|
| 1 | +# v0.5.0 |
| 2 | + |
| 3 | +`+196,739,-43,235` |
| 4 | + |
| 5 | +## Highlights |
| 6 | + |
| 7 | +- **Security Hardening**: Comprehensive audit fixes including Schnorr signature verification, NIP-46 relay message forgery protection, PIN encryption improvements, and NIP-26 delegation trust removal |
| 8 | +- **Performance**: Batched Schnorr verification in WASM, lazy-loaded routes, pre-compiled translations, worker-relay batch optimizations, and eliminated double verification per event |
| 9 | +- **Stability**: Fixed multiple React render loops, hook dependency arrays, stale closures, and lifecycle/memory leaks across the app |
| 10 | + |
| 11 | +## Added |
| 12 | + |
| 13 | +- Comprehensive request processing path tests |
| 14 | +- Priority profile loader with batch loading, priority tiers, and chunking |
| 15 | +- DVM kind:7000 payment-required invoice display (#618) |
| 16 | +- Default relays fallback when pool is empty |
| 17 | +- Zapstore manifest migration (nap.yaml → zapstore.yaml) |
| 18 | + |
| 19 | +## Changed |
| 20 | + |
| 21 | +- Batch event verification in system-wasm for improved throughput |
| 22 | +- Profile loader rewritten with priority tiers, chunking, and O(1) notifications |
| 23 | +- NoteCollection clear() emission and ghost-timer fixes |
| 24 | +- Trace-timeline terminal state runtime tracking improvements |
| 25 | +- Replaced uuid with crypto.randomUUID() |
| 26 | +- All useSyncExternalStore calls now include getServerSnapshot for SSR compatibility (#615) |
| 27 | +- Switched quote style to double quotes (Biome formatting) |
| 28 | + |
| 29 | +## Fixed |
| 30 | + |
| 31 | +- **Security**: Real Schnorr signature verification in isValid (#607) |
| 32 | +- **Security**: PIN encryption security issues (#606) |
| 33 | +- **Security**: NIP-46 hardened against forged relay messages and secret leakage (#609) |
| 34 | +- **Security**: Removed unverified NIP-26 delegation trust in getRootPubKey (#608) |
| 35 | +- **Security**: Wrapped all dangerous JSON.parse calls in try/catch (#610) |
| 36 | +- **Security**: Added timeouts to all hanging promises (#611) |
| 37 | +- **Security**: Added lifecycle management and fixed timer/memory leaks (#612) |
| 38 | +- Render loop in NoteReaction from unstable inline ref callback |
| 39 | +- Render loop on profile page pinned notes |
| 40 | +- Notifications render loop from unstable login object dependency |
| 41 | +- NoteContext render loop from unstable ev/link/translate deps |
| 42 | +- React hook dependency arrays and stale closures across components |
| 43 | +- NoteStore lazy snapshot and OutboxModel input mutation (#614) |
| 44 | +- Queue traces for connecting relays with query system edge-case tests |
| 45 | +- Batch verify in WASM with error logging |
| 46 | +- Build-tools version updated to 35.0.0 |
| 47 | +- APK artifact matching patterns |
| 48 | + |
| 49 | +## PRs |
| 50 | + |
| 51 | +* Fix #617: Display DVM kind:7000 payment-required invoices to users (#618) |
| 52 | +* Add getServerSnapshot to all useSyncExternalStore calls for SSR compatibility (#615) |
| 53 | +* Lazy snapshot in NoteStore, type safety improvements, fix OutboxModel input mutation (#614) |
| 54 | +* Replace uuid with crypto.randomUUID(), remove uuid dependency (#613) |
| 55 | +* Add lifecycle management and fix timer/memory leaks (#612) |
| 56 | +* Add timeouts to all hanging promises (#611) |
| 57 | +* Wrap all dangerous JSON.parse calls in try/catch (#610) |
| 58 | +* Harden NIP-46 against forged relay messages and secret leakage (#609) |
| 59 | +* Remove unverified NIP-26 delegation trust in getRootPubKey (#608) |
| 60 | +* Add real Schnorr signature verification to isValid (#607) |
| 61 | +* Fix PIN encryption security issues (#606) |
| 62 | + |
| 63 | +**Full Changelog**: https://github.com/v0l/snort/compare/v0.4.0...v0.5.0 |
| 64 | + |
| 65 | +--- |
| 66 | + |
1 | 67 | # v0.4.0 |
2 | 68 |
|
3 | 69 | `+21,991,-31,914` |
|
0 commit comments