v1.0.2

Gameplay

• osu!stable mania: pressHitErrors and releaseHitErrors no longer stop updating for the rest of a play when stable records two judgements from the same millisecond in a different order than the map lists them (for example two hold notes released together). Hits kept appearing in hitErrorArray but stopped reaching the press/release arrays, so overlays reading them lost every later hit.
• osu!stable mania: a hit error that cannot be matched to a key press or release no longer holds back later hits. It is published as a press once the replay has moved 250 ms past it or one second has passed.
• osu!stable mania: hold-note releases are now classified with the Mirror mod. Before, Mirror plays published every hit as a press.
• osu!stable: reading the hit-error list while the game grew it could pair the new length with the old storage and replace that hit's error with a made-up 0. vosu now reads the length first, which always matches the storage it reads.
• The selected-field subscription README section no longer documents an application-level ["ping", nonce] heartbeat that was never implemented; any text sent after subscribing closes the connection with code 1008.

Packaging

• The AUR package is now vosu-git, built from main with packaging/aur/PKGBUILD. Releases no longer include the vosu-bin-aur-v<version>.tar.gz bundle.
• Release files, commits and tags are signed with an OpenPGP release key (6F0F 0D30 C09D 3A03 6246 A810 2CB6 524B B54B 2CDA), starting with the published 1.0.1 files; each <file>.sig sits next to its file on the release page. The public key is packaging/release-signing-key.asc.

Licensing

• tosu's copyright holder, Mikhail Babynichev, gave written permission on 2026-10-12 for vosu's tosu-derived Rust (memory readers, API, state and related code) to be distributed under MIT OR Apache-2.0 with tosu credited. THIRD_PARTY_NOTICES.md and the provenance audit record the permission and its scope; it does not cover the LGPL calculator wrapper reference.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure