v0.4.5.2

What's Changed

• chore(deps): Bump modernc.org/sqlite from 1.60.1 to 1.61.0 in the go group by @dependabot[bot] in #88
• chore(ci): Bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 in the actions group by @dependabot[bot] in #89

Full Changelog: v0.4.5.1...v0.4.5.2

v0.4.5.1

What's Changed

• osv: ignore GO-2026-5932 (x/crypto/openpgp, not imported) by @Yoshiofthewire in #83
• Add Go fuzz tests for client IP, trusted proxies, brand patch and media index by @Yoshiofthewire in #84
• Silver criteria: repeatable build, release verification, contributing and coding standard, assurance case by @Yoshiofthewire in #85
• ci: build with the Go version go.mod names by @Yoshiofthewire in #86
• Bind the CSRF token to its session by @Yoshiofthewire in #87
• docs: add license, contributing, security, and code of conduct by @Yoshiofthewire in #90
• Add OpenSSF Best Practices and Scorecard badges by @Yoshiofthewire in #91
• feat: unify Busnes console and truthful status presentation by @Yoshiofthewire in #93
• appearance: theme page for every role, no header select by @Yoshiofthewire in #95
• Let any signed-in admin run a manual backup deposit by @Yoshiofthewire in #94
• Sync ky-ui 0.4.1 classic theme catalog by @Yoshiofthewire in #96

Full Changelog: v0.4.5...v0.4.5.1

v0.4.5

What's Changed

• Fix KyMessages launch-video bugs: Users note tone, Podman and sign-in docs by @Yoshiofthewire in #76
• Bump Node to 26.12.1 (CVE-2026-111497) by @Yoshiofthewire in #77
• Release Dependabot changes daily as vX.Y.Z.N by @Yoshiofthewire in #78
• build: Go 1.27.3 for GO-2026-6809, vitest 5.0.5 by @Yoshiofthewire in #79
• fix(compat): tidy after ky-primitives replace; bump x/crypto to v0.58.0 by @Yoshiofthewire in #80
• docs: use example.com and example.net for the deploy hostnames by @Yoshiofthewire in #81
• release: v0.4.5 by @Yoshiofthewire in #82

Full Changelog: v0.4.4...v0.4.5

v0.4.4

What's Changed

• docs: state that KyMessages is installed and tested by @Yoshiofthewire in #69
• Meeting notes: an invited bot that takes notes in calls by @Yoshiofthewire in #71
• Meeting notes: shared-screen snapshots (opt-in) by @Yoshiofthewire in #72
• fix: keep chat for assigned members; offboarding ends MAS sessions (0.4.4) by @Yoshiofthewire in #73

Full Changelog: v0.4.3...v0.4.4

v0.4.3

What's Changed

• docs: check the attested commit when verifying a release image by @Yoshiofthewire in #57
• chore(deps): Bump golang.org/x/term from 0.46.0 to 0.47.0 in the go group by @dependabot[bot] in #58
• chore(deps): Bump node from 143494b to 6f08a52 by @dependabot[bot] in #59
• chore(ci): Bump the actions group with 2 updates by @dependabot[bot] in #60
• Design KyCalendar meeting rooms with a guest waiting room (docs only) by @Yoshiofthewire in #61
• docs: record the guest window and who may admit by @Yoshiofthewire in #62
• docs: desk results of the meeting-room guest spikes by @Yoshiofthewire in #63
• Polish KyMessage interface while preserving controls and settings by @Yoshiofthewire in #65
• fix: installer setup under stock Compose; CLI seals carry installer credentials; drill exit code by @Yoshiofthewire in #64
• Remove obsolete console device pairing by @Yoshiofthewire in #66
• docs: clarify standalone installation and test coverage by @Yoshiofthewire in #67
• Shorten README and organize documentation by topic by @Yoshiofthewire in #68
• fix: installer-compatible secure defaults; apply-setup says why it refuses by @Yoshiofthewire in #70

Full Changelog: v0.4.2...v0.4.3

v0.4.2

What's Changed

• Security audit run 2 fixes by @Yoshiofthewire in #1
• Security audit run 2 follow-ups: webhook replay, half-written pins by @Yoshiofthewire in #2
• Directory webhook speaks KyIdentity's suite-webhook contract by @Yoshiofthewire in #3
• Per-thread auto-purge: Off/1/7/30/90, default 90 by @Yoshiofthewire in #4
• Backups: people capsule, opt-in message backups, restore-messages and device resume by @Yoshiofthewire in #5
• Backup follow-ups: route tests, clearer overflow errors, docs refresh by @Yoshiofthewire in #6
• Client readiness: My account, proxy deployment, browser support, chat-core behind a gate by @Yoshiofthewire in #7
• Chat follows the suite review process, not an independent-audit gate by @Yoshiofthewire in #8
• Rename KySignOn to KyIdentity (text, env, routes, stored provider) by @Yoshiofthewire in #9
• Docs: chat platform options (custom MLS vs Matrix vs XMPP, bridges to personal and team networks) by @Yoshiofthewire in #10
• Remove the isolated MLS client, chat-core package and their CI (pure deletion) by @Yoshiofthewire in #12
• Matrix sub-project 1: remove the custom messaging stack by @Yoshiofthewire in #11
• Land #11 on master (Matrix sub-project 1: remove the custom messaging stack) by @Yoshiofthewire in #13
• Matrix sub-project 2: Matrix stack and KyIdentity sign-in by @Yoshiofthewire in #14
• Matrix sub-project 3: offboarding (back-channel logout + MAS sync) by @Yoshiofthewire in #15
• Matrix sub-project 4: server backups (capsule dumps, encrypted media, whole-stack restore) by @Yoshiofthewire in #16
• Matrix sub-project 5a: console — users, health, audit by @Yoshiofthewire in #17
• Matrix sub-project 5b: console — rooms by @Yoshiofthewire in #18
• Console 5c: branding and KyIdentity sync status by @Yoshiofthewire in #19
• docs: PRODUCT.md describes KyMessages on Matrix as shipped by @Yoshiofthewire in #20
• test: count relations in a scratch database, not the shared one by @Yoshiofthewire in #21
• Fix 17 deferred review minors; harden the acceptance media step by @Yoshiofthewire in #22
• K80/K81 deploy: Element restart hint is configurable; deploy spec and plan by @Yoshiofthewire in #23
• KyIdentity identity fixes: username clashes refused cleanly; Matrix ID from the email by @Yoshiofthewire in #24
• Enable Matrix voice and video calls by default by @Yoshiofthewire in #25
• chore(deps): Bump modernc.org/sqlite from 1.59.0 to 1.60.1 in the go group by @dependabot[bot] in #27
• chore(deps): Bump github.com/Busnes-app/ky-primitives from 0.8.0 to 0.9.0 in the ky-primitives group by @dependabot[bot] in #26
• deps: bump source-map-js past GHSA-68fv-2mgg-jv7q by @Yoshiofthewire in #28
• fix(web): wrap backup copy rows on narrow screens by @Yoshiofthewire in #31
• ci: add OpenSSF Scorecard workflow by @Yoshiofthewire in #30
• fix: build with Go 1.27.2; raise go.mod floor to 1.26.9 by @Yoshiofthewire in #29
• ci: bump Node 22 to 26 by @Yoshiofthewire in #32
• chore: standard Go bump method by @Yoshiofthewire in #35
• chore(deps): Bump golang.org/x/sys from 0.48.0 to 0.49.0 in the go group by @dependabot[bot] in #33
• chore(ci): Bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #34
• fix(matrix): withhold message content from push gateways by @Yoshiofthewire in #36
• docs: plan opt-in federation (three console levels) by @Yoshiofthewire in #37
• feat(matrix): console-owned federation.yaml for Synapse listeners and allow-list by @Yoshiofthewire in #38
• feat(api): federation levels, allow-list and status by @Yoshiofthewire in #39
• feat(calls): remote users from allowed servers join existing calls by @Yoshiofthewire in #40
• feat(web): Settings > Federation panel by @Yoshiofthewire in #41
• test(acceptance): federation stage against a peer Synapse by @Yoshiofthewire in #42
• docs: operator guide for opt-in federation by @Yoshiofthewire in #43
• feat(api): five vetted public servers for the curated level by @Yoshiofthewire in #44
• feat: apply-setup for KyQuickStart installs by @Yoshiofthewire in #48
• chore(release): set every version source to 0.4.0 by @Yoshiofthewire in #49
• fix: hostile-review findings for backups, restore, migrations and settings by @Yoshiofthewire in #50
• fix: pairing secret out of URLs, honest SCIM page, console hardening by @Yoshiofthewire in #51
• fix(auth): TOTP enrolment, per-client lockout, SSO/SCIM/cookie hardening by @Yoshiofthewire in #52
• fix: hostile review — non-root app, fail-closed call eviction, federation/secret/rotation hardening by @Yoshiofthewire in #53
• feat: agent accounts for OpenClaw and Hermes Agent by @Yoshiofthewire in #54
• fix(ci): de-flake Rooms close test and Element sign-in after restore by @Yoshiofthewire in #55
• chore(release): v0.4.2 with an attested release image by @Yoshiofthewire in #56

New Contributors

• @Yoshiofthewire made their first contribution in #1
• @dependabot[bot] made their first contribution in #27

Full Changelog: https://github.com/Busnes-app/KyMessage-Server/commits/v0.4.2