v1.26.0

New Features

• prohibited languages spam detector #427 @umputun
• detect spam in rich messages (telegram articles) #428 @umputun
• add mention-only meta check #424 @umputun
• short-message flood detection for unapproved users #400 @umputun
• warn auto-ban for repeated admin /warn commands #398 @umputun
• reaction spam detection #395 @olitez
• database configuration support #294 @umputun

Improvements

• ascii fast path for multi-language script detection #425 @paskal
• reuse GPT tokenizer encoder across requests #417 @paskal
• reuse a single idle timer in the update loop #419 @paskal
• run extra-message deletions off the update loop #418 @paskal
• update telegram-bot-api to bot api 10.2 0ba7aa1
• update golang.org/x/net to v0.56.0 to fix reachable vulnerabilities #408 @paskal
• restore configurable basic-auth user #396 @paskal
• remove dead gid-column query registration from samples #416 @paskal
• cover procUserReply dispatch at the listener level #422 @paskal
• correct stale defaults in README, CLAUDE.md and site docs #413 @paskal
• pin playwright-go CLI version in e2e-ui workflow #406 @paskal
• use explicit ["**"] branches/tags in build-app push trigger #423 @paskal
• use explicit ["**"] branches/tags in build-updater push trigger 211213e
• only publish updater images from master and tags 10391c0
• fix invalid paths_ignored key in build-app workflow #412 @paskal

Bug Fixes

• scope locator primary keys by gid to prevent cross-group clobbering #407 @paskal
• data race on approvedUsers map in Detector.Check #405 @paskal
• Last(n) returns the most recent requests instead of the oldest #410 @paskal
• guard nil From in listener update loop #411 @paskal
• remove duplicate detected_spam index with colliding name #415 @paskal
• include reports and warnings tables in sqlite-to-postgres converter #414 @paskal
• preserve InstanceID across loadConfigFromDB swap #397 @paskal
• add change-ban/info buttons to reaction-spammer ban notifications #403 @umputun
• clean up /report handling and reported-user display #402 @umputun
• fix approved-user reaction spam exemption #401 @olitez
• pin htmx version and add SRI to admin UI CDN assets #421 @paskal
• drop world-writable permissions on docker preset dir #420 @paskal
• move to playwright-go v0.6100.0 to unbreak e2e-ui driver download #426 @paskal
• set simplechat session cookie attributes 885f37b