v0.4.2

What's Changed

• Security audit run 2 fixes by @Yoshiofthewire in #1
• Security audit run 2 follow-ups: webhook replay, half-written pins by @Yoshiofthewire in #2
• Directory webhook speaks KyIdentity's suite-webhook contract by @Yoshiofthewire in #3
• Per-thread auto-purge: Off/1/7/30/90, default 90 by @Yoshiofthewire in #4
• Backups: people capsule, opt-in message backups, restore-messages and device resume by @Yoshiofthewire in #5
• Backup follow-ups: route tests, clearer overflow errors, docs refresh by @Yoshiofthewire in #6
• Client readiness: My account, proxy deployment, browser support, chat-core behind a gate by @Yoshiofthewire in #7
• Chat follows the suite review process, not an independent-audit gate by @Yoshiofthewire in #8
• Rename KySignOn to KyIdentity (text, env, routes, stored provider) by @Yoshiofthewire in #9
• Docs: chat platform options (custom MLS vs Matrix vs XMPP, bridges to personal and team networks) by @Yoshiofthewire in #10
• Remove the isolated MLS client, chat-core package and their CI (pure deletion) by @Yoshiofthewire in #12
• Matrix sub-project 1: remove the custom messaging stack by @Yoshiofthewire in #11
• Land #11 on master (Matrix sub-project 1: remove the custom messaging stack) by @Yoshiofthewire in #13
• Matrix sub-project 2: Matrix stack and KyIdentity sign-in by @Yoshiofthewire in #14
• Matrix sub-project 3: offboarding (back-channel logout + MAS sync) by @Yoshiofthewire in #15
• Matrix sub-project 4: server backups (capsule dumps, encrypted media, whole-stack restore) by @Yoshiofthewire in #16
• Matrix sub-project 5a: console — users, health, audit by @Yoshiofthewire in #17
• Matrix sub-project 5b: console — rooms by @Yoshiofthewire in #18
• Console 5c: branding and KyIdentity sync status by @Yoshiofthewire in #19
• docs: PRODUCT.md describes KyMessages on Matrix as shipped by @Yoshiofthewire in #20
• test: count relations in a scratch database, not the shared one by @Yoshiofthewire in #21
• Fix 17 deferred review minors; harden the acceptance media step by @Yoshiofthewire in #22
• K80/K81 deploy: Element restart hint is configurable; deploy spec and plan by @Yoshiofthewire in #23
• KyIdentity identity fixes: username clashes refused cleanly; Matrix ID from the email by @Yoshiofthewire in #24
• Enable Matrix voice and video calls by default by @Yoshiofthewire in #25
• chore(deps): Bump modernc.org/sqlite from 1.59.0 to 1.60.1 in the go group by @dependabot[bot] in #27
• chore(deps): Bump github.com/Busnes-app/ky-primitives from 0.8.0 to 0.9.0 in the ky-primitives group by @dependabot[bot] in #26
• deps: bump source-map-js past GHSA-68fv-2mgg-jv7q by @Yoshiofthewire in #28
• fix(web): wrap backup copy rows on narrow screens by @Yoshiofthewire in #31
• ci: add OpenSSF Scorecard workflow by @Yoshiofthewire in #30
• fix: build with Go 1.27.2; raise go.mod floor to 1.26.9 by @Yoshiofthewire in #29
• ci: bump Node 22 to 26 by @Yoshiofthewire in #32
• chore: standard Go bump method by @Yoshiofthewire in #35
• chore(deps): Bump golang.org/x/sys from 0.48.0 to 0.49.0 in the go group by @dependabot[bot] in #33
• chore(ci): Bump the actions group across 1 directory with 2 updates by @dependabot[bot] in #34
• fix(matrix): withhold message content from push gateways by @Yoshiofthewire in #36
• docs: plan opt-in federation (three console levels) by @Yoshiofthewire in #37
• feat(matrix): console-owned federation.yaml for Synapse listeners and allow-list by @Yoshiofthewire in #38
• feat(api): federation levels, allow-list and status by @Yoshiofthewire in #39
• feat(calls): remote users from allowed servers join existing calls by @Yoshiofthewire in #40
• feat(web): Settings > Federation panel by @Yoshiofthewire in #41
• test(acceptance): federation stage against a peer Synapse by @Yoshiofthewire in #42
• docs: operator guide for opt-in federation by @Yoshiofthewire in #43
• feat(api): five vetted public servers for the curated level by @Yoshiofthewire in #44
• feat: apply-setup for KyQuickStart installs by @Yoshiofthewire in #48
• chore(release): set every version source to 0.4.0 by @Yoshiofthewire in #49
• fix: hostile-review findings for backups, restore, migrations and settings by @Yoshiofthewire in #50
• fix: pairing secret out of URLs, honest SCIM page, console hardening by @Yoshiofthewire in #51
• fix(auth): TOTP enrolment, per-client lockout, SSO/SCIM/cookie hardening by @Yoshiofthewire in #52
• fix: hostile review — non-root app, fail-closed call eviction, federation/secret/rotation hardening by @Yoshiofthewire in #53
• feat: agent accounts for OpenClaw and Hermes Agent by @Yoshiofthewire in #54
• fix(ci): de-flake Rooms close test and Element sign-in after restore by @Yoshiofthewire in #55
• chore(release): v0.4.2 with an attested release image by @Yoshiofthewire in #56

New Contributors

• @Yoshiofthewire made their first contribution in #1
• @dependabot[bot] made their first contribution in #27

Full Changelog: https://github.com/Busnes-app/KyMessage-Server/commits/v0.4.2