v0.1.9

Changed

• Visual Studio solution versioned with the repository (Kubuno.Chat.slnx, generated by vskubuno, the naming of
  every Kubuno repository): the server is the project Kubuno.Chat.Server, the frontend Kubuno.Chat.Web, in
  the solution folders Server, Libraries and Frontend, with the shared launch profile "Chat (Kubuno Core + browser)".
  The crate and npm names do not change.

• Runs on PostgreSQL, MySQL/MariaDB or SQLite. Chat moves off its
  PostgreSQL-only stack onto the runtime-dispatch kubuno-db 0.6.0 foundation:
  the same binary connects to whichever engine the administrator names in
  [database] engine, read at start-up. All queries were rewritten off the
  driver-specific paths — RETURNING inserts became a Rust-minted id plus a
  re-select (MySQL has no RETURNING), ON CONFLICT and case-insensitive
  matching go through the dialect layer, = ANY(array) becomes a portable
  IN (...), NOW()/make_interval/'-infinity' are computed in Rust and
  bound, LEFT JOIN LATERAL (unsupported by MariaDB/SQLite) becomes a
  correlated subquery, and every integer read is decoded at a width that holds
  on a strict PostgreSQL. Events are published through kubuno-db, which uses
  pg_notify on PostgreSQL and a durable outbox the core polls on the other
  engines. The one-time-prekey claim no longer relies on FOR UPDATE SKIP LOCKED; it is a guarded update proven by its affected-row count.
  (Cross-schema reads of core.users/core.settings remain PostgreSQL/MySQL
  only, as they touch another module's namespace.)

Fixed

• Files kept on the server's local storage are found again on Windows and under symlinked storage
  roots (shared storage layer updated to kubuno-storage 0.1.2).

• Database migrations keep the same checksum on every OS. The repository now
  pins line endings to LF (.gitattributes), so a checkout on Windows no longer
  turns SQL migrations, scripts, manifests or sources into CRLF. A database
  migrated by a Linux build is therefore no longer refused by a Windows or macOS
  build of the same version because its migration checksums differ.

• Media downloads no longer fail for recipients. The access check read a
  SELECT 1 probe at a width PostgreSQL rejected, so every non-uploader saw a
  database error and a permanent "media unavailable"; the check is now decoded
  portably and passes for anyone in the conversation.

Security

• The real-time connection no longer puts your access token in its URL: it presents a one-minute
  signed ticket, fresh at each reconnection. Leaving a meeting page while a provisional conversation is
  open now authenticates its clean-up with your session instead of a cookie. Requires a Kubuno core that issues signed tickets (POST /api/v1/auth/tickets) and @kubuno/sdk with the signed-URL helpers.

• Security fixes from the shared database layer (kubuno-db 0.9.0). The
  database password can no longer appear in a log through the debug output of
  the database settings.

• Database driver updated past an unfixable advisory. The previous line
  pulled in an RSA implementation vulnerable to a timing side-channel
  (RUSTSEC-2023-0071) for which no fix will ever exist. The new line does not
  depend on it at all, and it refuses any SQL string built at run time unless it
  has been audited — the queries here were checked and marked.

• Input validation library updated. The version in use carried
  RUSTSEC-2024-0421 through its domain-name parser, which accepted Punycode
  labels that decode to plain ASCII — a mismatch an attacker can use to make two
  different names look like one.