uhub 0.8.1

uhub 0.8.1 is a security release for the 0.8 series. It fixes four issues, all reported by @Kcchouette. Thank you!

Upgrade if you link hubs, use auth_proxy, or rely on exclusive authentication.

Advisory	Issue	Severity	Affected
UHUB-2026-005	#127 — a peer without the link secret could join a linked hub by reflecting the hub's own challenge	Critical	0.7.0 – 0.8.0, linking enabled
UHUB-2026-006	#128 — a newline in a nick on an auth_proxy slave injected commands into the master link	Critical	0.7.0 – 0.8.0, auth_proxy enabled
UHUB-2026-007	#129 — !unban could inject link commands and lift a ban by CID prefix	High	0.8.0
UHUB-2026-008	#130 — exclusive authentication did not keep unknown nicks out	Medium	≤ 0.8.0

Beyond the four fixes, the hub-to-hub link is hardened throughout:

• Every line written to a link refuses an embedded CR/LF.
• A peer can only route messages as users it owns.
• Auth replies are accepted only from the auth master.
• A ban on a nick containing a space now bans that nick on the other hubs, not its first word.

Before you upgrade

• Linked hubs must be upgraded together. The link handshake is now version 2, and a 0.8.1 hub cannot link with an older one. See doc/linking.txt.
• mod_auth_sqlite with exclusive=1 now refuses nicks that are not in its database, as documented. Remove exclusive if you want to keep admitting guests.

Otherwise 0.8.1 is a drop-in replacement for 0.8.0: same configuration and the same plugin API. Plugins don't need rebuilding.

Downloads

To build from source, download uhub-0.8.1-src.tar.gz (or .zip). The "Source code (zip)" and "Source code (tar.gz)" links GitHub adds automatically are incomplete and will not build: they cannot contain the bundled third_party/exotic and third_party/quickjs submodules. Use the archives attached here, or clone with git clone --recursive --branch 0.8.1.

Checksums are in SHA256SUMS. See the ChangeLog for the full list of changes.