v3.2.0

Feature release focused on accounts and sign-in: passkeys, passphrase recovery, the Boson Identity app, and sign-in for community apps. Also adds subscriptions to the DHT, moves to Vert.x 5.1, and makes super node updates safer.

Note: The Director database schema changes in this release and is migrated automatically on the first start of 3.2.0. A node on 3.1.x cannot go back to it once migrated, so back up the database before upgrading: the node's SQLite database, or a pg_dump of PostgreSQL. The super node setup tool's --update dumps the database for you before it installs a release that migrates it.

Note: OAuth sign-ins now return only to the node's own site and to the apps listed in oauth.allowedRedirects, which defaults to the Boson Identity and Photon app links. On a node with OAuth configured, the Debian packages add those two links and communityApps: true to /etc/boson/director.yaml on upgrade, keeping any entries already listed; elsewhere run the setup wizard with --migrate.

Added

• Add subscriptions to DHT values and peer records, kept alive through NAT rebinding and lapsed mappings and offered by nodes that support them (Orca 2 and later), with subscribe and unsubscribe commands in the boson-node shell.
• Add passkey sign-in to the Director, the User Portal and the Admin Dashboard.
• Add passphrase recovery with recovery codes, a passkey, or a linked OAuth account, never with the user key alone.
• Add sign-in for community apps that are not listed in the node's configuration, using an OAuth client ID metadata document, PKCE, and a consent page on the node; such apps get client scope only.
• Add support for the Boson Identity app: web sign-in through the app, device approval that uses the user key only when asked, and administrator enrollment by QR code with boson-director-cli user enroll-admin.
• Add a security log of account events, kept for 90 days or each user's newest 200 events.
• Add device rename and the management of linked sign-ins.
• Add a profile revision, so that a profile or avatar change made meanwhile on another device is detected rather than overwritten.
• Add database migration detection to the super node setup tool's --update, which dumps the database before a release that migrates it and prints the restore commands if the update fails afterwards; --backup-database and --no-backup-database override when the dump is taken.

Changed

• Upgrade to Vert.x 5.1.10, Netty 4.2.19 and Jackson 2.21.7.
• Merge Resolver into Registry in the Boson API: publish, look up and unpublish cards with a choice of version, with a built-in bounded card cache in place of the Caffeine and persistent resolution caches.
• Hand web pages the OAuth sign-in token in the URL fragment.
• Require the passphrase to link or unlink an OAuth sign-in, slow down repeated wrong passphrases, and check the strength of a new passphrase, with a minimum length of 8.
• Sign direct device registration with the user key, and make finishing a registration repeatable so that a lost approval answer can be fetched again.
• Publish messaging channel cards when a channel is created, renamed or changes its announcement rather than hourly, and unpublish them when announcing stops or the channel is deleted.
• List sign-in methods on the User Portal and the Admin Dashboard as passkey, Boson Identity, then OAuth providers.

Fixed

• Fix request bodies being lost when a Web Gateway store or announcement, or an Ion Store upload, waited for the Director's plan check.
• Fix a user record cached by the Director moving a hosted service onto the Director's thread, which lost request bodies.
• Fix the MQTT and federation servers of Photon Messaging publishing to sessions from each other's thread.
• Fix the client libraries resolving host names on the caller's thread under Vert.x 5.1, which Android refuses on its main thread.
• Fix a race in the messaging client loading a channel's members.
• Fix the home node profile lookup for messaging recipients.
• Fix the device admin flag in Director JSON, and duplicate and clashing paths in the Director OpenAPI specification.
• Fix various stability, test, documentation, and other minor issues.

v3.1.2

Maintenance release focused on tooling and distribution: the command line tools are now Java and ship on every platform, release assets carry a signed checksum file, an existing super node can be updated in place, and a node learns its own public endpoint from the network.

Note: The command line tools replace the earlier Rust tools of the same names. On Debian systems boson-cli, boson-director-cli and boson-node are all on the path after installing the packages, and boson-node replaces the DHT runner and its shell.

Note: The admin CLI configuration key rootUserKey is renamed to privateKey. The Debian packages migrate /etc/boson/director-cli.yaml on upgrade; elsewhere run the setup wizard with --migrate to bring an existing file up to date.

Added

• Add new Java command line tools, available on every supported platform: boson-cli for users and application developers, boson-director-cli for operators, and boson-node to run and explore a DHT node.
• Add super node service access to boson-cli, which finds the Ion Store, DHT and Active Proxy of a node through its Director.
• Add a Director client library covering the full client API, OAuth sign-in, device pairing and the admin API, published to Maven Central.
• Add public endpoint discovery to the DHT: a node learns its endpoint from what replying nodes observe, announces a change with a self-lookup, and gives up an endpoint that has gone stale.
• Add user blocking to the messaging client, dropping friend requests and direct messages from blocked users.
• Add a contact synchronization RPC to the messaging service, so a device can fetch the changes it missed.
• Add a Date header to every Director, service and federation answer, so a client with a skewed clock can correct itself and sign its own access tokens.
• Add public endpoint detection to the super node setup wizard, falling back to the local address with a warning.
• Add retrieval by ions:// address to the Ion Store client, served locally when the address names the bound service.
• Add a side-effect-free registration options endpoint and a public admin identity endpoint to the Director.

Changed

• Advertise Active Proxy session endpoints at the node's public address rather than its bind address.
• Take the service endpoint and upstream as URIs in the Active Proxy client configuration, and remove its standalone launcher in favour of boson-cli.
• Apply friend request rules consistently across the messaging service and client, and date a received request by both its send and arrival time.
• Bind the node configuration templates to the local address, and require peer.endpoint for a wildcard Active Proxy host.
• Use the official Boson mark across the node home page, the User Portal and the Admin Dashboard.
• Refuse to start on Java older than 17 when no runtime is bundled, rather than failing later.

Fixed

• Fix a request body being lost while the Ion Store service resolved the caller's plan, which stored a truncated object.
• Fix contact synchronization losing changes when a device reconnected with a backlog, and stop messages sent in the same millisecond from sharing an id.
• Fix dead routing table entries surviving when no replacement was available.
• Fix admin API list ordering, stale plan data, avatar replacement and malformed input answered with HTTP 500.
• Fix a refused avatar upload and an aborted remote fetch leaving state behind in the Director.
• Fix a connection left open when an Ion Store upload or federated fetch was refused, and report a ciphertext that does not decrypt as a decryption error.
• Fix various stability, test, documentation, and other minor issues.

v3.1.1

Maintenance release focused on super node deployment: running services behind a TLS-terminating reverse proxy, name access without a DNS update per connection, and a default home page for the node.

Note: The Ion Store database schema changed in this release. An Ion Store database created by 3.1.0 will fail to start under 3.1.1 with a schema version mismatch and has to be recreated.

Added

• Add a default super node home page, served at the root, reporting node identity, status, and hosted services.
• Add name access to Active Proxy through a reverse proxy and wildcard DNS, removing the DNS update per connection.
• Add RFC 2136 DNS UPDATE support to the Active Proxy dynamic DNS provider.
• Add an independently configurable listen interface and announced public endpoint for the Photon Messaging federation interface.
• Add service-defined extra values to service configuration, announced alongside the service endpoint.
• Add a tool to reconcile the Ion Store blob directory against its database.
• Add tunable heap size and file descriptor limits for the Boson service through /etc/default/boson.

Changed

• Ship the public Boson Network bootstrap nodes as the default in the bootstrap and super node configuration templates.
• Allow a service to announce a public endpoint whose scheme differs from its own listener, so services can serve plaintext behind a TLS-terminating reverse proxy.
• Serve the super node status without authentication, so the node home page can report availability to any visitor.
• Merge the Ion Store local and cache stores into a single store separated by origin, so cached objects are never served as locally hosted content.
• Report the cause when the admin CLI reaches a Director that is not serving TLS on the configured URL.
• Redesign the User Portal and Admin Dashboard sign-in pages to match the node home page.
• Declare service dependencies and startup order for the Boson systemd service.

Fixed

• Fix Web Gateway returning HTTP 500 instead of the resolved status when a failure carries no message.
• Fix the Web Gateway client ignoring the path prefix in the gateway URL when building requests.
• Fix Active Proxy client sessions cancelling their periodic check on a successful start, which produced duplicate and stale peer announcements.
• Fix the service base path derivation in the Ion Store client.
• Fix various stability, test, documentation, and other minor issues.

v3.1.0

First general availability release, concluding the Community Technical Preview series.

Note: The configuration syntax was reworked in this release and is not backward compatible with 3.0.x. Existing configuration files must be regenerated or updated before upgrading.

Added

• Add per-node announce results, reporting which nodes accepted a value or peer and why others refused.
• Add Kademlia tuning options to node configuration, including lookup, routing table, and bootstrap parameters.
• Add a common rate limiting API across the Director and Layer-2 services, with support for per-second through per-day limits.
• Add service-wide, per-address, per-user, and concurrency-based rate limiting to Web Gateway, Ion Store, and Photon Messaging.
• Add per-API request budgets, costs, and concurrency limits to Director APIs.
• Add plan-based service quotas for Ion Store, Photon Messaging, and Active Proxy.
• Add dedicated client exceptions for gateway errors, rate limits, and channel limits, including retry hints where applicable.
• Add security considerations to the protocol specification.

Changed

• Harden the DHT against malformed and abusive traffic with bounded packet decoding, routing-table contributions, lookup responses, and improved abuse throttling.
• Improve DHT lookup and announce tasks with bounded runtime and effort, more accurate timeout and loss tracking, and proper cancellation of outstanding calls.
• Improve bootstrap reliability with warm starts, bounded bucket fan-out, faster handling of unavailable bootstrap nodes, and reduced interference with application lookups.
• Move per-packet cryptographic operations off the event loop to improve throughput under load.
• Unify service configuration across the Director and Layer-2 services and finalize the configuration syntax.
• Rename plan features to match the corresponding service terminology.
• Retune default user limits, rate limits, and concurrency settings across the Director and services.
• Remove internal DHT instances from the public API and route all sends through the node.
• Improve Web Gateway re-announcement of persistent records with bounded concurrency and lag warnings.
• Restrict key-bearing configuration files to their owning account.
• Improve super node setup and administration, including public-host-based CLI configuration and DNS resolution overrides.
• Remove bundled logging configuration from library JARs so applications can manage their own logging.
• Improve build scripts and platform packaging for a more reliable build process.

Fixed

• Fix RPC socket binding to the wrong protocol family, preventing IPv6 nodes from starting.
• Fix messages and payloads that could exceed a single datagram.
• Fix conditions that could permanently block bootstrapping.
• Fix routing-table maintenance and warm-start sweeps skipping entries that required refresh.
• Fix task dispatch during shutdown and a race involving the local store.
• Fix bootstrap node identity being overwritten or accessed by other accounts.
• Fix stale channel membership after invalidation or early removal notifications in the messaging client.
• Fix incorrect default values when parsing Ion Store configuration.
• Fix configuration file permissions applied by the Debian post-install script.
• Fix various stability, test, documentation, and other minor issues.

v3.0.2

Community Technical Preview 3.

Added

• Introduce a pluggable CryptoProvider SPI with Bouncy Castle as the default implementation, improving crypto extensibility and compatibility.
• Add libsodium-compatible crypto_secretstream_xchacha20poly1305 support for streaming encryption and decryption.
• Add Equihash-based asymmetric proof-of-work primitives to support permissionless registration.
• Add permissionless registration proof-of-work gate in Director to provide Sybil resistance without requiring mandatory OAuth-based registration.
• Add new Vert.x-style in-memory asynchronous ReadStream and WriteStream implementations.
• Add crypto_kdf compatible key derivation API and expose raw key bytes support through CryptoBox.keyBytes().
• Add built-in on-the-fly encryption/decryption support in the IonStore client.
• Add object integrity verification when uploading data to IonStore.
• Add messaging client readiness watchdog to automatically detect and recover unhealthy connections during connection setup.
• Add super node QR code support to simplify mobile client discovery and onboarding.
• Add public API for querying super node identity information.

Changed

• Change self-signed TLS certificate generation from Ed25519 certificates to ECDSA certificates to ensure better compatibility.
• Improve crypto compatibility by moving certificate generation into the crypto provider layer and expanding compatibility tests between Bouncy Castle and libsodium.
• Improve node address management:
  • Support multiple address families(IPv4 and IPv6).
  • Resolve interface bindings to live addresses during startup.
  • Hide low-level network details from public APIs for improved developer experience.
• Replace the IonStore client legacy overloaded put() and get() APIs with new fluent APIs supporting different data sources and built-in stream encryption/decryption.
• Improve HTTP connection reliability in the IonStore client by configuring keep-alive timeout for pooled connections.
• Improve super node setup utility to automatically detect public IP addresses or domain names.
• Improve Director configuration templates and service defaults.
• Improve messaging client message delivery status by leveraging early acknowledgements.
• Improve MQTT session management:
  • Pin active sessions in cache while endpoints are attached.
  • Improve session takeover handling and stale endpoint cleanup.
  • Return more precise MQTT error codes for invalid client connections.
• Improve messaging persistence architecture by introducing a unified repository abstraction.
• Improve Java compatibility for client modules.

Fixed

• Fix MQTT session takeover race conditions and stale endpoint handling.
• Fix incorrect messaging session active address handling.
• Fix unexpected crypto context closure issues.
• Fix sending failures caused by disconnected messaging clients returning unexpected exceptions.
• Fix messaging client retry behavior by returning failed futures for unrecoverable connection errors.
• Fix JSON serialization issues on Android API level 33 by replacing DTO records with regular immutable classes.
• Fix missing channel information after fresh contact synchronization.
• Fix messaging contact event callback issues.
• Fix IonStore cache expiration behavior to prevent serving expired objects beyond their remaining TTL.
• Fix avatar cache and routing issues in Director.
• Fix various stability issues, test failures, documentation issues, and minor bugs.

v3.0.1

Community Technical Preview 2.

Added

• CBOR Web Token (COSE_Sign1) implementation, now used as the bearer token for Web authentication.
• New Ion Store client library.
• User Portal and Admin Dashboard Web apps for the super node, with GitHub and Google OAuth login.
• Server-side persistent store and announcement support in the WebGateway service.

Changed

• Common API improvements ahead of freezing the public API surface.
• Applied JSpecify nullness annotations across the API surface.
• Simplified super node setup: one private key per node, with Layer-2 services using keys derived from it.
• Reworked the Layer-2 service loading mechanism to be native-image friendly.
• Aligned the HiggsNode (Light Node) with the updated WebGateway service, making it more lightweight.

Fixed

• Stability improvements and minor bug fixes.

v3.0.0 (CTP)

Boson Network v3.0.0 — Community Technology Preview

First public release of the Boson Network Java platform. Intended for evaluation and early feedback.

CTP Notice

APIs and configuration formats may change before the stable release. No upgrade path is guaranteed for CTP deployments.

Feedback and bug reports are welcome.