What's Changed
Security fixes
Upgrading is recommended for all installations.
-
Room administration actions were not scoped to the room type of the namespace handling them. A member could delete any room they belonged to — along with its entire message history — and the creator of a direct message could convert it into an open or closed room, republishing the conversation to everyone on the account or taking control of who remained in it. Each room controller is now scoped to the types it administers, and a direct room can no longer change type. (GHSA-hcw3-6vw6-mpr4)
-
Message stream subscriptions were authorized by signature alone, so removing someone from a room did not stop them receiving its messages. Subscriptions are now checked against current membership. (GHSA-xg3h-rg27-h6fr)
-
Activity in every room was announced on one global stream that any signed-in account could join, exposing which rooms were active and when — including closed rooms and direct messages. The stream is now per user.
Reported by @enesdal, @wonbrand and @fg0x0. Full details: #232.
Full changelog: v1.4.7...v1.4.8