_format_from_data_mime_and_filename(
-	data: &[u8],
-	mime: Option<&str>,
-	filename: Option<&str>,
-) -> Result<image::ImageFormat, BlurhashingError> {
-	let extension = filename
-		.map(std::path::Path::new)
-		.and_then(std::path::Path::extension)
-		.map(std::ffi::OsStr::to_string_lossy);
-
-	mime.or(extension.as_deref())
-		.and_then(image::ImageFormat::from_mime_type)
-		.map_or_else(|| image::guess_format(data).map_err(Into::into), Ok)
-}
-
-#[cfg(feature = "blurhashing")]
-fn get_image_decoder_with_format_and_data(
-	image_format: image::ImageFormat,
-	data: &[u8],
-) -> Result<Box<dyn image::ImageDecoder + '_>, BlurhashingError> {
-	let mut image_reader = image::ImageReader::new(std::io::Cursor::new(data));
-	image_reader.set_format(image_format);
-	Ok(Box::new(image_reader.into_decoder()?))
-}
-
-#[cfg(feature = "blurhashing")]
-fn is_image_above_size_limit<T: image::ImageDecoder>(
-	decoder: &T,
-	blurhash_config: BlurhashConfig,
-) -> bool {
-	decoder.total_bytes() >= blurhash_config.size_limit
-}
-
-#[cfg(feature = "blurhashing")]
-#[tracing::instrument(name = "encode", level = "debug", skip_all)]
-#[inline]
-fn blurhash_an_image(
-	image: &image::DynamicImage,
-	blurhash_config: BlurhashConfig,
-) -> Result<String, BlurhashingError> {
-	Ok(blurhash::encode_image(
-		blurhash_config.components_x,
-		blurhash_config.components_y,
-		&image.to_rgba8(),
-	)?)
-}
-
-#[derive(Clone, Copy, Debug)]
-pub struct BlurhashConfig {
-	pub components_x: u32,
-	pub components_y: u32,
-
-	/// size limit in bytes
-	pub size_limit: u64,
-}
-
-#[cfg(feature = "blurhashing")]
-impl From<CoreBlurhashConfig> for BlurhashConfig {
-	fn from(value: CoreBlurhashConfig) -> Self {
-		Self {
-			components_x: value.components_x,
-			components_y: value.components_y,
-			size_limit: value.blurhash_max_raw_size,
-		}
-	}
-}
-
-#[derive(Debug)]
-#[cfg(feature = "blurhashing")]
-pub enum BlurhashingError {
-	HashingLibError(Box<dyn std::error::Error + Send>),
-	#[cfg(feature = "blurhashing")]
-	ImageError(Box<image::ImageError>),
-	ImageTooLarge,
-}
-
-#[cfg(feature = "blurhashing")]
-impl From<image::ImageError> for BlurhashingError {
-	fn from(value: image::ImageError) -> Self { Self::ImageError(Box::new(value)) }
-}
-
-#[cfg(feature = "blurhashing")]
-impl From<blurhash::Error> for BlurhashingError {
-	fn from(value: blurhash::Error) -> Self { Self::HashingLibError(Box::new(value)) }
-}
-
-#[cfg(feature = "blurhashing")]
-impl std::fmt::Display for BlurhashingError {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		write!(f, "Blurhash Error:")?;
-		match &self {
-			| Self::ImageTooLarge => write!(f, "Image was too large to blurhash")?,
-			| Self::HashingLibError(e) =>
-				write!(f, "There was an error with the blurhashing library => {e}")?,
-			#[cfg(feature = "blurhashing")]
-			| Self::ImageError(e) =>
-				write!(f, "There was an error with the image loading library => {e}")?,
-		}
-
-		Ok(())
-	}
-}

src/service/media/mod.rs

@@ -1,4 +1,3 @@
-pub mod blurhash;
 mod data;
 pub(super) mod migrations;
 pub mod mxc;

src/service/rooms/membership/mod.rs

@@ -73,7 +73,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				db: args.db.clone(),
 				antispam: args.depend::<antispam::Service>("antispam"),
 				globals: args.depend::<globals::Service>("globals"),
-				metadata: args.depend::<metadata::Service>("metadata"),
+				metadata: args.depend::<metadata::Service>("rooms::metadata"),
 				outlier: args.depend::<outlier::Service>("rooms::outlier"),
 				sending: args.depend::<sending::Service>("sending"),
 				server_keys: args.depend::<server_keys::Service>("server_keys"),
@@ -240,7 +240,6 @@ async fn join_local_room(
 		let mut content = RoomMemberEventContent::new(MembershipState::Join);
 		content.displayname = self.services.users.displayname(sender_user).await.ok();
 		content.avatar_url = self.services.users.avatar_url(sender_user).await.ok();
-		content.blurhash = self.services.users.blurhash(sender_user).await.ok();
 		content.reason.clone_from(&reason);
 		content.join_authorized_via_users_server = auth_user;
 
@@ -351,7 +350,6 @@ async fn join_remote_room(
 		let mut join_content = RoomMemberEventContent::new(MembershipState::Join);
 		join_content.displayname = self.services.users.displayname(sender_user).await.ok();
 		join_content.avatar_url = self.services.users.avatar_url(sender_user).await.ok();
-		join_content.blurhash = self.services.users.blurhash(sender_user).await.ok();
 		join_content.reason = reason;
 		join_content
 			.join_authorized_via_users_server

src/service/users/mod.rs

@@ -79,7 +79,6 @@ struct Data {
 	userdeviceid_token: Arc<Map>,
 	userfilterid_filter: Arc<Map>,
 	userid_avatarurl: Arc<Map>,
-	userid_blurhash: Arc<Map>,
 	userid_dehydrateddevice: Arc<Map>,
 	userid_devicelistversion: Arc<Map>,
 	userid_displayname: Arc<Map>,
@@ -120,7 +119,6 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				userdeviceid_token: args.db["userdeviceid_token"].clone(),
 				userfilterid_filter: args.db["userfilterid_filter"].clone(),
 				userid_avatarurl: args.db["userid_avatarurl"].clone(),
-				userid_blurhash: args.db["userid_blurhash"].clone(),
 				userid_dehydrateddevice: args.db["userid_dehydrateddevice"].clone(),
 				userid_devicelistversion: args.db["userid_devicelistversion"].clone(),
 				userid_displayname: args.db["userid_displayname"].clone(),
@@ -430,20 +428,6 @@ pub fn set_avatar_url(&self, user_id: &UserId, avatar_url: Option<OwnedMxcUri>)
 		}
 	}
 
-	/// Get the blurhash of a user.
-	pub async fn blurhash(&self, user_id: &UserId) -> Result<String> {
-		self.db.userid_blurhash.get(user_id).await.deserialized()
-	}
-
-	/// Sets a new avatar_url or removes it if avatar_url is None.
-	pub fn set_blurhash(&self, user_id: &UserId, blurhash: Option<String>) {
-		if let Some(blurhash) = blurhash {
-			self.db.userid_blurhash.insert(user_id, blurhash);
-		} else {
-			self.db.userid_blurhash.remove(user_id);
-		}
-	}
-
 	/// Adds a new device to a user.
 	pub async fn create_device(
 		&self,
@@ -1379,7 +1363,6 @@ pub fn set_profile_key(
 	pub async fn clear_profile(&self, user_id: &UserId) {
 		self.set_displayname(user_id, None);
 		self.set_avatar_url(user_id, None);
-		self.set_blurhash(user_id, None);
 		self.all_profile_keys(user_id)
 			.ready_for_each(|(key, _)| self.set_profile_key(user_id, &key, None))
 			.await;