v4.0.98

Downloads

Most People Will Want

• Nostr VPN for macOS (Apple Silicon): nostr-vpn-v4.0.98-macos-arm64.dmg
• Nostr VPN for Debian/Ubuntu (.deb): nostr-vpn-v4.0.98-linux-x64.deb
• Nostr VPN for Windows: nostr-vpn-v4.0.98-windows-x64-setup.exe
• Nostr VPN for Android: nostr-vpn-v4.0.98-android-arm64.apk

StartOS Servers

Server One and Server Pure use x86_64; use aarch64 only for an ARM64 StartOS host.

• Nostr VPN for StartOS (x86_64): nostr-vpn-v4.0.98-startos-x86_64.s9pk
• Nostr VPN for StartOS (aarch64): nostr-vpn-v4.0.98-startos-aarch64.s9pk

Command Line

• macOS Apple Silicon CLI: nvpn-aarch64-apple-darwin.tar.gz
• Linux x64 CLI: nvpn-x86_64-unknown-linux-musl.tar.gz
• Linux ARM64 CLI: nvpn-aarch64-unknown-linux-musl.tar.gz
• Windows x64 CLI: nvpn-v4.0.98-x86_64-pc-windows-msvc.zip

Other Files

• Android arm64 AAB: nostr-vpn-v4.0.98-android-arm64.aab
• macOS Apple Silicon updater archive: nostr-vpn-v4.0.98-macos-arm64.app.tar.gz
• nvpn-arm-unknown-linux-musleabihf.tar.gz: nvpn-arm-unknown-linux-musleabihf.tar.gz
• nvpn-v4.0.98-arm-unknown-linux-musleabihf.tar.gz: nvpn-v4.0.98-arm-unknown-linux-musleabihf.tar.gz

Changes

Added

• Added a production topology regression that delivers an ordinary signed
  join roster through explicit WSS seeds, a generic FIPS router, and a
  zero-preconfigured physical guest.
• Made LAN discovery an explicit persisted network setting while retaining
  repeatable daemon flags for Ethernet interface and discovery scope.

Changed

• Integrated the existing StartOS package into the release gate and both
  release pipelines. Tagged releases now publish signed, manifest-validated
  x86_64 and aarch64 .s9pk artifacts alongside the native apps.
• Use standard port-7368 Nostr pubsub as the sole FIPS peer/service
  announcement path; public Nostr relays carry bounded signed events, never
  FIPS packet records or WebRTC signaling envelopes.
• Updated FIPS Core and Endpoint to 0.4.14 and nostr-pubsub-fips to 0.4.3
  for routed WSS first contact, verified-event reuse, bounded observed-ID
  caches, provider abuse cooldowns, reverse-session transit, and idle-work
  fixes.

Fixed

• Admit authenticated physical adjacencies while an ordinary device approval
  is pending and accept authenticated in-FIPS WebRTC offers without a public
  relay fallback.
• Bound public-relay and FIPS retained replay, preserve already verified
  control events across policy checks, and expose pubsub wire, TCP, and
  provider-cooldown counters.
• Stop repeated idle control-plane scans, disabled-host cleanup, duplicate
  Linux address handling, and route-refresh feedback loops.
• Fully stop LAN mDNS between aligned discovery windows, preserving periodic
  local peer discovery while removing the persistent Android VPN wakeup loop.

Release Build

• Built from commit c52cbc47f01fdc78814db8044d30ebee4258aa5d for release v4.0.98.
• Built signed and notarized Apple Silicon macOS DMG and updater archive.
• Built Linux x64 desktop Debian package.
• Built Windows x64 installer.
• Built signed Android arm64 APK/AAB.
• Built signed StartOS packages for x86_64 and aarch64.