What shipped on OpenVibe.Wiki

Every change deployed to OpenVibe, newest first. Each line is a commit from the OpenVibers repositories, linked to the change itself. When enough have gathered, or a large feature lands, they are written up as Patch notes on openvibe.blog. JSON: /api/v1/changelog.

2026-09-24

1f54de7The OpenVibe Frame: openvibe-shared/frame (formerly chrome-ssr) and 1.11.0; openvibe-publishing 0.3.2 (one copy of openvibe-shared)OpenVibers · 07:55 UTC
fdcea62The shared update system and one account UI: home shows what shipped (openvibe-shared chrome-ssr shipped()), /updates is the shared log, the footer links it; the shared navbar handles sign in/out (logoutUrl ends this site's session) and…OpenVibers · 07:55 UTC
907659cOne W3C trace across services (Track O): openvibe-shared v1.7.0 trace.install(app) keeps each request's traceparent and puts it on the calls made while serving it, to loopback and OpenVibe hosts onlyOpenVibers · 06:16 UTC
6c09371CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those stepsOpenVibers · 06:16 UTC
fe113b9openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside)OpenVibers · 06:16 UTC
4223b6dSECURITY.md: how to report a vulnerability ([email protected], 7-day reply, scope, supported versions)OpenVibers · 06:16 UTC

2026-09-23

1d2bd18openvibe-shared v1.5.1, openvibe-contracts v0.33.0OpenVibers · 23:15 UTC
06b6054openvibe-shared v1.5.0 (Track R release manifest), openvibe-contracts v0.32.0, openvibe-sdk v0.5.0OpenVibers · 22:22 UTC
b4e70acCI: run the shared security workflow (gitleaks secret scan + dependency audit, Track Q)OpenVibers · 19:33 UTC
ea468b4Threat review fixes: outbound links in community spaces are rel="nofollow ugc noopener" (Markdown links, bare URLs, citations, infobox URLs; official spaces unchanged); a page summary is text of at most 300 characters on every write path…OpenVibers · 19:13 UTC
011a68fWritten threat review (docs/threat-review.md, launch rule point 6): Markdown and XSS, links and redirects, Media attachments, permissions and delegation, spam, revisions and vandalism, CSRF, SSRF, caching, search/feeds/sitemaps, the space…OpenVibers · 19:13 UTC
1afdbdanginx: space imports get their own body limits (3 MB for POST /api/v1/spaces/:space/import, 7 MB for the /s/:space/import form; everything else stays at 1 MB), so a 2 MB bundle reaches the app's own checks instead of nginx's 413; header…OpenVibers · 19:06 UTC
96b8e43Space import: an owner imports a JSON bundle of pages (the seed file's page shape) into their space through POST /api/v1/spaces/:space/import or the /s/:space/import form, in one transaction (one bad page imports nothing, events included).…OpenVibers · 19:05 UTC
34bffa4Citation inspector: /w/:space/:slug/sources (?rev=N, the published revision by default) shows a revision's sources in full, server-rendered and useful without JavaScript: kind (URL or OpenVibe.Sources item), retrieval time, license, quote…OpenVibers · 19:01 UTC
39a0648Media attachments across authors and editors: a person attaches an OpenVibe.Media object only if they can read it there (public, unlisted or their own; missing, deleted and other people's private objects get one media.not_readable answer)…OpenVibers · 18:59 UTC
ed94b7a/feed.atom answers 200 with a valid Atom feed of zero entries while nothing is listable (it is linked from every page and answered 404): the feed-level updated is the last change to a public space, or the epoch when there is none, never…OpenVibers · 18:56 UTC
3b9cf78Docs: STATUS.json and README match production (2026-09-23)OpenVibers · 18:34 UTC
c1e6ff5App and module tokens act only for their on_behalf_of person; sandbox tokens refusedOpenVibers · 16:33 UTC
98b4c5bA page's discussion thread is hidden when the page stops being publicOpenVibers · 16:31 UTC
baf5d63nginx: client address headers only from $remote_addr (realip). X-Forwarded-For was appended to and CF-Connecting-IP passed through from the client, so a request reaching the origin without Cloudflare (DNS-only host or the bare IP) chose…OpenVibers · 16:14 UTC
d70d20copenvibe-publishing v0.2.1 (ReDoS fixes in ssr markdown)OpenVibers · 16:06 UTC
0634ffaSecurity: a renamed or deleted space's old slug cannot be claimed by another spaceOpenVibers · 15:54 UTC
4dcd3fbSTATUS: deployed on its domain 2026-09-23 (alpha); Sites placeholder removedOpenVibers · 02:54 UTC
1042138Generated seed text stays noindex until a person reviews it: AI-assisted imports count as AI output for the gate; reviewRevision (history form and POST /api/v1/pages/:id/revisions/:n/review) re-evaluates the gate and re-sends the Search…OpenVibers · 02:52 UTC
ab55c58openvibe-contracts v0.19.0 (this service's manifest and capabilities are released); contracts check is blockingOpenVibers · 02:47 UTC
b869edfOpenVibe.Wiki service (Wave 16, Wiki half): spaces, page trees, immutable revisions with diff and revert, citations per revision, typed infoboxes, [[internal links]], Media attachments with an explicit broken state, Community discussion…OpenVibers · 02:43 UTC

2026-09-21

b8aac8eCharter: OpenVibe.Wiki as defined in the OpenVibe realignment plan (placeholder, no code yet)OpenVibers · 16:20 UTC