v1.1.0

Dashboard origin

• Move trusted dashboard pages and management APIs to an independent loopback listener on port 24051 (DASHBOARD_IP/DASHBOARD_PORT), keeping overlay URLs on port 24050 so localStorage and IndexedDB remain intact. Add /api/dashboard discovery and safe path/query-preserving redirects for old dashboard links. Tray, startup and second-instance links follow the dashboard listener.
• Reject overlay-origin management mutations, require dashboard provenance plus a per-start CSRF token, and never serve overlay scripts on the dashboard origin. Scoped API keys, profiles, broker tokens and overlay command-socket settings remain compatible.
• Add explicit network Apply with server-side 30-second automatic rollback unless confirmed from the new dashboard origin. Rebind both listeners independently. Support IPv4/IPv6 CIDR allowlists, including the precise Tailscale 100.64.0.0/10 range, alongside legacy wildcard octets.
• Harden dashboard HTML with inert runtime context, CSP, Host checks, and no dashboard WebSocket upgrades. Network rollback targets cannot come from URL parameters; pending edits survive crashes as rollback journals, Keep checks both listeners, and dashboard binds cannot reuse recorded overlay origins.
• Print full clickable overlay/API and dashboard URLs at startup and after successful rebinds, mapping wildcard binds to loopback.
• Allow loopback native broker credentials to save HTTP settings values and manage profiles, with authorization rechecked after body reads; grant no schema or management authority.
• Dashboard pages cannot be framed by other sites.

Dashboard

• Manage settings profiles from a dropdown and overflow menu (Create, Copy, Rename, Delete, Set as default) with in-app naming and delete confirmation.
• Match API-key management to the runtime settings groups and rows, with compact permission dialogs, per-key overflow actions and a copyable show-once dialog.
• Restore mouse dragging of pinned overlays with a visible insertion marker, retaining keyboard menu moves and the existing dashboard-origin saved order.
• Add permanent local dismissal of the community-overlay notice and an About link to reopen it.
• Keep installed previews at or below their native size and label reduced previews with their scale.
• Give overlay updates a warning-coloured action, remove redundant settings badges, and use styled update/delete dialogs with the folder path and a bounded on-disk file-size scan.
• Match Installed cards against the catalog too, so their update action is visible without visiting Available; update the actual local folder even if it has a custom name. Hide empty author segments rather than leaving doubled metadata separators.
• Show per-instance attachment/version/polling information and identified live WebSocket connection counts. Counts include previews and profile-qualified command sockets, not unique users; unidentified connections are intentionally omitted.
• Present allowlist entries one per line, warn about public-space CIDR ranges (including 0.0.0.0/0 and ::/0) and broad wildcards, add interval units, simplify subscription wording, and make the catalog notice collapsible with quieter carousel controls and normalized display metadata.
• Rename "Download report" to "Diagnostics report".

Overlay settings

• Add named, revocable, hash-only API keys with fixed settings/profile scopes,
  same-origin dashboard management, native Bearer HTTP/WebSocket authentication,
  browser WebSocket subprotocol authentication, and immediate open-socket revocation.
  Revocation actively closes idle sockets and rejects in-flight POSTs whose bodies
  finish after revocation; warn about unsafe Unix registry ownership/permissions.

• Add per-start private broker credentials for loopback command WebSockets, so
  counters hosted by native overlay brokers can save and relay settings without
  forging Origin. Invalid credentials fail the upgrade with 401; HTTP management
  authorization and headerless read-only behavior remain unchanged.
  Treat Bearer scheme names case-insensitively and ignore other auth schemes;
  publication failures warn and disable broker writes without stopping serving.
  The credential file is replaced atomically at each start and never deleted; a
  stopped daemon's token is stale.

• Add named settings profiles with a default profile for unpinned overlays, per-instance
  vosuProfile overrides, a management API, and profile-aware command refreshes.
  The reserved default profile retains existing values files.

• Add profile management, title/description/ID search, and section navigation to
  the dashboard's card settings and inline /settings?overlay= editors.

Gameplay

• Added opt-in ENABLE_MANIA_KEY_HIT_ERRORS (default false) and vosu v2/precise keyHitErrors per-column press/release arrays. Stable preserves matched displayed lanes, including Mirror; lazer reads object columns and mirrors hold-release corrections.
• Added opt-in ENABLE_HIT_OFFSETS (default false) for vosu v2 play.hitOffsets and precise hitOffsets: flat cursor-x/y-offset
  and timing-error triples for osu!standard circles and slider heads, with
  incremental replay/map matching on stable and judgement-position reads on lazer.
  Stable under HR reflects positions before applying the stack offset, as the game does.
• osu!lazer: the embedded offsets now include the mania column, catch catcher and
  standard hit-object position fields, so keyHitErrors, catcher and hitOffsets
  work on lazer 2026.921.0 without runtime generation. A cached offsets file
  generated before an update that adds offset fields is regenerated instead of
  silently leaving those features off.
• osu!lazer: runtime offset generation no longer fails intermittently with a crash
  in osu.Game.Skinning.Skin finalization; the daemon previously retried and
  sometimes ran without offsets for a while.
• osu!stable mania: a final hit error that matches no key press or release is now also published as a press after the play ends. In 1.0.2 the one-second fallback only ran during play, so such a hit could stay missing from pressHitErrors on the results screen.
• Stable keys.all now uses replay-frame logical actions with lazer-compatible B names/order, frame-time transitions and incremental counts, independently of in-game overlay visibility. Legacy key members and configuration gating are unchanged. Catch movement actions remain unpressed because stable records positions rather than left/right input; dash is recorded. Preloaded replay capture follows the play clock. Lazer now accepts the full 20-action dual-stage mania range.
• Catch: v2 play and precise payloads expose a vosu-only catcher object with the client's playfield x and ordinary dashing state, omitted outside catch gameplay. Stable samples by current play time even for preloaded replays and without new hit errors; lazer uses precise native field reads.

Command line

• vosu -V and vosu --version print the version and exit. Previously the flag was ignored, so vosu started the daemon, or opened the running instance's dashboard and exited.

Performance

• osu!lazer settings are read in a handful of batched native reads instead of two reads per configuration entry, which removes most of a regular lazer capture's cost.
• Other osu!lazer state (gameplay score and leaderboard entry, user, multiplayer room and ranked play, menu checksum, global state, skin name) also reads independent fields together, and pointers the capture reuses (game services, the current screen's fields) are read once per capture.
• osu!stable regular captures batch pointer chains and related fields, reusing per-capture reads with sequential recovery when a batched read fails. The osu!lazer menu now batches its full traversal as well.
• Linux: nearby fields requested together share one native read range, and each native read checks the process generation once, after the read, instead of before and after it. A reused PID or exited process is still rejected.
• Selected-field v2 subscriptions share extraction and encoded frames for matching plans and baselines, write frames into shared bounded chunks, and skip memoization for plans used by only one client. Wire frames and latest-only delivery are unchanged.
• Selected-field subscriptions deliver changes with fewer locks, allocations, and wakeups while retaining bounded queues and latest-only delivery.
• Cold API serialization avoids repeated output-buffer growth; the high-rate v2 precise document writes directly from snapshot data without building an owned response first, preserving the existing JSON contract.
• Unfiltered v1, v2, and streamCompanion responses now write directly from snapshots without first building owned response documents, preserving JSON bytes and field semantics.
• Filtered compatibility WebSockets project only requested DTO fields directly, rather than materializing full JSON and typed trees. Identical ordered filter plans share encoded bytes within each broadcast pass, with at most 64 retained variants and 1 MiB of payload bytes; filters beyond either bound are still served without cache retention.
• Distinct filtered WebSocket plans reuse a broadcast's schema document and write only selected fields; frequently visited properties share bounded projection work even when clients request different filters.

Packaging

• Release builds now create a draft GitHub release. The release key signs the draft's files and then publishes it, because the repository's immutable releases reject new files after publication.
• v1.0.2 was published before it could be signed and has no .sig files. Verify its downloads with GitHub's release attestation instead: gh release verify-asset v1.0.2 <file> --repo shiruviaa/vosu.

Code signing policy

SignPath signing is not active yet, so this release's Windows executable is unsigned. See the code signing policy.

Privacy policy · Security and installation disclosure