What shipped on OpenVibe.Community

Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.

2026-09-24

d692a51VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchangedOpenVibers · 05:35 UTC
9074b54VIP convergence (W10): Community subscribes to vip.membership.changed on its Events endpoint; a delivery from VIP drops the member's cached members-only answers for that creator at once (the VIP gate's cache handleEvent, once per event…OpenVibers · 05:35 UTC
0a540eaStaff powers from the contracts staff map (D05, ADR-022): a browser viewer is paste staff with staff.moderation.pastes and discussion staff with staff.moderation.discussions, from the role or the staff_caps Network issues (issued claims…OpenVibers · 05:35 UTC
474c101Pulse is fed from OpenVibe.Events: POST /internal/events (signature v2 only, loopback only, exactly once via the openvibe-sdk inbox) turns public live.stream.started, blog.post.published, wiki.page.published and news.story.published into…OpenVibers · 05:35 UTC
c8a70c7Community publishes events (openvibe-contracts 0.35.0): community.paste.created|updated|deleted, community.thread.created, community.post.created and community.comment.created, each queued in the transaction of the write through the…OpenVibers · 05:35 UTC
e075d39SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 05:35 UTC
985da86Pastes browse: Show pastes, images or all (?type=), carried through paging (lang=image still means images); the home page's 'What is coming' roadmap block is replaced by what is live (spaces, threads, Pulse); /llms.txt says what Community…OpenVibers · 05:35 UTC

2026-09-23

78f2f9bopenvibe-shared v1.5.1 (Track R release manifest), openvibe-contracts v0.33.0OpenVibers · 23:16 UTC
6d534d8Paste list for feeds: GET /api/pastes takes sort=top (views, a like worth five views, newest first on a tie), since= (created at or after; ISO 8601 or 'YYYY-MM-DD HH:MM:SS' UTC, compared with datetime() so imported ISO timestamps work; an…OpenVibers · 21:25 UTC
63b90a8Comment threads on a Live channel link to its page, /@<username> (they linked to /<username>, which is not a page on Live); threads on a Live stream link to /stream/<id>OpenVibers · 21:22 UTC
57d1dd4Members-only discussion through OpenVibe.VIP: a forum space or a single thread can be for one creator's VIP membersOpenVibers · 19:38 UTC
131f5f5CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 19:33 UTC
7d7cc3dLive's VOD and clip comments become Community threads (Wave 5 exit: Live and a second product share one thread)OpenVibers · 19:10 UTC
466eabaDocs: STATUS.json and README match production (2026-09-23)OpenVibers · 18:33 UTC
922f834Unlisted and private pastes always get a secret slug: a service-named slug only applies to public pastes (Live forwards people's /api/pastes bodies as-is, so a person could pick a guessable slug)OpenVibers · 17:10 UTC
be48b73Discord relay: a mapping may only name an allow-listed webhook variable (DISCORD_WEBHOOK_*, or exactly the names in DISCORD_RELAY_WEBHOOK_VARS). Staff could point the relay at the URL in any environment variable (an internal service's base…OpenVibers · 16:44 UTC
2e6f43bUnlisted pastes get slugs nobody can guess: a new unlisted or private paste (and a fork of one) gets adj-noun- plus 16 random base62 characters (~2^95) instead of the ~1.5M adj-noun-NN space that could be walked; public pastes keep the…OpenVibers · 16:42 UTC
faa08c2Comment threads cannot be enumerated: every thread gets an unguessable access id (cth_ + 128 random bits, filled in for existing threads on boot, unique index); browsers address threads only by it and get it as the thread id from resolve…OpenVibers · 16:41 UTC
8d782c4nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…OpenVibers · 16:14 UTC
8bba2d6Forum Markdown: fix ReDoS (a heading with trailing spaces was cubic, unclosed **/__/~~ and backtick runs quadratic, fence lines and [ runs in markdownToText quadratic); a 40,000-character post could block the server for minutes on every…OpenVibers · 15:55 UTC
cac1df9Security: app tokens act only for on_behalf_of; burn-after-read cannot be read around; forks keep unlisted pastes unlistedOpenVibers · 15:51 UTC
b492398Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics and release_info; /api/ready built on openvibe-shared/ready (db required; Network key, Live or Media optional -> degraded)…OpenVibers · 02:03 UTC
2787010GET /release.json (ADR-016); openvibe-shared v1.2.0, openvibe-contracts v0.11.0OpenVibers · 01:49 UTC
458d44bopenvibe-shared is the pinned OpenVibe.Shared v1.0.0 release (vendor/ is gone); openvibe-contracts v0.7.0 knows the Wave 5 capabilitiesOpenVibers · 01:12 UTC
139aeddWave 5: typed comment threads, forum (spaces/threads/posts), Discord relay, PulseOpenVibers · 01:06 UTC

2026-09-22

d7c6e60Importer: only rows between the OpenVibe launch and the id-space fix can hold a Network id (--ambiguous-from, default 2026-08-17T21:10:29Z); earlier rows were migrated from HoboStreamer with Live idsOpenVibers · 23:32 UTC
fdacc98auth: a request that arrives while the Network key is loading waits for itOpenVibers · 23:27 UTC
786e6f8Pastes: Community becomes the authority (PASTES_AUTHORITY=community)OpenVibers · 23:27 UTC
515bc7fssr test: expect the home headline introduced in 19cc8dd ("clearer home copy"); the test still asserted the old oneOpenVibers · 21:38 UTC
199d0f1CI: npm test on Node 22 on every push to main and every PROpenVibers · 21:36 UTC

2026-09-21

de947eavendor sync: openvibe-shared navbar + ring icons now draw solid Font Awesome glyphs (no FA CSS dependency)OpenVibers · 16:58 UTC

2026-09-18

b9cb474vendor sync: shared navbar (drawer, chips, sections)OpenVibers · 14:44 UTC
eb7c9d5Paste authors without a stored picture use the network avatar addressOpenVibers · 14:33 UTC
ee2f49dvendor sync: shared user menu and panel coordinatorOpenVibers · 14:24 UTC
f4533f4Footer baked into the HTML; vendor syncOpenVibers · 14:19 UTC
0f1eee5vendor: Footer carries its own inline icons (no dependency on the page's icon font)OpenVibers · 14:04 UTC
4a99928vendor sync: navbar panels stay inside the viewportOpenVibers · 14:02 UTC
4148b93First paint never waits on the Network: inline dark canvas + cached-theme boot in the shared head tags, theme script deferred; CSP allows the Network sign-in check frameOpenVibers · 13:36 UTC
7ffa764vendor syncOpenVibers · 11:20 UTC
e4494f3vendor: Icons: hover keeps the glyph in place, every glyph optically centred from measured bounds; legal documents rewritten with site-specific clauses and a table of contentsOpenVibers · 11:16 UTC
19cc8ddIcon set and manifest; clearer home copy; vendor syncOpenVibers · 11:02 UTC
1d57dedvendor: Favicon and browser theme colour follow the user's theme and update live (this tab, other tabs, server sync)OpenVibers · 10:51 UTC
46ff0f9Shared app icon head tags; vendor syncOpenVibers · 10:49 UTC
3a047f3Legal pages; vendor syncOpenVibers · 10:34 UTC
bd94360vendor: sync openvibe-shared (icons, island, ui, seo, navbar launcher)OpenVibers · 08:07 UTC
f0d9c1aPOST /auth/fedcm swaps a FedCM assertion for a session (jwt-bearer grant, nonce pre-check); silent login skips the Network when ov_token already verifiesOpenVibers · 04:24 UTC
a788e6fUnit runs as ubuntu like the other OpenVibe services; re-sync vendored openvibe-sharedOpenVibers · 03:16 UTC
ff4a6b6Re-sync vendored openvibe-shared with the Network's current copyOpenVibers · 03:10 UTC
f3232e2Pastes: Live proxy, server-rendered pages with syntax highlighting, SEOOpenVibers · 03:09 UTC
ed5edbbDeploy: systemd unit and nginx vhost for the Node app; README rewrittenOpenVibers · 03:09 UTC