v0.11.0

New Features

• 9829b9f - homeserver: add support to path-addressed storage reads (PR #536 by @MCarlomagno)
  • addresses issue #524 opened by @MCarlomagno
• 08ac08d - homeserver: add path addressed storage writes (PR #543 by @MCarlomagno)
  • addresses issue #525 opened by @MCarlomagno
• 23e5ed4 - feature flags endpoint (PR #550 by @MCarlomagno)
  • addresses issue #549 opened by @MCarlomagno

Bug Fixes

• 7cbe7a9 - A few more pubky-core references (PR #551 by @86667)

Refactors

• 07beea0 - homeserver: All user-based operations to flow through UserService (PR #545 by @86667)
• 0f7f7b9 - fix state unwraps and wraps (PR #553 by @MCarlomagno)
• 6b5cbd6 - homeserver: Services own their construction from AppContext (PR #554 by @86667)

Documentation Changes

• 201d29d - homeserver: add migration guide for /priv events stream (PR #539 by @MCarlomagno)
• a4fdd41 - homeserver: Point to sdk and dev guide on pubky.org (PR #541 by @86667)
• 9a68e95 - homeserver: Update logo for repo rename (PR #555 by @86667)

Chores

• aa39c09 - Rename all pubky-core links (PR #526 by @86667)
• 1106eb0 - increase docker pipeline timeout (PR #540 by @SpontaneousOverthrow)
• 5035cd8 - deps: upgrade pkarr to v8 and relay to v2 (PR #542 by @andrei-21)
• 5ab358d - ci: Sync context7 only on tag creation (PR #547 by @86667)
• 6a14bdb - v0.11.0 (PR #562 by @86667)

v0.10.0

This is a new release with quite a few breaking changes. Please checkout the v0.10.0 migration guide.

ALPHA private data /priv/ The homeserver now provides a way to store private data that only the user has access to. This feature is under active development and should NOT be used in any production environment. Expect private data APIs to change or disappear as we actively iterate over different solutions.

Change Summary

BREAKING CHANGES

• hs/sdk/common: Grant-based auth (PR #373 by @SeverinAlexB)
• sdk: deeplink refactor (PR #392 by @SeverinAlexB)
• js-sdk: Grant auth for the JS SDK (PR #405 by @SeverinAlexB)
• sdk: Rename startAuthFlow to startCookieAuthFlow (PR #460 by @SeverinAlexB)
• homeserver|sdk: Signup deeplink authentication (PR #482 by @MCarlomagno)
• pkarr: Adapt to the new client API, replacing PkarrError::Query with PkarrError::Resolve (PR #502 by @andrei-21)
• common: Strict capabilities and shared storage paths (PR #514 by @SeverinAlexB)
• sdk: Surface errors from get_homeserver_of (PR #477 by @MCarlomagno)

New Features

• sdk: Restore grant sessions (PR #400 by @SeverinAlexB)
• Add Docker build pipeline (PR #416 by @SpontaneousOverthrow)
• Add list signup tokens endpoint (PR #420 by @MCarlomagno)
• Allow writes to /priv (PR #446 by @MCarlomagno)
• homeserver: Authenticated reads and listing authorization for /priv (PR #448 by @MCarlomagno)
• Add OpenAPI specification (PR #406 by @86667)
• homeserver: Filter private events from the events endpoint (PR #454 by @MCarlomagno)
• homeserver: Add private event-stream reads (PR #458 by @MCarlomagno)
• Add init CLI command for generating configuration and secrets (PR #467 by @86667)
• sdk: WebCrypto delegated PoP key and browser session store (PR #411 by @SeverinAlexB)
• testnet: Add persistent data-directory mode to StaticTestnet (PR #472 by @86667)
• Expose pool_max_idle_per_host on PubkyHttpClientBuilder (PR #480 by @tipogi)
• homeserver: Add events admin endpoint (PR #463 by @MCarlomagno)
• sdk: Subscribe to private events (PR #470 by @MCarlomagno)
• homeserver: Skip PKARR republishing for migrated users (PR #515 by @andrei-21)
• Set up TypeDoc (PR #523 by @86667)
• sdk: Add support for callback parameters (PR #533 by @MCarlomagno)

Bug Fixes

• release: Allow hotfix releases (PR #453 by @86667)
• Handle path collisions (PR #424 by @MCarlomagno)
• homeserver: Reject directory paths on writes (PR #445 by @andrei-21)
• Repair Docker build pipeline (PR #466 by @SpontaneousOverthrow)
• Repair build-artifacts script (PR #485 by @SpontaneousOverthrow)
• Correct cache policy for private events (PR #494 by @MCarlomagno)
• homeserver: Split OpenAPI specification into client and admin APIs (PR #507 by @MCarlomagno)
• homeserver: Republish the latest known PKARR packet (PR #509 by @andrei-21)
• homeserver: Close private event streams on session revocation (PR #501 by @MCarlomagno)
• homeserver: Consolidate stateful OpenDAL layers (PR #510 by @MCarlomagno)

Refactors

• sdk: Extract grant management into GrantManager (PR #412 by @SeverinAlexB)
• homeserver: Simplify republisher internals (PR #481 by @andrei-21)
• Resolve workspace Clippy warnings (PR #489 by @andrei-21)
• homeserver: Simplify concurrent PKARR republishing (PR #488 by @andrei-21)
• homeserver: Move PKARR retries into a dedicated republisher (PR #495 by @andrei-21)
• homeserver: Restructure PKARR republishing (PR #498 by @andrei-21)
• homeserver: Move auth revocation into AuthState (PR #518 by @86667)

Tests

• homeserver: Add E2E coverage for private data (PR #474 by @MCarlomagno)
• homeserver: Prevent PKARR clients from using default relays (PR #517 by @andrei-21)

Build System

• homeserver: Set the default run binary to pubky-homeserver (PR #452 by @andrei-21)
• Add Context7 refresh workflow (PR #462 by @gcomte)
• Cache npm dependencies (PR #499 by @ok300)
• Change Dependabot’s Rust interval to weekly (PR #511 by @ok300)
• Use Rust cache in the build-artifacts workflow (PR #512 by @ok300)
• deps-dev: Update @xmldom/xmldom (PR #516 by @dependabot[bot])
• Use dtolnay/rust-toolchain for faster Rust setup (PR #513 by @ok300)

Documentation Changes

• Fix Rustdoc links (PR #447 by @andrei-21)
• Add DeepWiki badge (PR #450 by @ok300)
• testnet: Gate Docker Postgres doctest by feature (PR #461 by @andrei-21)
• homeserver: Improve developer documentation and READMEs (PR #431 by @SeverinAlexB)
• examples: Add grant-auth examples and reorganize existing examples (PR #487 by @SeverinAlexB)
• homeserver: Add deployment guide (PR #503 by @86667)
• Remove the legacy mdBook site (PR #508 by @andrei-21)
• testnet: Prioritize persisted static-testnet setup instructions (PR #521 by @86667)
• hs/sdk: Add private-storage documentation (PR #505 by @MCarlomagno)
• sdk: Make in-code documentation more user-friendly (PR #537 by @86667)

Chores

• Update the Cargo dependency group (PR #396 by @dependabot[bot])
• deps: Remove the nested WASM lockfile (PR #415 by @andrei-21)
• deps: Separate library dependency ranges (PR #414 by @andrei-21)
• cargo: Centralize workspace manifest metadata (PR #417 by @andrei-21)
• deps: Remove unused crate dependencies (PR #455 by @andrei-21)
• Make the npm workflow respect prerelease tags (PR #465 by @SeverinAlexB)
• Improve cookie AuthFlow documentation (PR #367 by @tipogi)
• deps: Update serde_valid to 2.0.3 (PR #490 by @andrei-21)
• Bind the testnet HTTP relay to all addresses (PR #497 by @ok300)
• Update the Cargo dependency group (PR #491 by @dependabot[bot])
• sdk: Add the v0.10 migration guide (PR #493 by @SeverinAlexB)

Full Changelog: v0.9.3...chore/v0.10.0

v0.10.0-alpha.0

BREAKING CHANGES

• Grant-based auth (PR #373 by @SeverinAlexB)
• deeplink refactor (PR #392 by @SeverinAlexB)
• Grant auth for the JS SDK (PR #405 by @SeverinAlexB)
• Renamed startAuthFlow to startCookieAuthFlow + Cookie migration guide (PR #460 by @SeverinAlexB)

New Features

• hs/sdk/common: Grant-based auth (PR #373 by @SeverinAlexB)
• sdk: restore grant session (PR #400 by @SeverinAlexB)
• sdk: deeplink refactor (PR #392 by @SeverinAlexB)
• js-sdk: Grant auth for the JS SDK (PR #405 by @SeverinAlexB)
• Add docker build pipeline (PR #416 by @SpontaneousOverthrow)
• add list signup tokens endpoint
• allow writes to /priv folder
• homeserver: authenticated reads + listing authz for /priv (PR #448 by @MCarlomagno)
  • addresses issue #433 opened by @MCarlomagno
  • addresses issue #434 opened by @MCarlomagno
  • addresses issue #437 opened by @MCarlomagno
• OpenAPI yaml (PR #406 by @86667)
  • addresses issue #369 opened by @86667
• filter private events from events endpoint (PR #454 by @MCarlomagno)
  • addresses issue #436 opened by @MCarlomagno
• sdk: Renamed startAuthFlow to startCookieAuthFlow + Cookie migration guide (PR #460 by @SeverinAlexB)

Bug Fixes

• changes from review
• use NonZerou16 for limit
• sdk: resolve transport with the full _pubky. qname so ICANN fallback applies (PR #423 by @SHAcollision)
  • fixes issue #422 opened by @SHAcollision
• release: Allow hot-fixing (PR #453 by @86667)
• sdk: disable TLS revocation hard-fail on ICANN HTTP client (false Revoked errors on Android) (PR #456 by @coreyphillips)
• path collisions (PR #424 by @MCarlomagno)
  • fixes issue #419 opened by @andrei-21
• homeserver: reject directory paths on writes (PR #445 by @andrei-21)

Refactors

• sdk: Extract grant management from session to its own GrantManager (PR #412 by @SeverinAlexB)

Tests

• better coverage for cursor and pagination

Build System

• homeserver: set default run binary to pubky-homeserver (PR #452 by @andrei-21)
• add Context7 refresh workflow

Documentation Changes

• fix rustdoc links (PR #447 by @andrei-21)
• add DeepWiki badge to README (PR #450 by @ok300)
• testnet: gate Docker Postgres doctest by feature (PR #461 by @andrei-21)

Chores

• deps: update pkarr to 6.0.1 (PR #404 by @andrei-21)
• deps: remove nested wasm lockfile (PR #415 by @andrei-21)
• deps: separate library dependency ranges (PR #414 by @andrei-21)
• cargo: centralize workspace manifest metadata (PR #417 by @andrei-21)
• deps: remove unused crate dependencies (PR #455 by @andrei-21)

v0.9.3

Bug Fixes

• 6c0f533 - sdk: disable TLS revocation hard-fail on ICANN HTTP client (false Revoked errors on Android) (PR #456 by @coreyphillips)

Chores

• ddbf15c - v0.9.3 (commit by @86667)

v0.9.2

Bug Fixes

• 76b3ee7 - sdk: resolve transport with the full _pubky. qname so ICANN fallback applies (PR #423 by @SHAcollision)
  • fixes issue #422 opened by @SHAcollision
• 7e1a82a - Release pipeline to not check that tag commit is on main branch. This blocks hot fix tagging. (commit by @86667)

Chores

• be84fe8 - v0.9.2 (commit by @86667)

v0.9.1

Chores

• chore(deps): update pkarr to 6.0.1 by @andrei-21 in #404

Full Changelog: v0.9.0...v0.9.1

v0.9.0

BREAKING CHANGES

• due to 59797cd - v0.9.0 (PR #395 by @86667):

  The embedded-postgres feature was renamed to
  docker-postgres and now requires Docker on the host. Deprecated
  aliases are provided for the old feature flag and API names.
  (introduced in f9e75f0)

Bug Fixes

• f9e75f0 - Improve embedded-postgres shared instance handling to prevent hanging postgres bug (PR #368 by @86667)

Build System

• b605fcc - Use requarks/changelog-action to generate categorised changelog for release notes from conventional commit messages. Ensure PR titles follow correct conventional commit pattern. (PR #393 by @86667)

Chores

• 5a421c9 - Fix release pipeline - Pin pubky_test_utils (PR #390 by @SeverinAlexB)
• 59797cd - v0.9.0 (PR #395 by @86667)

v0.8.0

What's Changed

Important: LMDB support has been dropped. Use Postgres from now on. If you have to migrate, use v0.7.0 first before you upgrade to v0.8.0.

• BREAKING CHANGE feat!(hs): Remove LMDB by @SeverinAlexB in #357
• feat(homeserver): Horizontally scalable SSE Events by @86667 in #303
• feat(sdk): Add resumeAuthFlow to recover auth flows after page refresh by @tipogi in #355
• feat: native SDK fallback to ICANN when PubkyTLS direct endpoint is unreachable by @SHAcollision in #352
• feat(homeserver): Per user rate limits by @86667 in #363
• feat: signup_count metric by @86667 in #379
• feat(examples): Improve write abilities by @86667 in #382
• feat(homeserver): UserQuota option allowed_write_paths by @86667 in #381
• fix(homeserver): Serialise event inserts to prevent poll loop from skipping events by @86667 in #358
• fix(testnet): testnet port binding by @SeverinAlexB in #362
• fix(homeserver): apply burst to request rate limits by @andrei-21 in #383
• fix(auth): Check actual version byte by @andrei-21 in #370
• fix(sdk): lock wasm-pack install so that it uses the exact dependency versions from wasm-pack's lockfile by @86667 in #371
• build: symlink LICENSE for wasm-pack packaging by @andrei-21 in #372
• test: add unit test to verify actual behavior on quota excess by @andrei-21 in #374
• deps: bump the cargo-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #359
• refactor(common)!: normalize capabilities construction by @andrei-21 in #375
• refactor(homeserver): Move pkarr republisher and add docs by @86667 in #351
• ci(wasm): install wasm-pack from prebuilt binary by @andrei-21 in #385
• ci: fix worflow yaml by @andrei-21 in #386
• refactor(homeserver): use nonzero burst quota values by @andrei-21 in #387
• chore: pkarr v6 by @dzdidi and @ok300 in #380

New Contributors

• @andrei-21 made their first contribution in #370

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Changes

New features

This release introduces the Event Streaming API (#293), bringing real-time SSE-based event subscriptions to the SDK. Alongside that, the homeserver picks up a new GET /signup_tokens/{token} endpoint (#319) for checking whether a signup token is valid or already used

On the developer experience side, pubky-testnet now supports an optional embedded Postgres mode (#308), so you can spin up fully self-contained test environments without needing an external database.

Auth flows have been reworked to use a new /inbox relay endpoint (#316) (replacing the previous /link channel), and the token validity window has been extended from 45 seconds to 3 minutes (#318).

Under the hood several major dependencies were bumped: pkarr (3.x → 5.x), reqwest (0.12 → 0.13), and ed25519-dalek (2.x → 3.0-pre). See the breaking changes section below for migration details.

Breaking changes

pubky-common

• pkarr 3.10 → 5.0 and ed25519-dalek 2.x → 3.0.0-pre.1
• EventCursor moved here from the homeserver crate, with inner type changed from i64 → u64
• Auth timestamp window widened from 45 seconds to 3 minutes
• New pub mod events added (additive)

pubky-sdk (pubky)

• pub use pkarr::DEFAULT_RELAYS removed — must now use pubky::pkarr::DEFAULT_RELAYS
• DEFAULT_HTTP_RELAY deprecated (/link → /inbox) — replaced by DEFAULT_HTTP_RELAY_INBOX
• HttpRelayLinkChannel / EncryptedHttpRelayLinkChannel deprecated. Replaced by *InboxChannel variants
• Auth flows default to /inbox endpoint
• reqwest 0.12 → 0.13
• New event streaming API added: Event, EventCursor, EventStreamBuilder, EventType (additive)

pubky-homeserver

• axum-server 0.7 → 0.8
• New endpoint GET /signup_tokens/{token} for querying signup token status (additive)

pubky-testnet

• HTTP relay now enables CORS (cors_allow_all(true)) by default
• DHT builder API changed (chaining style, from pkarr/mainline upgrade)
• New Testnet::new_unseeded() method (additive)
• New embedded-postgres feature flag with EphemeralTestnetBuilder::with_embedded_postgres() (additive)

pubky-wasm (JS bindings)

• wasm-bindgen 0.2.100 → 0.2.108 and wasm-streams 0.4 → 0.5
• Auth relay default changed from /link to /inbox (inherited from SDK)
• New event streaming bindings added: EventStreamBuilder, Event, PubkyResource (additive)

What's Changed

• feat: events-stream sdk by @86667 in #293
• chore: Re-export pkarr by @ok300 in #297
• chore: Group dependabot PRs by @ok300 in #305
• fix: Fix crate naming issue preventing dependabot runs by @ok300 in #304
• feat: Add feature for embedded Postgres by @86667 in #308
• chore: Bump pkarr, mainline, pkarr-relay by @ok300 in #315
• feat: increased auth token life time from 45s to 3min + clean code refactor by @SeverinAlexB in #318
• feat: GET /signup_tokens/{token} resource by @86667 in #319
• fix: Macos mainline tests binding to 127.0.0.1 by @SeverinAlexB in #320
• fix: pubky-testnet readme local cargo test by @SeverinAlexB in #321
• feat: set 10 request per ip per minute default rate limit for /signup_tokens route by @86667 in #323
• chore: pubky-testnet v0.7.0 by @86667 in #326
• feat: Examples use embedded postgres by default by @86667 in #335
• docs: Improve pubky-testnet usage docs by @86667 in #341
• fix: UserQuotaLayer does not need to validate a pubky exists in the path by @86667 in #342
• feat: Replace Http-Relay with new /inbox endpoint by @SeverinAlexB in #316
• feat: v0.7.0 release candidate changes by @86667 in #310
• chore: v0.7.0 by @86667 in #347
• feat: Publish crates and npm package via Trusted Publisher auth by @86667 in #348

Full Changelog: v0.6.0...v0.7.0

v0.6.0

First Stable Release: Pubky Homeserver and Pubky SDK

This release marks the first stable versions of the Pubky Homeserver and Pubky SDK.

There are extensive breaking changes compared to versions 0.5.4 and earlier. These changes are not documented in this release because the crates were previously treated as unstable. Any application built against 0.5.4 or earlier should be considered incompatible and must be re-implemented.

From this release onward, all breaking changes will be explicitly documented.

Pubky SDK

• NPM JS: https://www.npmjs.com/package/@synonymdev/pubky/v/0.6.0
• Crates.io: https://crates.io/crates/pubky/0.6.0
• Docs.rs: http://docs.rs/crate/pubky/0.6.0

Pubky Homeserver

Install as

cargo install pubky-homeserver 

Or build the docker image using the Dockerfile at the root directory. A docker repository image will be available soon.

Pubky Testnet

Install as

cargo install pubky-testnet 

Or build the docker image using the Dockerfile at the root directory. A docker repository image will be available soon.

What's Changed

• Update comment in config.sample.toml by @ok300 in #208
• feat(client): add convenience constructors by @SHAcollision in #210
• Re-use read-/write-keypair from updated pkarr by @ok300 in #196
• fix(bindings): wasm name on browser import by @SHAcollision in #209
• deps: bump reqwest from 0.12.15 to 0.12.22 by @dependabot[bot] in #202
• deps: bump log from 0.4.25 to 0.4.27 by @dependabot[bot] in #206
• deps: bump rand from 0.9.1 to 0.9.2 by @dependabot[bot] in #205
• deps: bump getrandom from 0.3.1 to 0.3.3 by @dependabot[bot] in #204
• deps: bump clap from 4.5.40 to 4.5.42 by @dependabot[bot] in #203
• deps: bump serde-wasm-bindgen from 0.4.5 to 0.6.5 by @dependabot[bot] in #201
• chore(tests): fix flaky homeserver test by @SHAcollision in #212
• feat(client): structured error handling for native and WASM bindings by @SHAcollision in #211
• chore(client): small fixes. by @SHAcollision in #217
• Fix clippy warnings by @ok300 in #222
• feat: ephemeral testnet with random keypair by @tipogi in #221
• deps: bump openssl from 0.10.71 to 0.10.73 by @dependabot[bot] in #223
• deps: bump thiserror from 2.0.12 to 2.0.16 by @dependabot[bot] in #225
• deps: bump tracing-subscriber from 0.3.19 to 0.3.20 by @dependabot[bot] in #226
• deps: bump clap from 4.5.42 to 4.5.46 by @dependabot[bot] in #228
• deps: bump anyhow from 1.0.98 to 1.0.99 by @dependabot[bot] in #231
• deps: bump futures-lite from 2.6.0 to 2.6.1 by @dependabot[bot] in #229
• deps: bump reqwest from 0.12.22 to 0.12.23 by @dependabot[bot] in #230
• deps: bump tokio from 1.47.0 to 1.47.1 by @dependabot[bot] in #227
• chore: bump rust version in Dockerfile by @catch-21 in #233
• Fix Dockerfile cross-compilation by @catch-21 in #239
• docs general readability by @86667 in #238
• deps: bump ring from 0.17.9 to 0.17.14 by @dependabot[bot] in #241
• deps: bump clap from 4.5.46 to 4.5.48 by @dependabot[bot] in #243
• deps: bump wasm-bindgen-futures from 0.4.50 to 0.4.54 by @dependabot[bot] in #244
• deps: bump ctrlc from 3.4.7 to 3.5.0 by @dependabot[bot] in #245
• deps: bump pkarr-relay from 0.11.0 to 0.11.1 by @dependabot[bot] in #246
• deps: bump log from 0.4.27 to 0.4.28 by @dependabot[bot] in #247
• deps: bump axum from 0.8.4 to 0.8.6 by @dependabot[bot] in #249
• deps: bump thiserror from 2.0.16 to 2.0.17 by @dependabot[bot] in #251
• refactor(client): revamp pubky sdk by @SHAcollision in #219
• feat(hs): Postgres DB support replacing LMDB (#214) by @SeverinAlexB in #255
• Fix: incompatibility with pubky-client 0.5.4 by @SHAcollision in #256
• feat: remove cross-compile toolchain for aarch64 by @SpontaneousOverthrow in #258
• fix: feed cursor empty when no file by @SeverinAlexB in #264
• fix(examples): update example auth widget to latest sdk changes by @SHAcollision in #267
• homeserver: refactoring by @dzdidi in #266
• fix(homeserver): remove cookies on signout. by @SHAcollision in #269
• fix(hs): log errors for the events endpoint by @SeverinAlexB in #272
• Add events-stream endpoint by @86667 in #254
• chore: set mdbook version explicitly by @86667 in #273
• fix: Change OpenDal layer order to ensure Event is created after file is written by @86667 in #275
• /metrics endpoint by @86667 in #274
• feat: Make admin server optional by @86667 in #277
• fix(hs): Wrong event order in event endpoint by @SeverinAlexB in #279
• feat(hs): postgres tls support by @SeverinAlexB in #281
• docs(sdk): add browser environment notes by @SHAcollision in #280
• chore: add openssl to cross toml by @SpontaneousOverthrow in #282
• Feat: move from openssl to rustls by @SpontaneousOverthrow in #283
• feat(sdk): added auth signup flow by @SeverinAlexB in #268
• Fix default test DB URL by @ok300 in #287
• Fix README code block by @ok300 in #286
• feat(wasm): add methods for browser session persistence by @SHAcollision in #292
• Testnet: Fix chosen timeout for client builder by @ok300 in #290
• fix(sdk): null rust pointer error on authflow by @SHAcollision in #284
• Bump Postgres from 17 to 18 by @ok300 in #289
• feat(homeserver): add aditional metadata to admin info endpoint by @SHAcollision in #294
• Explicitly specify loopback IP when exposing container ports by @ok300 in #288
• Fix: apply C collation to entry ordering and cursors for deterministic ordering by @SHAcollision in #295
• Builder pattern for EphemeralTestnet allowing for custom configurations by @86667 in #278
• feat: add pubky keys type by @SHAcollision in #276
• chore: v0.6.0 by @SHAcollision in #298

New Contributors

• @tipogi made their first contribution in #221
• @SpontaneousOverthrow made their first contribution in #258
• @dzdidi made their first contribution in #266

Full Changelog: v0.5.4...v0.6.0