Backspace 1.0.2
Backspace 1.0.2
Security release. Closes the federation and direct-message issues raised in a review of the BadAtCaptchas/backspace fork, and gets the container image building again.
Self-hosters running federation should update.
What changed
Eleven fixes, one per commit, each with its own regression test.
- Public registration can no longer claim a federation-replicated account stub.
- Reply targets are confined to the channel they belong to, in direct messages and in space channels, on creation and on read.
- Direct-message relays are addressed to the instances that host participants, rather than to every peer.
- Federated call relays reach only the instances hosting a member, and each instance receives tokens only for its own members.
- The author of a relayed event is now resolved from the peer that authenticated the request, rather than from what the payload claims.
- Each instance you connect to gets its own account credential.
- Peer records now note who created them, and both peering gates honour it.
- Message edit and delete events go only to the audience of the channel they belong to.
- Trailing-slash handling in origin parsing no longer backtracks on hostile input.
Descriptions are deliberately behavioural. If you self-host and want detail before updating, open a private security advisory on the repository.
Testing
974 server tests across 115 files, 488 web tests, type checks clean.
The notable addition is a set of end-to-end suites that boot two real server instances with separate databases, peer them through the actual handshake, and assert over real HTTP. Before this release there was no two-instance test in the repository at all; every federation test ran in a single process against mocks.
Each suite was checked by reverting the fix it covers and confirming the test fails.
Migrations
Two additive migrations run automatically on first boot. Both were tested against a copy of a populated database with row counts and integrity checks compared before and after, and restoring an older backup into the new build was simulated.
Nothing needs to be done by hand.
Container image
The image builds again. It had been broken since 2026-08-25, when better-sqlite3 stopped shipping a Node 20 prebuild and started compiling from source inside an image with no compiler. This is the first working image since July.
Downloads
| Platform | File |
|---|---|
| Windows (x64 + arm64) | Backspace-1.0.2.exe |
| macOS Apple Silicon | Backspace-1.0.2-arm64.dmg |
| macOS Intel | Backspace-1.0.2-x64.dmg |
| Linux x64 | Backspace-1.0.2-x86_64.AppImage / Backspace-1.0.2-amd64.deb |
| Linux arm64 | Backspace-1.0.2-arm64.AppImage / Backspace-1.0.2-arm64.deb |
macOS first launch
The app is signed but not notarized, so Gatekeeper stops the first launch. You only need to do this once.
macOS 15 and later: open the app, dismiss the warning, then go to System Settings, Privacy & Security, and press Open Anyway.
macOS 14 and earlier: right-click the app, choose Open, then Open again.
Auto-update still does not work on macOS, so check the releases page for new versions. Windows and Linux AppImage builds update automatically.
Known, not fixed here
Voice presence updates are still sent to the whole space, while the initial voice state snapshot is correctly filtered by channel visibility. A member who cannot see a voice channel gets a filtered list on connect and then sees that channel's join and leave traffic. This is being fixed separately because it touches the client.
Logging in directly at a remote instance still forwards your password to your home instance. That path is what makes direct remote login work, so removing it needs its own design. If you have connected to an instance you do not trust, change your home password.