What shipped on OpenVibe.Community
Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.
2026-09-24
d692a51VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchanged
9074b54VIP convergence (W10): Community subscribes to vip.membership.changed on its Events endpoint; a delivery from VIP drops the member's cached members-only answers for that creator at once (the VIP gate's cache handleEvent, once per event…
0a540eaStaff powers from the contracts staff map (D05, ADR-022): a browser viewer is paste staff with staff.moderation.pastes and discussion staff with staff.moderation.discussions, from the role or the staff_caps Network issues (issued claims…
474c101Pulse is fed from OpenVibe.Events: POST /internal/events (signature v2 only, loopback only, exactly once via the openvibe-sdk inbox) turns public live.stream.started, blog.post.published, wiki.page.published and news.story.published into…
c8a70c7Community publishes events (openvibe-contracts 0.35.0): community.paste.created|updated|deleted, community.thread.created, community.post.created and community.comment.created, each queued in the transaction of the write through the…
e075d39SECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)
985da86Pastes browse: Show pastes, images or all (?type=), carried through paging (lang=image still means images); the home page's 'What is coming' roadmap block is replaced by what is live (spaces, threads, Pulse); /llms.txt says what Community…
2026-09-23
78f2f9bopenvibe-shared v1.5.1 (Track R release manifest), openvibe-contracts v0.33.0
6d534d8Paste list for feeds: GET /api/pastes takes sort=top (views, a like worth five views, newest first on a tie), since= (created at or after; ISO 8601 or 'YYYY-MM-DD HH:MM:SS' UTC, compared with datetime() so imported ISO timestamps work; an…
63b90a8Comment threads on a Live channel link to its page, /@<username> (they linked to /<username>, which is not a page on Live); threads on a Live stream link to /stream/<id>
57d1dd4Members-only discussion through OpenVibe.VIP: a forum space or a single thread can be for one creator's VIP members
131f5f5CI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)
7d7cc3dLive's VOD and clip comments become Community threads (Wave 5 exit: Live and a second product share one thread)
466eabaDocs: STATUS.json and README match production (2026-09-23)
922f834Unlisted and private pastes always get a secret slug: a service-named slug only applies to public pastes (Live forwards people's /api/pastes bodies as-is, so a person could pick a guessable slug)
be48b73Discord relay: a mapping may only name an allow-listed webhook variable (DISCORD_WEBHOOK_*, or exactly the names in DISCORD_RELAY_WEBHOOK_VARS). Staff could point the relay at the URL in any environment variable (an internal service's base…
2e6f43bUnlisted pastes get slugs nobody can guess: a new unlisted or private paste (and a fork of one) gets adj-noun- plus 16 random base62 characters (~2^95) instead of the ~1.5M adj-noun-NN space that could be walked; public pastes keep the…
faa08c2Comment threads cannot be enumerated: every thread gets an unguessable access id (cth_ + 128 random bits, filled in for existing threads on boot, unique index); browsers address threads only by it and get it as the thread id from resolve…
8d782c4nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…
8bba2d6Forum Markdown: fix ReDoS (a heading with trailing spaces was cubic, unclosed **/__/~~ and backtick runs quadratic, fence lines and [ runs in markdownToText quadratic); a 40,000-character post could block the server for minutes on every…
cac1df9Security: app tokens act only for on_behalf_of; burn-after-read cannot be read around; forks keep unlisted pastes unlisted
b492398Observability (Track O): GET /metrics (loopback only) with HTTP golden signals by route template, process metrics and release_info; /api/ready built on openvibe-shared/ready (db required; Network key, Live or Media optional -> degraded)…
2787010GET /release.json (ADR-016); openvibe-shared v1.2.0, openvibe-contracts v0.11.0
458d44bopenvibe-shared is the pinned OpenVibe.Shared v1.0.0 release (vendor/ is gone); openvibe-contracts v0.7.0 knows the Wave 5 capabilities
139aeddWave 5: typed comment threads, forum (spaces/threads/posts), Discord relay, Pulse
2026-09-22
d7c6e60Importer: only rows between the OpenVibe launch and the id-space fix can hold a Network id (--ambiguous-from, default 2026-08-17T21:10:29Z); earlier rows were migrated from HoboStreamer with Live ids
fdacc98auth: a request that arrives while the Network key is loading waits for it
786e6f8Pastes: Community becomes the authority (PASTES_AUTHORITY=community)
515bc7fssr test: expect the home headline introduced in 19cc8dd ("clearer home copy"); the test still asserted the old one
199d0f1CI: npm test on Node 22 on every push to main and every PR
2026-09-21
de947eavendor sync: openvibe-shared navbar + ring icons now draw solid Font Awesome glyphs (no FA CSS dependency)
2026-09-18
b9cb474vendor sync: shared navbar (drawer, chips, sections)
eb7c9d5Paste authors without a stored picture use the network avatar address
ee2f49dvendor sync: shared user menu and panel coordinator
f4533f4Footer baked into the HTML; vendor sync
0f1eee5vendor: Footer carries its own inline icons (no dependency on the page's icon font)
4a99928vendor sync: navbar panels stay inside the viewport
4148b93First paint never waits on the Network: inline dark canvas + cached-theme boot in the shared head tags, theme script deferred; CSP allows the Network sign-in check frame
7ffa764vendor sync
e4494f3vendor: Icons: hover keeps the glyph in place, every glyph optically centred from measured bounds; legal documents rewritten with site-specific clauses and a table of contents
19cc8ddIcon set and manifest; clearer home copy; vendor sync
1d57dedvendor: Favicon and browser theme colour follow the user's theme and update live (this tab, other tabs, server sync)
46ff0f9Shared app icon head tags; vendor sync
3a047f3Legal pages; vendor sync
bd94360vendor: sync openvibe-shared (icons, island, ui, seo, navbar launcher)
f0d9c1aPOST /auth/fedcm swaps a FedCM assertion for a session (jwt-bearer grant, nonce pre-check); silent login skips the Network when ov_token already verifies
a788e6fUnit runs as ubuntu like the other OpenVibe services; re-sync vendored openvibe-shared
ff4a6b6Re-sync vendored openvibe-shared with the Network's current copy
f3232e2Pastes: Live proxy, server-rendered pages with syntax highlighting, SEO
ed5edbbDeploy: systemd unit and nginx vhost for the Node app; README rewritten