Backspace 1.2.1

Backspace 1.2.1

Language and interface scale have moved out of Account into a new Appearance
tab, directly below it.

Neither setting was ever account data. Both are stored in this browser or app
rather than on your account, and both work on the login screen before you have
signed in. Account now holds what actually lives on the server: your profile,
your username and email, your password, and account deletion.

Nothing about the two settings changed, and what you already picked carries
over. Appearance is where themes and display density will go when they arrive.

Updating

Instances. docker compose pull && docker compose up -d, or ./deploy.sh.

Desktop. The installers below update themselves, and the web client comes
from your instance either way.

Backspace 1.2.0

Backspace 1.2.0

Scale the interface to your eyes, share system audio without echoing viewers
back to themselves, and use voice shortcuts on Wayland. Instances can also opt
in to a daily ping so the project knows how many of them are out there.

Interface scale

Settings, Account now has an interface scale: 75% to 250% in 25% steps. It
scales the whole client in the browser and in the desktop app, is stored per
device rather than per account, and applies on the login screen too. Browser
zoom still works on top of it.

The mobile and desktop layouts now switch on the scaled width, so a wide window
at 200% gets the mobile layout. Thanks @st7105.

Telemetry, off by default

Your instance can send one small JSON document a day so the project can see how
many instances exist and what they run. Admins are asked once. Declining costs
nothing, and nothing leaves the instance unless someone says yes.

It sends a random instance id, the Backspace and Node versions, rounded counts
of users, spaces, channels, messages and active users by client, and whether
voice, federation and open registration are on. It never sends usernames, your
domain, addresses, message content or file names. The receiver keeps the country
and drops the rest of the request.

You can read the exact payload before deciding, and at any time after, under
instance settings. TELEMETRY=on or off before install.sh answers the
question ahead of time for scripted installs, TELEMETRY_ENDPOINT points at
your own receiver, and what comes back is public on the
insights page.

Voice shortcuts on Wayland

Mute, deafen and push to talk now work on Wayland through the GlobalShortcuts
portal, including while another application has focus. Wayland hands shortcut
assignment to the desktop, so Keybinds shows what the system has assigned and
sends you to system settings to change it. X11, Windows and macOS are unchanged.

Leaving a call also releases the microphone now. The client had been stopping a
copy of the track instead of the capture itself, so the recording indicator
could stay lit after a call. Thanks @st7105 and @gr1n-the-big-floppa.

Screen shares stop feeding viewers their own voice

Sharing system audio could send viewers their own voice back. Backspace asked
Electron to exclude its own playback, and Electron ignored the request. The
desktop app now ships Electron 43.6, which honors it on macOS and Windows. Linux
loopback is unchanged; the upstream fix does not cover it.

The exclusion covers everything Backspace plays, so a YouTube or Spotify embed
inside the app no longer reaches viewers through a system-audio share either.
Play it in another application if you want to share it.

Two things worth knowing. An audio router such as SoundSource replays call audio
through a separate process, which no setting in Backspace can exclude, so
exclude Backspace there as well. And nobody has run a real two-person call on
this build yet: the code path and the upstream fix were reviewed, that is all.
#136 stays open, so tell us
what you hear. Thanks @akk0sfx.

Also fixed

• Clicking a message notification opens the DM or channel it came from and
  restores a minimized window, instead of only focusing the app (#130, @st7105).
• Uploads work when the instance runs on a custom public port behind a reverse
  proxy, for example DOMAIN=chat.example.com:1443 (#44). Federation across a
  custom port is still unsupported.
• Image preview controls stay below the native title bar on the desktop app
  instead of hiding under the window buttons (#129, @st7105).

Around the project

The insights page now charts repository traffic and the telemetry aggregates and
publishes both as plain tables. CONTRIBUTING asks for a design before code on
architectural changes and says what is expected of agent-written work. Pull
requests from forks get an automatic summary of what they touch before anyone
approves CI.

Updating

Instances. docker compose pull && docker compose up -d, or ./deploy.sh.
The telemetry settings migration runs at boot and sends nothing by itself.

Desktop. The installers below update themselves. The web client comes from
your instance, so interface scale reaches the browser as soon as the instance is
on 1.2.0.

Backspace 1.1.2

Backspace 1.1.2

Fixes the "Register" and "Log In" links on the login and registration pages,
which did nothing since 1.1.0. Two smaller changes ride along. All three
were contributed by @st7105.

What changed

The auth navigation links work again (#124)

The 1.1.0 localization moved the login and registration prompts into
translation catalogs, and the placeholder for the link inside them was named
link. The library that renders those strings treats a lowercase link as
an HTML void element, so the link was rendered empty and the component never
mounted. The placeholder is now actionLink, and the localization
consistency check rejects void-element names in every catalog so this cannot
come back.

Activity elapsed time is localized (#122)

The "elapsed" line under a rich activity now comes from the catalogs in all
three languages instead of a hard-coded English string.

Edit your last message with the up arrow (#123)

With an empty composer, pressing the up arrow opens your most recent message
in the channel for editing. Pending messages, system messages and messages
without text are skipped.

Updating

The fix lives in the web client the instance serves, so updating the
instance is what matters. Desktop installers are rebuilt with the new version
number and pick the fix up from the instance.

Backspace 1.1.1

Backspace 1.1.1

The container image for 1.1.0 never got built, so self-hosted instances could
not pull that version. This release exists to fix that. The app itself is
1.1.0: English, Russian and German, see
https://github.com/TheZwiss/backspace/releases/tag/v1.1.0 for what changed.

What changed

The image build was missing the localization check

The web build now starts with the localization consistency check, which lives
in the repository's scripts directory. The Dockerfile copies source into the
image one path at a time and never picked that directory up, so the image
build failed on the first step while every other check was green. The
builder stage now copies the check and its two input files.

Nothing built the Dockerfile before a tag did, which is how this reached a
release. CI now builds the image on every pull request, without publishing
it, and the merge gate requires it.

Desktop installers are rebuilt for 1.1.1 but contain no changes beyond the
version number. Updating from 1.1.0 is optional.

Backspace 1.1.0

Backspace 1.1.0

Backspace now speaks English, Russian and German.

Pick your language under Settings, Account. On first run the app follows
your browser's language and falls back to English; once you choose, the
choice is remembered on that device. Every part of the app is covered: chat,
direct messages, voice and screen sharing, spaces and their settings, friends,
the instance settings, the mobile layout, and the desktop app's tray, menus,
recovery page and instance picker.

Dates, times, numbers, percentages and file sizes follow the selected
language too, so a German user sees "5. Sept." and "1,5 MB" and a Russian
user sees the plural forms their language actually has.

Errors from the server arrive with a stable code and are shown in your
language. Older clients and federated instances that do not know a code
still get the English text, so nothing breaks across versions.

The Russian translation comes from st7105, who translated the whole app in
#45 and whose work carried over
into this release with credit on every commit. Thank you. German was written
and reviewed by the maintainers.

If a phrase reads wrong in your language, open an issue or edit the catalog
under packages/web/src/locales; the consistency check in the build tells you
when a key is missing or a plural form is off.

Also in this release: the Flatpak build can use the webcam and talk to the
system power service, so video calls work and the app can keep the system
awake during a call. Thanks to st7105 and gr1n-the-big-floppa for that fix
(#93).

Note for self-hosters: the container image for this version failed to
build, so there is no 1.1.0 image to pull. Use 1.1.1, which is this release
plus that fix: https://github.com/TheZwiss/backspace/releases/tag/v1.1.1

Backspace 1.0.6

Backspace 1.0.6

Backspace now has Flatpak packaging, contributed by the community, and the
contributing guide says what a packaging or platform change needs to bring
with it.

What changed

Flatpak packaging

The desktop app can now be built as a Flatpak. The manifest, the offline
dependency sources, the AppStream metadata and a CI job that builds it on
x86_64 and aarch64 are all in the repository, and every tagged release now
regenerates and validates that metadata automatically.

In the Flatpak build, updates are Flatpak's job. The app detects the sandbox
and hides its own update and auto-launch controls instead of offering actions
it cannot perform, the same way the ad-hoc signed macOS build learned to do in
1.0.5.

This is the groundwork. A Flathub listing needs the published manifest to
point at a tagged release, which this release is, so the submission can
follow.

Thank you to st7105 and gr1n-the-big-floppa for the packaging work and for two
rounds of careful fixes during review.

Contributing guide

CONTRIBUTING.md now explains what a reviewable pull request looks like: a
size the maintainers can actually read, and, for packaging, platform and UI
changes, evidence that the change was run rather than only built. The pull
request template asks for the same.

Release automation

The first run of the new Flatpak release job failed on a git ownership check
inside its build container. That is fixed, and this is the release that
proved it.

Upgrading

Server operators: ./update.sh as usual. Desktop users on Windows and Linux
get the update in the app; macOS users download the new build by hand, as
before.

Backspace 1.0.5

Backspace 1.0.5

The desktop app stops offering a Restart button that cannot work, operators get
a real update script, and admins can see what version their instance runs
without reading the README.

What changed

The macOS update prompt told the truth for the first time

Every macOS launch showed "Update ready" with a Restart button that did nothing.
Dismissing it revealed a second card saying the update had failed, and the whole
sequence repeated on the next launch.

None of that was a glitch. Our macOS builds are ad-hoc signed, which means the
signature has no stable identity and macOS derives the app's identity from a hash
of that exact binary. The updater checks a new version against that hash before
installing it, and a new version never matches. It could not have worked for any
release, and it will not until the app carries a real Developer ID certificate.

The app now checks its own signature at startup and behaves accordingly. On a
build that cannot install its own updates it says so in plain words and offers a
download instead of a Restart button. It also stops downloading the release
archive it can never apply, which was costing 228 MB per machine, stored twice,
fetched again on every check, and it clears the copies already sitting there.

Dismissing the prompt now means something. It is remembered for that version, so
you see it once per release rather than once per launch, and it survives
switching instances. The update stays available in Settings, Desktop, so nothing
is lost by dismissing it.

Two smaller things fell out of the same work. A failed update no longer hides
behind the "ready" card that preceded it, and downloads show real progress on
Windows and Linux instead of a five second guess.

If you are on macOS, this release still has to be installed by hand. It is the
last one that will be silent about why.

./update.sh

There was no update script. The documented path was copying commands out of the
README.

./update.sh              Update, with one confirmation prompt
./update.sh --check      Report whether an update exists, changing nothing
./update.sh --yes        Update without prompting, for ssh and cron

It takes a database snapshot first, refreshes the checkout when that is possible
and says why when it is not, fetches the new image the way you installed
(pulling or rebuilding), and restarts only the Backspace container. Then it waits
for the healthcheck and checks that the running version actually changed. If the
new version does not come up, or comes up still running the old code, it puts the
previous image back.

An update with nothing to fetch skips the restart entirely, so nobody gets
dropped from a voice call for nothing.

It has been rehearsed on a live instance, including a deliberately broken update
that failed the health check and rolled back.

Instance Settings, Updates

Admins get a panel showing the running version, the commit, how the instance was
installed, whether a newer release exists, and the exact command for that
install.

The instance does not check for updates on a timer. The lookup happens only while
an admin has that panel open, so an instance whose admin never opens it never
contacts GitHub at all. BACKSPACE_UPDATE_CHECK=false turns it off outright for
airgapped deployments.

There is no button that performs the update, and that is deliberate. Applying a
container update from inside the container requires handing the container control
of the Docker daemon, which is root on the host. That is not a reasonable price
for saving one ssh.

Operator notes

Updating to this release. From your install directory:

git pull
docker compose pull backspace && docker compose up -d backspace

From 1.0.6 onward, ./update.sh does all of that for you. It ships in this
release, so you need this one before you can use it.

Name the service and do not pass --remove-orphans. If you run other
containers in the same compose project, Compose will suggest that flag, and
following it deletes them.

The compose file defaults to the latest image tag, so docker compose pull
moves you across releases, including ones carrying database migrations. Pin
BACKSPACE_IMAGE_TAG in your .env to stay on a specific version. Backups are
taken automatically before migrations run, and ./restore.sh restores them.

New environment variables, both optional and both documented in
.env.example: BACKSPACE_UPDATE_CHECK (default true) and
BACKSPACE_INSTALL_CHANNEL (written by install.sh).

Downloads

Platform	File
Windows (x64 + arm64)	Backspace-1.0.5.exe
macOS Apple Silicon	Backspace-1.0.5-arm64.dmg
macOS Intel	Backspace-1.0.5-x64.dmg
Linux x64	Backspace-1.0.5-x86_64.AppImage / Backspace-1.0.5-amd64.deb
Linux arm64	Backspace-1.0.5-arm64.AppImage / Backspace-1.0.5-arm64.deb

macOS first launch

The app is signed but not notarized, so Gatekeeper stops the first launch. You
only need to do this once.

macOS 15 and later: open the app, dismiss the warning, then go to System
Settings, Privacy & Security, and press Open Anyway.

macOS 14 and earlier: right-click the app, choose Open, then Open again.

Updating resets the Input Monitoring and Screen Recording permissions, because
the signature carries no stable identity. That is the same limitation behind the
update prompt described above.

Known, not fixed here

Auto-update on macOS still does not work, and cannot until the app is signed with
an Apple Developer ID. What changed is that the app no longer pretends otherwise.

./update.sh has been rehearsed on a prebuilt-image install. Its from-source
branch is written and checked but has not been run against real hardware.

Voice presence updates are still sent to the whole space, while the initial voice
state snapshot is correctly filtered by channel visibility. A member who cannot
see a voice channel gets a filtered list on connect and then sees that channel's
join and leave traffic.

Logging in directly at a remote instance still forwards your password to your
home instance. That path is what makes direct remote login work, so removing it
needs its own design. If you have connected to an instance you do not trust,
change your home password.

Backspace 1.0.4

Backspace 1.0.4

Server release. The content security policy introduced in 1.0.3 now enforces instead of reporting, and the container image stops shipping two package managers it never used.

There are no functional changes to the desktop app in this release. If you are on 1.0.3, the installers here are equivalent and you can skip them.

What changed

The content security policy now enforces

1.0.3 shipped the policy in report-only mode, which meant browsers evaluated it, reported what would have been blocked, and loaded the resource anyway. It now blocks.

The gap between those two states is narrower than it sounds. The page has always carried a second, enforcing policy covering the directives that stop script injection, so those have been active in every release since 1.0.0. What starts enforcing now is the rest: which origins may be framed, where forms may submit, and whether the app may be embedded in a frame.

Before the switch, the report-only policy was observed on two live deployments across ordinary use: loading the app, sending messages, uploading and displaying files, joining voice, and screen sharing. Each observation round injected deliberate violations first to prove the detector worked, because a clean result from a broken detector looks identical to a clean policy. No violations came from the application itself.

Violations are still reported to the instance, so if this does break a flow that was never exercised, it leaves a trace in your logs.

The container image no longer ships pnpm or npm

Neither was ever used at runtime. The image installs nothing from a registry and starts the server directly. Both were present anyway, one because the build activated it and one because the base image bundles it.

Between them they accounted for 17 of the image's 20 fixable high and critical scan findings, all of it in code that never ran. The count is now 3, and those three are a single cluster in the web framework that needs a major upgrade with its own compatibility work.

Release automation

Publishing a release used to have four build jobs race to create the same draft, which on 1.0.3 produced two drafts with the files split between them. The draft is now created once, before the builds start.

Operator notes

The compose file defaults to the latest image tag, so docker compose pull moves you across releases, including ones that carry database migrations. Pin BACKSPACE_IMAGE_TAG in your .env to stay on a specific version. Backups are taken automatically before migrations run, and ./restore.sh restores them.

Nothing auto-updates. restart: unless-stopped restarts the image you already have, it never fetches a new one. From your install directory:

git pull
docker compose pull && docker compose up -d

If the policy blocks something on your deployment, check your instance log for lines reading CSP violation reported. The directive and the blocked address are both recorded. Please open an issue if you find one, since that means a real flow was missed.

Downloads

Platform	File
Windows (x64 + arm64)	Backspace-1.0.4.exe
macOS Apple Silicon	Backspace-1.0.4-arm64.dmg
macOS Intel	Backspace-1.0.4-x64.dmg
Linux x64	Backspace-1.0.4-x86_64.AppImage / Backspace-1.0.4-amd64.deb
Linux arm64	Backspace-1.0.4-arm64.AppImage / Backspace-1.0.4-arm64.deb

macOS first launch

The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.

macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.

macOS 14 and earlier: right-click the app, choose Open, then Open again.

Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.

Since there are no desktop changes in this release, macOS users have a reason to skip it: updating resets the Input Monitoring and Screen Recording permissions, because the signature carries no stable identity.

Known, not fixed here

Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic.

Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.

The published container image is still scanned on every publish without blocking. The backlog is down to 3 findings, all in one dependency cluster that needs a major framework upgrade. That upgrade is scoped and has a deadline of 2026-12-01, after which the dependency scan turns red on purpose.

Backspace 1.0.3

Backspace 1.0.3

Hardening release. Adds a content security policy and a full set of security headers, validates every outbound request the server makes, moves the container to the current Node LTS, and brings the dependency tree up to date.

Nothing changes for people using the app. Self-hosters should read the operator notes at the bottom.

What changed

Security headers

Every response now carries a consistent set of security headers: frame denial, a referrer policy, MIME sniffing protection, and cross-origin values chosen so that federated avatars and attachments keep loading from peer instances.

Ownership is split deliberately. The application sends everything except HTTPS enforcement, which belongs to whatever terminates TLS, because only that layer knows HTTPS is genuinely in play.

Content security policy, in report-only mode

A policy now ships, and it blocks nothing in this release. Browsers evaluate it, report what would have been blocked, and load the resource anyway. This is on purpose: a policy that is switched straight to blocking breaks voice or embeds on somebody's deployment with nothing in the console to explain it.

The policy is built from your instance configuration at boot, so it knows your own LiveKit origin rather than a hardcoded one.

Before shipping, it was observed on two live deployments across ordinary use: messages, link embeds, file uploads, a voice join, screen sharing, and noise suppression. No violations were produced by the application. Enforcement will follow in a later release.

Outbound request validation

Every request the server makes to a user-supplied or peer-supplied address is now checked before it is sent, and checked again at every redirect hop rather than only at the start. Link previews and federated file fetches are the paths this covers.

Runtime and dependencies

The container now runs on Node 24, the active LTS. Node 20 reached end of life in April 2026, so the previous image was running an unpatched runtime.

The dependency tree moved forward across the board, including the build tooling and the desktop packaging toolchain. Known-vulnerable transitive packages dropped from 151 to 13, and each of the 13 that remain needs a major upgrade with its own compatibility work, recorded with a reason and a review date rather than silently ignored.

Continuous scanning

Static analysis, dependency scanning, secret scanning, configuration scanning, and repository posture checks now fail the build rather than merely reporting. A dynamic scan runs against a freshly built instance on every change to the main branch.

Linux: the executable inside the package is renamed

The binary inside the AppImage and the deb was previously named
@backspacedesktop, which came from the package name rather than the product
name. The packaging toolchain now rejects that name outright, so it is
Backspace from this release on. The AppImage and deb file names are unchanged.

This only matters if you launch the binary directly or script against it.

Operator notes

The compose file defaults to the latest image tag. This means docker compose pull moves you across releases, including ones that carry database migrations. If you want to stay on a specific version, set BACKSPACE_IMAGE_TAG in your .env. Backups are taken automatically before migrations run, and ./restore.sh restores them.

FEDERATION_ALLOW_PRIVATE_PEERS is new. Outbound request validation refuses to connect to private network addresses by default. If you peer instances across a LAN or a VPN, set this to true. Leave it off on anything reachable from the public internet.

If you deploy with deploy.sh, your Caddyfile is not overwritten, by design, since deployed hosts often carry extra site blocks. That also means changes to the bundled Caddyfile do not reach you automatically, so HTTPS enforcement headers are yours to set on your own proxy.

Downloads

Platform	File
Windows (x64 + arm64)	Backspace-1.0.3.exe
macOS Apple Silicon	Backspace-1.0.3-arm64.dmg
macOS Intel	Backspace-1.0.3-x64.dmg
Linux x64	Backspace-1.0.3-x86_64.AppImage / Backspace-1.0.3-amd64.deb
Linux arm64	Backspace-1.0.3-arm64.AppImage / Backspace-1.0.3-arm64.deb

macOS first launch

The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.

macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.

macOS 14 and earlier: right-click the app, choose Open, then Open again.

Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.

Known, not fixed here

Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic.

Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.

The published container image is scanned on every publish, and that scan reports rather than blocks. It carries a backlog of fixable findings in third-party packages that needs its own pass, and blocking on it today would stop security fixes from shipping at all.

Backspace 1.0.2

Backspace 1.0.2

Security release. Closes the federation and direct-message issues raised in a review of the BadAtCaptchas/backspace fork, and gets the container image building again.

Self-hosters running federation should update.

What changed

Eleven fixes, one per commit, each with its own regression test.

• Public registration can no longer claim a federation-replicated account stub.
• Reply targets are confined to the channel they belong to, in direct messages and in space channels, on creation and on read.
• Direct-message relays are addressed to the instances that host participants, rather than to every peer.
• Federated call relays reach only the instances hosting a member, and each instance receives tokens only for its own members.
• The author of a relayed event is now resolved from the peer that authenticated the request, rather than from what the payload claims.
• Each instance you connect to gets its own account credential.
• Peer records now note who created them, and both peering gates honour it.
• Message edit and delete events go only to the audience of the channel they belong to.
• Trailing-slash handling in origin parsing no longer backtracks on hostile input.

Descriptions are deliberately behavioural. If you self-host and want detail before updating, open a private security advisory on the repository.

Testing

974 server tests across 115 files, 488 web tests, type checks clean.

The notable addition is a set of end-to-end suites that boot two real server instances with separate databases, peer them through the actual handshake, and assert over real HTTP. Before this release there was no two-instance test in the repository at all; every federation test ran in a single process against mocks.

Each suite was checked by reverting the fix it covers and confirming the test fails.

Migrations

Two additive migrations run automatically on first boot. Both were tested against a copy of a populated database with row counts and integrity checks compared before and after, and restoring an older backup into the new build was simulated.

Nothing needs to be done by hand.

Container image

The image builds again. It had been broken since 2026-08-25, when better-sqlite3 stopped shipping a Node 20 prebuild and started compiling from source inside an image with no compiler. This is the first working image since July.

Downloads

Platform	File
Windows (x64 + arm64)	Backspace-1.0.2.exe
macOS Apple Silicon	Backspace-1.0.2-arm64.dmg
macOS Intel	Backspace-1.0.2-x64.dmg
Linux x64	Backspace-1.0.2-x86_64.AppImage / Backspace-1.0.2-amd64.deb
Linux arm64	Backspace-1.0.2-arm64.AppImage / Backspace-1.0.2-arm64.deb

macOS first launch

The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.

macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.

macOS 14 and earlier: right-click the app, choose Open, then Open again.

Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.

Known, not fixed here

Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic. This is being fixed separately because it touches the client.

Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.