v2.1.2

What's Changed

Link Preview Overhaul

The link preview system has been overhauled and requires some more steps to use link previews successfully. One big benefit to this new system is that we've got video preview images!

Previews are now resolved by lurker-previews, a second container that does all the fetching and media parsing, so your main server never dials a user-supplied URL or runs a media parser over hostile bytes. Because previews cannot work without it, pointing at a decoder is the on switch — there is no separate flag any more.

Two variables change:

2.1.1	2.1.2
LURKER_LINK_PREVIEWS=on	LURKER_PREVIEWS_URL=http://lurker-previews:8030
LURKER_PREVIEW_USER_AGENT=…	same name, but set it on the decoder

Add the service to your compose file and point the main server at it:

services:
  lurker-previews:
    image: ghcr.io/amiantos/lurker-previews:latest
    restart: unless-stopped
    environment:
      - LURKER_PREVIEWS_ALLOW_PRIVATE=1  # this is insecure, read docs/SELF_HOSTING.md to learn more

  lurker:
    environment:
      - LURKER_PREVIEWS_URL=http://lurker-previews:8030
      - LURKER_PREVIEW_CACHE_MODE=local # this, or s3, is required for video posters to work

Full setup, the egress model, and hardening: Link previews & inline media in docs/SELF_HOSTING.md.

Favorite Uploads & Uploads Quick Access

There is now a star icon you can assign to your uploads, so you can favorite gifs or images you've uploaded and want to use repeatedly. The paperclip icon in the status bar now brings up a little overlay allowing you to quickly access your favorite or recent uploads to insert into chat.

Commits

• Docs: link previews for operators and users by @amiantos in #772
• Link previews: stop relaying video and audio by @amiantos in #777
• Link previews: isolate the decoder into lurker-previews (M3 + posters) by @amiantos in #779
• Inline media polish: pad image-only messages, drop the 4-tile mosaic cap by @amiantos in #780
• Link previews: warn when the decoder is unreachable, and document the shared-network requirement by @amiantos in #781
• Star uploads to keep them at hand by @amiantos in #782
• Bump Lurker version to 2.1.2 by @amiantos in #783

Full Changelog: v2.1.1...v2.1.2

v2.1.1

What's Changed

• Fixed / improved mIRC color support and display formatting.
• Made some improvements to how link previews are displayed and organized.

What's Changed - Detailed

• Make every mIRC slot a literal colour by @amiantos in #758
• Stop the spoiler close from eating the text after it by @amiantos in #760
• Link previews: hide the URL, mosaic groups, and a hero card for landscape images by @amiantos in #768
• Preview byte cache: a dropper mode for the hosted fleet by @amiantos in #770
• Bump Lurker version to 2.1.1 by @amiantos in #771

Full Changelog: v2.1.0...v2.1.1

v2.1.0

What's Changed

New Features

• Theme Presets - You can now save and load different theme presets.
• Light Mode - There is now a light mode theme to choose from, built right in. And it looks great, too!
• System Light / Dark Mode Support - You can choose two different themes to auto-apply based on your system-level setting.

Fixes

• PWA Swipe-to-go-back - Rejoice! Every buffer has a unique URL route now, so you can now 'swipe back' on Android and iOS PWAs, as well as using browser back/forward buttons on desktop (if you so desire). Fun bonus: you can now bookmark specific buffers, and you can copy a link to a specific message, to open that message in a new window, as an example.
• Misc. Fixes - Fixed a possible issue with nick suggestions in the input bar on Android Firefox (maybe?), as well as some other minor fixes and improvements.

What's Changed - Detailed

• Give every buffer a URL, and derive the mobile screens from it (#744, #200) by @amiantos in #749
• Theme presets foundation: built-in Dark/Light, saved themes, system-scheme mapping by @amiantos in #750
• Fix composer freezing during IME composition (Android keyboards) by @amiantos in #624
• Network form: say what "commands to run on connect" actually wants by @amiantos in #752
• Remove the asyncHandler wrapper — Express 5 forwards async rejections itself by @amiantos in #754
• Hoist the .ua flex+gap workaround into the shared .device row by @amiantos in #753
• Auto-reconnect: a ban on a surviving socket no longer poisons the next drop by @amiantos in #756
• Survive the controlling terminal going away by @amiantos in #755
• Bump wrangler from 4.114.0 to 4.116.0 in /docs in the minor-and-patch group by @dependabot[bot] in #751
• Bump Lurker version to 2.1.0 by @amiantos in #757

Full Changelog: v2.0.0...v2.1.0

v2.0.0

What's Changed

⚠️ This is a big update! Backup your data folder before the update, just to be safe! ⚠️

• Breaking Change: The existing friends system has been stripped out and replaced with a new, simpler friends system based on marking a DM buffer as a 'friend' instead. Your existing friends will be auto-converted to the new friend system, so most users will not notice any difference.
• You can now "Favorite" channels to pull them into a dedicated space in your sidebar, similar to the Friends system. This is a supplement to the in-network pinning system, as another tier of organization and favoritism.
• The new Friends and Favorites sections can be freely reordered.
• Nick changes are now tracked automatically for peers, so any open dm/query buffer will automatically rename itself to match the new nickname.
  • Breaking Change: In order to support this, there needed to be some changes to Lurker's internal database. On start up after updating, you will see some messages indicating your database is migrating to the new model. It shouldn't take long unless you are on a very slow system. I'm marking this as a breaking change as data exports from Lurker 2.0.0 definitely cannot be used with Lurker 1.1.6.
• Added support for m4a, and pretend m4a (3gpp in an m4a container) audio files to the uploader system.
• Link Previews (Beta): Fixed an issue where new messages with link previews were not sticking to the bottom of the chat correctly on load.
• Misc. dependency updates and other fixes.

What's Changed - Detailed

• Route main-branch Docker publishes to :staging; reserve :latest for releases by @amiantos with @Copilot in #712
• Normalize buffer identity: messages.buffer_id, sentinel rows, resumable backfill (v17) by @amiantos in #711
• Rebuild the view-state satellites onto buffer_id keys (v18) by @amiantos in #713
• Put bufferId on the wire, and let verbs address buffers by id by @amiantos in #714
• Vue: buffer ids in the store, and one lifecycle registry for per-buffer state by @amiantos in #715
• DM buffers follow their peer through /nick by @amiantos in #716
• Update lurker image to use latest tag in sample compose file by @amiantos in #717
• Fold targets per the server-declared CASEMAPPING (#707) by @amiantos in #718
• Remove the Friends/Contacts system (buffer favorites will replace it) by @amiantos in #720
• Buffer favorites: server foundation + contacts migration (schema v19) by @amiantos in #721
• Vue client: FRIENDS + FAVORITES sidebar sections by @amiantos in #723
• Revive friend-online notifications, keyed on favorited DMs by @amiantos in #725
• Accept audio/mp4 + 3GPP (video/3gpp, video/3gpp2) uploads — same ISO-BMFF scrubber by @JawshTheDark in #685
• build(deps): batch six dependabot updates by @amiantos in #728
• build(deps): batch dependabot round 2, constrain the docker ecosystem by @amiantos in #734
• build: move the runtime to Node 24 LTS by @amiantos in #735
• Reserve an inline image's box in Blink, not just in WebKit by @amiantos in #737
• Source membership modes from ISUPPORT PREFIX, not a hardcode (#486) by @amiantos in #738
• Hoist the per-row notify-always lookup out of N-row decorates (#679) by @amiantos in #739
• Evict the preview value, never the ref identity (#694) by @amiantos in #740
• Own the preview-toggle watcher at module level, not by a route (#693) by @amiantos in #741
• Rewrite ||spoiler|| in /me, /msg, /notice and /shrug too (#652) by @amiantos in #742
• Add a 1.1.x → 2.0 client migration guide by @amiantos in #743
• One channel-prefix test, shared by both tiers (#724) by @amiantos in #745
• Bump Lurker version to 2.0.0 by @amiantos in #747

Full Changelog: v1.1.6...v2.0.0

v1.1.6

What's Changed

• Inline Link Previews (Beta) - Lurker now supports inline link previews for images, videos, webpages, and YouTube videos.
  • To turn this on, add LURKER_LINK_PREVIEWS=on to your env variables. Then users on your instance can go to Settings -> Chat to turn on link previews and/or image previews separately.
    • Preview content is proxied through your Lurker instance. You can enable local caching of preview content via the env var LURKER_PREVIEW_CACHE_MODE=local. There is also an s3 storage mode for the preview cache, with more env vars to configure that.
  • Known Issues
    • Chrome: when a new message with a preview comes into the message list, the message list does not scroll down to reveal the preview. This functionality works currently on Safari.
  • Please join #lurker on libera.chat or mansionNET to share feedback about this feature while it is in beta!
• Some miscellaneous other fixes and improvements.

What's Changed - Detailed

• Make the connect snapshot's resume path cheap (#469) by @amiantos in #677
• Harden and share the SSRF address guard by @amiantos in #682
• Add the SSRF-safe fetcher behind link previews by @amiantos in #683
• Link previews 3/6: metadata scraping and the embed table by @amiantos in #684
• Link previews 4/6: the resolver, its cache, and the feature flag by @amiantos in #690
• Link previews: the Vue client by @amiantos in #691
• Inline media: reveal a message's attachments all at once, and never size from bytes by @amiantos in #696
• Measure WebP and GIF dimensions sharp refuses to read from a truncated header by @amiantos in #697
• Stop /ignore from quietly authoring a rule nobody asked for by @amiantos in #699
• Give the link-preview card a shape, and make YouTube embeds play by @amiantos in #698
• Cache preview image bytes on disk by @amiantos in #700
• Cache preview bytes in a bucket, served from its CDN — no redirect by @amiantos in #701
• Check that a cached image is actually an image by @amiantos in #702
• Stop asking a host that just rate-limited us by @amiantos in #703
• Add new icon + iOS screenshots + update README by @amiantos in #704
• Guard the FTS update trigger on the columns it actually indexes by @amiantos in #708
• Update Lurker image version to 1.1.5 by @amiantos in #709
• Bump Lurker version to 1.1.6 by @amiantos in #710

Full Changelog: v1.1.5...v1.1.6

v1.1.5

What's Changed

• Added new chat.keep_position_on_send option, which maintains your scroll position when you send a message instead of jumping to the bottom. Off by default, which maintains existing behavior.
• A handful of changes were made to the websocket to improve it, basically. The most visible change should be that when you load in a buffer that has a lot of event noise, and you have join consolidation turned on, you shouldn't see the 'load in' effect in the buffer as much as you used to, or at all.
• Overhauled the system behind event consolidation and filtering. The main improvement is that you can now choose different event filter levels between desktop and mobile. So on desktop you could show all events with consolidation, and on mobile you could just hide all event noise entirely.
• Backend improvements (and matching client side improvements) to how the bookmarks system conveys bookmarks to the client (this was a bit wacky before, it's more normal now).

This update is required to use bookmarks functionality in the latest versions of the iOS TestFlight beta client.

What's Changed - Detailed

• Add "stay put when you send" to the composer by @amiantos in #667
• Say how to merge a backlog frame instead of implying it by @amiantos in #668
• Drop wedged sockets, back off on reconnect, and always answer open-buffer by @amiantos in #669
• Size history pages in rendered rows, not stored ones by @amiantos in #670
• Take hydration off open-buffer, and announce a real open by @amiantos in #671
• Collapse event-noise filtering into one tier (#666) by @amiantos in #672
• Carry bookmark state on message rows, drop the connect snapshot by @amiantos in #674
• Bump version to 1.1.5 by @amiantos in #675

Full Changelog: v1.1.4...v1.1.5

v1.1.4

What's Changed

• Fixed issue where spoilers created with ||spoiler tagging|| were basically invisible.
• Added backend improvement where the server can tell clients the maximum allowed upload size.
• Added backend improvement: LURKER_MAX_UPLOAD_MB declares max upload MBs, which helps if you're using Cloudflared and your upload maximum is a hard 100mb limit.
• Fixed some edge cases around auto-reconnection that could cause auto-reconnect attempts to end early.
• Added /j and /p shortcuts, and /shrug ¯_(ツ)_/¯
• Added backend improvement: the server can tell clients there is no more message content in a buffer.
• Fixed a login redirect loop.
• Fixed identd to now properly use the Lurker account name for the user, not their nickname.
• Added admin ability to override identd per user in the Admin -> User menu.
• Fixed issue where Lurker usernames were case sensitive and could have spaces or other unusual characters in them (🤦🏻‍♂️)
• New page on https://docs.lurker.chat explaining Lurker's IRCv3 support and why it supports the various capabilities.
• Added new count badge of unread highlights that appears in the mobile app (by the back button) and on the desktop app (if you have the channel list collapsed) to aid in visibility of important unread messages.
• Various dependency updates.

What's Changed - Detailed

• Highlight-count chip on the buffer-list reveal controls by @amiantos in #638
• Fix the infinite login redirect loop that ends in a 429 by @amiantos in #639
• Send a terminal backlog-complete frame at the end of the snapshot burst by @amiantos in #640
• Document IRCv3 support by what each capability delivers by @amiantos in #642
• Derive the identd ident from the Lurker account, admin-assignable (#643) by @amiantos in #644
• Lock down usernames: no spaces, case-insensitive identity by @amiantos in #645
• Advertise the effective upload cap so clients stop guessing (#627) by @amiantos in #648
• Add /j and /p aliases and a /shrug command (#412, #532) by @amiantos in #654
• Clamp imports to the transport ceiling and warn before the upload (#649) by @amiantos in #653
• Gate auto-reconnect on the same policy every connect clears (#616, #617) by @amiantos in #655
• Fix spoilers rendering in the app's own background colour by @amiantos in #656
• Batch the dependency bumps (#605, #659, #661, #662, #663) + clear 3 high-severity advisories by @amiantos in #658
• Bump the npm_and_yarn group across 2 directories with 3 updates by @dependabot[bot] in #660
• Dependency batch, part 2: the security fixes #658 missed by @amiantos in #664
• Bump actions/checkout from 7.0.0 to 7.0.1 in the actions group across 1 directory by @dependabot[bot] in #663
• Bump version to 1.1.4 by @amiantos in #665

Full Changelog: v1.1.3...v1.1.4

v1.1.3

What's Changed

• Fixed an issue where the big migration in the last release could take a long time and cause problems with external database replication...
• Fixed an issue where push devices for native apps were mislabeled in the web client's notification client list
• Added client protocol spec / guide to the docs site
• If a server provides a timestamp for a message, we record that timestamp and not the time we received the message.
• We're also internally recording msgid to lay the groundwork for possible future reply / react support.
• The server now reports accurate notify status on message arrivals that properly reflect the ignore rules.
• Fixed an issue where the /part command didn't work as expected.
• Overhauled the "automatically reconnect" system so it will actually, like, reconnect you reliably, automatically.
• Fixed an issue (hopefully) that caused the message list and/or input bar to disappear on mobile Chrome.
• Admin screens like invites and users will automatically refresh as you click on them, so stale data doesn't persist confusingly.
• mIRC color codes are properly stripped from notifications.

What's Changed - By Pull Request

• Run the v16 buffers cutover as BEGIN IMMEDIATE by @amiantos in #603
• Label native push devices by transport instead of user agent by @amiantos in #604
• docs: Client Protocol & API spec for third-party client authors by @amiantos in #609
• docs: surface Developers as a top-nav dropdown by @amiantos in #610
• Store IRCv3 server-time + msgid; adopt echo-message for own sends by @amiantos in #611
• Fold the ignore/mute veto into the server notify flag by @amiantos in #614
• /part: leave the current channel with a reason by @amiantos in #615
• Own the IRC reconnect policy: retry-forever with backoff by @amiantos in #618
• Fix blank message lists (hydration reconciler) and the vanishing mobile-Chrome input bar by @amiantos in #619
• Admin screens auto-refresh + strip mIRC codes from notifications by @amiantos in #620
• Bump version to 1.1.3 by @amiantos in #621

Full Changelog: v1.1.2...v1.1.3

v1.1.2

What's Changed

• Added support for APNs and FCM push notifications (for first-party mobile apps)
• Added chghost support and message consolidation support
• Added extended-join support (new option chat.show_join_account)
• Changed: zipline uploads now user /raw/ urls
• Changed: removed /local/ path from local uploads
• Fixed: settings button could become unresponsive (hopefully fixed)
• Fixed: chat.allow_split_messages was not working properly.
• Big database migration to change how open/closed buffers are tracked.

What's Changed - Detailed

• Fix WS upgrade origin check breaking behind reverse proxies (#577 regression) by @amiantos in #580
• Native push notifications: transport seam, APNs + FCM (#490) by @amiantos in #587
• Handle chghost and extended-join for other users by @amiantos in #592
• Fix a load-dependent race in the push presence test by @amiantos in #594
• Consolidate chghost alongside join/part/quit by @amiantos in #595
• Honor chat.allow_split_messages at every message count by @amiantos in #596
• Fix two uploader URL-shape bugs (#582, #589) by @amiantos in #597
• Bump file-type from 19.6.0 to 22.0.1 by @dependabot[bot] in #585
• Bump the minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in #599
• Bump the minor-and-patch group across 1 directory with 6 updates by @dependabot[bot] in #598
• Bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #586
• Recover from failed lazy-route chunk loads (#571) by @amiantos in #600
• Buffer registry: replace derived existence, closed_buffers, and channels with one buffers table by @amiantos in #601
• Bump version to 1.1.2 by @amiantos in #602

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• Added full support for bearer token authentication to allow for mobile apps (which are being prototyped now)
  • https://github.com/amiantos/lurker-android
  • https://github.com/amiantos/lurker-ios
• Added rate limiting to protect auth endpoints
• Added proper support for oidentd (similar to TheLounge's setup)
• Improved how locked down paused user accounts are

What's Changed - Detailed

• Accept bearer session tokens on the WebSocket and REST (#489) by @amiantos in #570
• Add per-IP auth rate limiting / brute-force backoff (#568) by @amiantos in #572
• Add oidentd shared-daemon ident mode (LURKER_OIDENTD_FILE) by @amiantos in #575
• WS protocol versioning + upgrade hardening (#569, #574) by @amiantos in #577
• Block paused-account writes centrally in requireAuth (#573) by @amiantos in #576
• Release 1.1.1 by @amiantos in #579

Full Changelog: v1.1.0...v1.1.1