chore: Bump version & cut changelog

Reviewed-By: Jacob Taylor <jacob@explodie.org>

CHANGELOG.md

@@ -1,3 +1,14 @@
+# Continuwuity 0.5.9 (2026-05-07)
+
+## Security
+
+- Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a
+  singular transaction. Contributed by @nex. (#1711)
+- Fixed a bug that caused the server to panic while handling transactions with malformed events, resulting in a 
+  deadlock that prevented the remote server from federating with us until the server was restarted. Contributed by @nex.
+- Fixed a bug that resulted in the `m.federate` field of `m.room.create` being ignored in v12 rooms, allowing remote 
+  servers to participate in local-only rooms. Contributed by @nex, reported by [@mat:emzee.ee](matrix:u/mat:emzee.ee?action=chat).
+
 # Continuwuity 0.5.8 (2026-04-24)
 
 ## Features

Cargo.lock

@@ -960,7 +960,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "aws-lc-rs",
  "clap",
@@ -997,7 +997,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "clap",
  "conduwuit_api",
@@ -1020,7 +1020,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "async-trait",
  "axum",
@@ -1055,7 +1055,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "built",
  "cargo_metadata",
@@ -1063,7 +1063,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_core"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -1127,7 +1127,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1147,7 +1147,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "cargo_toml",
  "itertools 0.14.0",
@@ -1158,7 +1158,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "axum",
  "axum-client-ip",
@@ -1194,7 +1194,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "askama",
  "async-trait",
@@ -1242,7 +1242,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "askama",
  "async-trait",
@@ -7017,7 +7017,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "0.5.8"
+version = "0.5.9"
 dependencies = [
  "askama",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "0.5.8"
+version = "0.5.9"
 
 [workspace.metadata.crane]
 name = "conduwuit"

changelog.d/1711.bugfix

@@ -1 +0,0 @@
-Fixed a bug that caused the server to drop events during processing if several events for the same room were sent in a singular transaction. Contributed by @nex.

src/core/matrix/state_res/event_auth.rs

@@ -332,8 +332,7 @@ pub async fn auth_check<E, F, Fut>(
 	// If the create event content has the field m.federate set to false and the
 	// sender domain of the event does not match the sender domain of the create
 	// event, reject.
-	if !room_version.room_ids_as_hashes
-		&& !room_create_content.federate
+	if !room_create_content.federate
 		&& room_create_event.sender().server_name() != incoming_event.sender().server_name()
 	{
 		warn!(