Mialuna 0.17.2 — The caption box follows the composer

Mialuna 0.17.2 — The caption box follows the composer

A small fix release.

Fixes

• The caption box could show text the composer no longer had. The box only copied the composer's caption into itself when the box was empty. After a caption changed elsewhere (a story shared from the Home rail, a reset after publishing, a draft that was read late), the box kept the old words while the composer was empty, so the next keystroke brought the old text back into the post. The box now always shows what the composer holds, including an empty caption, and never moves the cursor while you type. Three new widget tests cover it; the first one failed before the fix.

Everything in 0.17.1 (Reels no longer crash, the notification battery hint, PNG/WebP orientation) is unchanged.

Install on Android

1. Download mialuna-0.17.2.apk from the release assets.
2. Open the APK on a device running Android 7.0 or later and allow installation from your browser or file manager if Android asks you to.
3. It is signed with the same key as 0.16.0, 0.17.0 and 0.17.1, so it installs over them and keeps your data. Do not uninstall the old version first.

The APK includes arm64-v8a, armeabi-v7a and x86_64 native libraries.

Verification

Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine). The source passed static analysis and all 842 automated tests (the three caption tests and the version check were run again after a final tidy-up of the new test file). The fix was checked in widget tests only; this release APK itself has not been launched on a device yet.

• APK SHA-256: e34b6dff20c9149aeee2523e67e179fa862cd6389480f54d2d72583d96ff9dac
• Signing certificate SHA-256: 5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50 (the same as 0.16.0, 0.17.0 and 0.17.1)

Full changelog: CHANGELOG.md

Mialuna 0.17.1 — Reels no longer crash, notifications explained

Mialuna 0.17.1 — Reels no longer crash, notifications explained

A fix release, driven by user reports and by testing 0.17.0 on a phone.

Fixes

• Reels no longer crash the app. Swiping quickly through reels started a video player — a hardware decoder and its buffers — for every reel, and a reel you had swiped past only let go of its player once its download answered, so players piled up until the app ran out of memory (reproduced: 20 swipes took the app from 670 MB to 1.2 GB; reported on a Galaxy S21 Ultra). Now only the reel you are watching has a player, the next one is prepared once you stay on a reel for a moment, and everything else lets go at once. 100 swipes on the same phone: no crash, flat memory.
• Reels stay where you left them. New reels that arrive while you are watching are added at the end instead of being sorted in front of the one under your finger.
• Notifications on the phone, explained. Android puts an app to sleep a few minutes after the screen turns off, and its relay connections with it, so the bell fills up on your next visit but nothing shows in the notification shade. Mialuna has no push service and runs nothing in the background by design. Settings → System notifications now tells you so and opens the phone's battery settings, where Mialuna should be set to Unrestricted. With that, a reaction reached the shade even with Android forced into deep Doze for 8 minutes.
• Photos could come out sideways when a PNG or WebP carried an EXIF rotation: the tag was removed without the rotation being applied. They are now turned the right way up first (JPEG already was); every orientation from 1 to 8 is checked pixel by pixel.
• "5 min ago" no longer freezes under a post that stays on screen.
• Adding a media (Blossom) server that is not https:// now says "Invalid address: use https://…" instead of emptying the field silently.

Install on Android

1. Download mialuna-0.17.1.apk from the release assets.
2. Open the APK on a device running Android 7.0 or later and allow installation from your browser or file manager if Android asks you to.
3. It is signed with the same key as 0.16.0 and 0.17.0, so it installs over them and keeps your data. Do not uninstall the old version first.

The APK includes arm64-v8a, armeabi-v7a and x86_64 native libraries.

Verification

Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine). The source passed static analysis and all 839 automated tests; the debug build of this code ran on a Galaxy S24 (Android 17), where the Reels crash was reproduced and fixed. This release APK itself has not been launched on a device yet, and the new battery hint was checked in widget tests, not on screen.

• APK SHA-256: 9a70ec3caf4178116ac292fd456a378e18070be8b85072d15f41c1b38200686e
• Signing certificate SHA-256: 5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50 (the same as 0.16.0 and 0.17.0)

Full changelog: CHANGELOG.md

Mialuna 0.17.0 — Reliable story receipts, a Home that refreshes

Mialuna 0.17.0 — Reliable story receipts, a Home that refreshes

A fix-and-polish release. Story views no longer get lost, Home refreshes after your phone has slept and scrolls more smoothly, and you can switch off new-follower notifications if people spam you with follows.

Highlights

• Pull-to-refresh works after the phone has slept. Connections to relays often die silently in the background, and the refresh used to be sent into them and bring nothing back. Mialuna now checks a quiet relay before refreshing (and when the app returns to the foreground) and replaces a dead connection at once.
• Smoother scrolling in Home. Single-picture posts no longer sit in a carousel that competed with vertical scrolling, cards keep their real shape instead of jumping when they scroll back into view, and cards that did not change are no longer rebuilt every time a page of posts arrives.
• Show new followers (Settings). Off, new followers no longer appear in Notifications, the bell's count or on the phone. Likes, comments and zaps still do. On by default.
• Home follows who you follow. Replacing one followed account with another used to leave Home (and the story rail) showing the old people.

Story views and Stories

• No more lost views. A story view receipt is delivered only once the author's inbox relay accepted it. Otherwise it waits in a small on-device outbox (a story id and the author's key, for at most 24 hours) and is retried with growing pauses. Amber and bunker signers are never prompted in the background.
• Turning receipts off really stops them. Receipts still waiting are discarded immediately, and a restart does not bring them back. A receipt a relay already accepted cannot be taken back.
• More than 30 stories to one author are now sent in further messages instead of being cut at 30.
• A story counts as watched only once it was really shown: not when a picture failed to load, not when you swipe past it, not while it is held, in the background or buffering.
• Watched stories are remembered per account (they used to be shared by every account on the phone).
• Stories disappear after 24 hours even when their expiration tag is missing, malformed or far in the future, and while the app stays open.
• Only receipts for your own live stories are counted, within bounded memory; anybody could previously name any story id.
• A new story starts clean: no caption or sensitive-content flag from the last one, and a story's caption no longer overwrites your post draft.

Privacy and robustness

• Receipts and queues are bound to the account that watched; an account switch or sign-out cannot have them signed, sent or written for someone else, and it can no longer carry a signer refusal or a "follow list loaded" signal over to the next account.
• The private inbox now remembers every wrap it has opened, so a session that only received story receipts or close-friends content does not decrypt them again at the next start (a signer prompt each with Amber).
• PRIVACY.md, the Nostr compatibility notes and the in-app setting text describe the new behaviour (English and Italian).

The full audit — every finding, the tests that reproduce it and the risks left open — is in docs/BUGFIX_AUDIT.md.

Install on Android

1. Download mialuna-0.17.0.apk from the release assets.
2. Open the APK on a device running Android 7.0 or later and allow installation from your browser or file manager if Android asks you to.
3. It is signed with the same key as 0.16.0, so it installs over it and keeps your data. Do not uninstall the old version first.

The APK includes arm64-v8a, armeabi-v7a and x86_64 native libraries. It is signed with Mialuna's release key.

Verification

Built with Flutter 3.44.3 and Dart 3.12.2 (the repository pins 3.47.9, which was not available on the build machine). The source passed static analysis and all 805 automated tests. The APK's signature was verified with apksigner; it has not yet been launched on a device or emulator, and the Amber/bunker prompts, video playback counting and background/foreground behaviour still need a check on real hardware (see the audit, section F).

• APK SHA-256: 833263a73c5cb1b16d85845a033422b8ff4e9c11206694ab1e62f0a8b0932f18
• Signing certificate SHA-256: 5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50 (the same as 0.16.0)

Full changelog: CHANGELOG.md

Mialuna 0.16.0 — First release

Mialuna 0.16.0 — First release

Mialuna is a media-first, decentralized social network powered by Nostr: photos, videos, Reels and Stories, with no company in the middle. This is Mialuna's first published GitHub release.

Highlights

• Stories, the Instagram way: write directly on photos and videos with multiple fonts, colors, backgrounds, resizing, rotation and draggable text. Hashtags in captions and story texts are tappable. Choose public or close-friends distribution, see segmented story rings and check who viewed your stories through encrypted receipts.
• Notifications: unread counters for notifications and private messages in Home, plus local Android system notifications for reactions, comments, zaps, new followers and messages. No push server or Google messaging service is used, and private-message notifications never reveal the message text.
• Private communication: end-to-end encrypted direct messages, close-friends posts and encrypted media. Encrypted posts have no unencrypted fallback.
• Web of trust: an optional, on-device spam filter based on your follow network. Message requests from outside the network stay separate from the main inbox.
• A faster Home: cached posts appear before network loading, follow lists are remembered locally, paging is more reliable and images load ahead of scrolling.
• Profiles and discovery: NIP-50 people search, NIP-05 addresses, tappable npubs, hashtag search, Following and Discover feeds.
• English and Italian, light and dark themes, Amber and remote-signer support, Blossom media uploads, Lightning zaps and Nostr Wallet Connect.
• New Mialuna icon, regenerated Android adaptive icons and iOS icons, plus a new screenshot gallery in the README.

Privacy and security

• Android backups and device-transfer exports are disabled for application data.
• Release builds reject cleartext traffic and user-installed certificate authorities.
• Private screens are protected from screenshots and recent-screen previews.
• Third-party HTTP fetches are restricted to public HTTPS hosts, with redirect, response-size and destination checks.
• Relay and signer URLs are validated, oversized relay messages are dropped and zap receipts are checked against signed requests and paid invoices.
• Signing out removes account-specific credentials, decrypted content, lists, preferences and caches.

Fixes

This release also includes improved NIP-51 list preservation, Unicode hashtag parsing, protection against concurrent cache writes, startup race fixes, more reliable story and feed paging, and several memory-lifecycle and UI corrections.

Install on Android

1. Download mialuna-0.16.0.apk from the release assets.
2. Open the APK on a device running Android 7.0 or later and allow installation from your browser or file manager if Android asks you to.
3. Keep the existing app signature when installing future updates. Do not uninstall a version you want to upgrade in place, because Android may delete its local data.

The APK includes arm64-v8a, armeabi-v7a and x86_64 native libraries. It is signed with Mialuna's release key.

Verification

Built with Flutter 3.47.9 and Dart 3.13.7. The source passed static analysis and all 686 automated tests. A release APK was also launched successfully on an Android emulator.

• APK SHA-256: ffa526e64f738f6a7980a5ff3ed5171ceb6d36e4700fe2188c3b95ae5f672593
• Signing certificate SHA-256: 5F:E4:44:55:43:21:44:8B:FA:7B:EB:FD:EF:F8:0E:84:1C:08:6D:80:91:59:A5:9A:82:B2:AA:EE:EE:D0:37:50

Full changelog: CHANGELOG.md