4.4.0

What's Changed

• test(sdk): cover similar-entries timeout split + fix retry comment by @feruzm in #905
• fix(web): give pasted editor images a valid filename before upload by @feruzm in #904
• fix(web): align mobile scroll-to-top with FAB; lead publish bar with community selector by @feruzm in #906
• fix(web): unify publish mode label into one aligned header by @feruzm in #907
• fix(web): fully hide mobile FAB + scroll-to-top when navbar hides (no half-cut) by @feruzm in #908
• Soft-moderate new-account posts with outbound links (SEO/backlink-farm) by @feruzm in #909
• Server-side CAPTCHA: Turnstile on free signup (+ web 4.4.0) by @feruzm in #910
• fix(web): block open redirect via decoded path in middleware by @feruzm in #911
• Add Spotlight type and getSpotlightsQueryOptions to @ecency/sdk by @feruzm in #912
• Add feature-spotlight sidebar widget to the feed by @feruzm in #913
• Spotlight: feed layout tweaks, CTA button fix, Plausible tracking by @feruzm in #914
• feat(profile): show followers/following as page sections instead of modals by @feruzm in #915
• feat(web): agent-readable post endpoints (.md / .json / .discussion.json) + llms.txt by @feruzm in #916
• Spotlight: guests-only audience (replace auth boolean) by @feruzm in #917
• Read next: render cards visible in SSR (CSS entrance, not framer-motion opacity:0) by @feruzm in #918
• Hide proposal announcements from users who already voted by @feruzm in #919
• fix(sentry): Filter Hive RPC "category/tag does not exist" errors from RSS feeds by @sentry[bot] in #921
• Parameterize web replica count (WEB_REPLICAS) by @feruzm in #922
• Make prod deploy fail loudly instead of silently passing by @feruzm in #923
• Latency-aware adaptive node selection in hive-tx by @feruzm in #924
• Read next: add staleTime so SSR-hydrated data skips the redundant client refetch by @feruzm in #925
• vapi: pin search backend to origin IP (bypass broken CF colo path) by @feruzm in #926
• fix(sdk): adaptive node selection — cold-start order + caller-abort handling by @feruzm in #927
• Default search to Relevance over all time by @feruzm in #929
• render-helper: cache-safe per-format image negotiation (web/self-hosted) by @feruzm in #928
• fix(entry): skip LCP preload when the cover URL can't be resolved (no double-download) by @feruzm in #930
• fix(rss): also treat Hive bridge "invalid tag" assert as transient by @feruzm in #931
• perf(web): keep tus-js-client and qrcode off the read-path bundle by @feruzm in #932
• fix(discover): stop double-converting curator rewards to HP by @feruzm in #934
• fix(3speak): stop duplicate video uploads (use token embed URL) by @feruzm in #933
• feat(seo): add tags.xml sitemap shard of top tag hub pages by @feruzm in #936
• fix(chat): make sidebar 3-dot menu discoverable and fix broken theming by @feruzm in #935
• fix(chat): reply preview quotes the parent message, not itself by @feruzm in #937
• fix(chat): thread panel shows the full conversation, not just loaded posts by @feruzm in #938
• feat(entry): oEmbed provider + replace in-post link scrape by @feruzm in #939
• feat(chat): modernize channel/DM list with borderless rows by @feruzm in #940
• fix(oembed): return 400 (not 501) for unsupported format by @feruzm in #941
• fix(signup): serve Turnstile widget from a hosted /embed route for mobile WebView by @feruzm in #942
• fix(entry-stats): date-scope + canonical-path Plausible queries by @feruzm in #943
• fix(stats-proxy): exact-match post pages to stop sibling-permlink overmatch by @feruzm in #944
• Security hardening: embed sanitization, CSP, Mattermost admin authz, import proxy by @feruzm in #945
• CSP reports: route through a de-duplicating first-party collector (fix Sentry flood) by @feruzm in #946
• CSP collector: log report-only violations instead of sending them to Sentry by @feruzm in #947
• Allowlist real feature deps surfaced by CSP report-only monitoring by @feruzm in #948
• Serve /embed/turnstile as self-contained static HTML by @feruzm in #949
• Allow WASM eval in the Turnstile embed CSP (fixes stuck 'Verifying…') by @feruzm in #950
• perf: mobile CWV (1/2) — homepage redesign, mobile-only navbar search, lighter shared bundle by @feruzm in #951
• fix(ci): drop @ecency/sdk from optimizePackageImports to fix build OOM on develop by @feruzm in #952
• fix(home): visible footer social icons, Contributors link, expanded About copy by @feruzm in #953
• fix(home): correct About email + CF-verified visitor stat by @feruzm in #955
• perf(sentry): defer Sentry SDK off every route's eager bootstrap (-67KB First Load JS/route) by @feruzm in #954
• perf(feed): replace the 30s all-card re-render fan-out with a self-ticking TimeLabel by @feruzm in #956
• perf(feed): defer below-the-fold card action-bar hydration (feed TBT fix) by @feruzm in #957
• perf(navbar): lazy-load sidebar search to evict the search graph from the eager bundle by @feruzm in #958
• feat(home): lead the hero with the Ecency wordmark instead of the logo mark by @feruzm in #959
• perf(navbar): defer the 5 sidebar user dialogs out of the eager navbar chunk by @feruzm in #960
• fix(home): hero subtitle copy, Signup as primary CTA, brand kicker treatment by @feruzm in #961
• feat(sdk): label server-side Hive requests with a real User-Agent by @feruzm in #962
• chore(deps): bump ws from 8.18.3 to 8.21.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #963
• chore(deps): bump dompurify from 3.4.0 to 3.4.9 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #964
• fix: don't autoplay videos in waves feed by @feruzm in #965
• fix(web): make Extensions login reliable and quiet Permissions-Policy warnings by @feruzm in #966
• fix(sdk): classify "missing required active/owner authority" for auth fallback by @feruzm in #967
• fix(web): harden MetaMask snap login (version guard + benign cancel) by @feruzm in #968
• fix(web): stop external-transfer dialog from auto-prompting MetaMask connect by @feruzm in #969
• fix(web): always show the extension picker when 2+ extensions are installed by @feruzm in #970
• feat(waves): show payout + correct vote count on waves cards by @feruzm in #971
• chore(deps): bump dompurify from 3.4.9 to 3.4.11 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #972
• feat(waves): show payout/votes/replies on following + tag feeds by @feruzm in #973
• fix(waves): publish time on custom feeds + tag selection on Following by @feruzm in #974
• infra(web): cap US replicas to 3 and bound SSR memory (arena + heap + mem_limit) by @feruzm in #975
• fix(sdk): preserve unrelated metadata on account_update2 writes by @feruzm in #976
• chore(deps): bump undici from 6.25.0 to 6.27.0 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #977
• fix(sdk): default Transaction.signatures to [] (hive-uri sign crash) by @feruzm in #979
• feat: Resource Credits pre-publish check + RC top-up purchase client by @feruzm in #978
• fix(web): resolve Hive Keeper via live window.hive, not a dead hive_extension check by @feruzm in #980
• feat(config): enable RC top-up feature flag by @feruzm in #981
• feat(points): funnel low-RC users to buy Points + clearer purchase steps by @feruzm in #982
• chore(deploy): pass STRIPE_INTERNAL_SECRET to vapi in the stack deploy by @feruzm in #983
• feat(points): buy Points with a card via Stripe Payment Element by @feruzm in #984
• fix(csp): allow Stripe.js (Payment Element) origins by @feruzm in #985
• fix: enable Stripe wallets + route signing to the logged-in extension (Keychain/Keeper hijack) by @feruzm in #986
• feat: unified Sign-with-Extension picker across all signing surfaces by @feruzm in #987
• feat(publish): rebuild geo-tag picker on open-source map + hybrid search by @feruzm in #988
• feat(tip): add tip button to comments, feed cards, and decks by @feruzm in #989
• feat(stripe): premium account purchase by card on the web (P6d) by @feruzm in #990
• chore(embed): drop the dead, misleading CSP from the Turnstile embed route by @feruzm in #991
• fix(waves): guard get_discussion so one failed container can't empty the For-you feed by @feruzm in #992
• fix(comments): tip button before Reply + keyboard-accessible reblog by @feruzm in #993
• perf(embed): edge-cache the Turnstile widget instead of no-store by @feruzm in #994
• fix(safe-tweet): quiet the handled tweet-embed failure log by @feruzm in #995
• feat(signup): localize free-signup error messages by backend code by @feruzm in #996
• Use distinct QR illustration for buy-points-with-QR card by @feruzm in #997
• Show the actual extension (Keeper / Peak Vault) on login account badges by @feruzm in #999
• fix(sentry-filter): widen botnet regex to match old Chrome 'property' format by @sentry[bot] in #998
• fix(mobile): feed card overflow, list-item bullet, and CSS-skew recovery by @feruzm in #1000
• fix(pwa): exclude non-servable assets from the SW precache so it can update by @feruzm in #1003
• fix(profile): validate website URL before prefetching by @sentry[bot] in #1001
• fix(sentry-filter): drop webkit.messageHandlers errors from non-WKWebView by @sentry[bot] in #1002
• waves: single combined cross-container feed by @feruzm in #1004
• Liketu Speak: audio player, footer cleanup, indexability by @feruzm in #1005
• waves: server-side observer mute filter + author feed param by @feruzm in #1006
• feat(waves): publish to hive.flow first, fall back to ecency.waves by @feruzm in #1007
• fix: strip emoji before translation to fix language detection by @feruzm in #1008
• fix(signup): block chain-invalid usernames synchronously before submit by @feruzm in #1009
• fix(entry-payout): guard missing beneficiaries in EntryPayoutDetail by @feruzm in #1010
• feat: DecentMemes meme maker (publish + waves) by @feruzm in #1011
• fix(render-helper): stop Skatehive IPFS videos autoplaying in waves by @feruzm in #1012
• feat(waves): show Ecency source badge on wave header by @feruzm in #1013
• fix(waves): friendly not-found screen for unavailable waves by @feruzm in #1014
• fix(i18n): repair en-US.json broken by waves PR merge by @feruzm in #1015

Full Changelog: 4.3.9...4.4.0