v0.10.0

This is a new release with quite a few breaking changes. Please checkout the v0.10.0 migration guide.

ALPHA private data /priv/ The homeserver now provides a way to store private data that only the user has access to. This feature is under active development and should NOT be used in any production environment. Expect private data APIs to change or disappear as we actively iterate over different solutions.

Change Summary

BREAKING CHANGES

• hs/sdk/common: Grant-based auth (PR #373 by @SeverinAlexB)
• sdk: deeplink refactor (PR #392 by @SeverinAlexB)
• js-sdk: Grant auth for the JS SDK (PR #405 by @SeverinAlexB)
• sdk: Rename startAuthFlow to startCookieAuthFlow (PR #460 by @SeverinAlexB)
• homeserver|sdk: Signup deeplink authentication (PR #482 by @MCarlomagno)
• pkarr: Adapt to the new client API, replacing PkarrError::Query with PkarrError::Resolve (PR #502 by @andrei-21)
• common: Strict capabilities and shared storage paths (PR #514 by @SeverinAlexB)
• sdk: Surface errors from get_homeserver_of (PR #477 by @MCarlomagno)

New Features

• sdk: Restore grant sessions (PR #400 by @SeverinAlexB)
• Add Docker build pipeline (PR #416 by @SpontaneousOverthrow)
• Add list signup tokens endpoint (PR #420 by @MCarlomagno)
• Allow writes to /priv (PR #446 by @MCarlomagno)
• homeserver: Authenticated reads and listing authorization for /priv (PR #448 by @MCarlomagno)
• Add OpenAPI specification (PR #406 by @86667)
• homeserver: Filter private events from the events endpoint (PR #454 by @MCarlomagno)
• homeserver: Add private event-stream reads (PR #458 by @MCarlomagno)
• Add init CLI command for generating configuration and secrets (PR #467 by @86667)
• sdk: WebCrypto delegated PoP key and browser session store (PR #411 by @SeverinAlexB)
• testnet: Add persistent data-directory mode to StaticTestnet (PR #472 by @86667)
• Expose pool_max_idle_per_host on PubkyHttpClientBuilder (PR #480 by @tipogi)
• homeserver: Add events admin endpoint (PR #463 by @MCarlomagno)
• sdk: Subscribe to private events (PR #470 by @MCarlomagno)
• homeserver: Skip PKARR republishing for migrated users (PR #515 by @andrei-21)
• Set up TypeDoc (PR #523 by @86667)
• sdk: Add support for callback parameters (PR #533 by @MCarlomagno)

Bug Fixes

• release: Allow hotfix releases (PR #453 by @86667)
• Handle path collisions (PR #424 by @MCarlomagno)
• homeserver: Reject directory paths on writes (PR #445 by @andrei-21)
• Repair Docker build pipeline (PR #466 by @SpontaneousOverthrow)
• Repair build-artifacts script (PR #485 by @SpontaneousOverthrow)
• Correct cache policy for private events (PR #494 by @MCarlomagno)
• homeserver: Split OpenAPI specification into client and admin APIs (PR #507 by @MCarlomagno)
• homeserver: Republish the latest known PKARR packet (PR #509 by @andrei-21)
• homeserver: Close private event streams on session revocation (PR #501 by @MCarlomagno)
• homeserver: Consolidate stateful OpenDAL layers (PR #510 by @MCarlomagno)

Refactors

• sdk: Extract grant management into GrantManager (PR #412 by @SeverinAlexB)
• homeserver: Simplify republisher internals (PR #481 by @andrei-21)
• Resolve workspace Clippy warnings (PR #489 by @andrei-21)
• homeserver: Simplify concurrent PKARR republishing (PR #488 by @andrei-21)
• homeserver: Move PKARR retries into a dedicated republisher (PR #495 by @andrei-21)
• homeserver: Restructure PKARR republishing (PR #498 by @andrei-21)
• homeserver: Move auth revocation into AuthState (PR #518 by @86667)

Tests

• homeserver: Add E2E coverage for private data (PR #474 by @MCarlomagno)
• homeserver: Prevent PKARR clients from using default relays (PR #517 by @andrei-21)

Build System

• homeserver: Set the default run binary to pubky-homeserver (PR #452 by @andrei-21)
• Add Context7 refresh workflow (PR #462 by @gcomte)
• Cache npm dependencies (PR #499 by @ok300)
• Change Dependabot’s Rust interval to weekly (PR #511 by @ok300)
• Use Rust cache in the build-artifacts workflow (PR #512 by @ok300)
• deps-dev: Update @xmldom/xmldom (PR #516 by @dependabot[bot])
• Use dtolnay/rust-toolchain for faster Rust setup (PR #513 by @ok300)

Documentation Changes

• Fix Rustdoc links (PR #447 by @andrei-21)
• Add DeepWiki badge (PR #450 by @ok300)
• testnet: Gate Docker Postgres doctest by feature (PR #461 by @andrei-21)
• homeserver: Improve developer documentation and READMEs (PR #431 by @SeverinAlexB)
• examples: Add grant-auth examples and reorganize existing examples (PR #487 by @SeverinAlexB)
• homeserver: Add deployment guide (PR #503 by @86667)
• Remove the legacy mdBook site (PR #508 by @andrei-21)
• testnet: Prioritize persisted static-testnet setup instructions (PR #521 by @86667)
• hs/sdk: Add private-storage documentation (PR #505 by @MCarlomagno)
• sdk: Make in-code documentation more user-friendly (PR #537 by @86667)

Chores

• Update the Cargo dependency group (PR #396 by @dependabot[bot])
• deps: Remove the nested WASM lockfile (PR #415 by @andrei-21)
• deps: Separate library dependency ranges (PR #414 by @andrei-21)
• cargo: Centralize workspace manifest metadata (PR #417 by @andrei-21)
• deps: Remove unused crate dependencies (PR #455 by @andrei-21)
• Make the npm workflow respect prerelease tags (PR #465 by @SeverinAlexB)
• Improve cookie AuthFlow documentation (PR #367 by @tipogi)
• deps: Update serde_valid to 2.0.3 (PR #490 by @andrei-21)
• Bind the testnet HTTP relay to all addresses (PR #497 by @ok300)
• Update the Cargo dependency group (PR #491 by @dependabot[bot])
• sdk: Add the v0.10 migration guide (PR #493 by @SeverinAlexB)

Full Changelog: v0.9.3...chore/v0.10.0