Note: entries for v0.12.10 through v0.13.1 live in the GitHub Releases notes; this file resumes at v0.13.2. The release notes on GitHub are the richer record — this file is the summary.
- NIP-17 DM relay lists (kind 10050) are honoured (#49). Fetching your messages now also asks your own published DM relays, and sending a DM publishes each gift wrap to its owner's DM relays (the recipient's for their copy, yours for the self-copy) — always merged with your configured relays. Gated on Relay reach; with it off, Vega stays on your configured relays as before. Your own published DM relays count as "my relays" for the relay-authentication scope, since a dedicated DM inbox relay is exactly the relay that requires NIP-42 before serving messages.
- Messages open faster on remote signers (#61). Gift wraps are decrypted in bounded batches instead of one at a time, and a message decrypted once is not decrypted again in the same session (in memory only — decrypted content is never written to disk).
- Feeds no longer end early on one empty relay answer (#63), and switching feed tabs starts at the top (#62).
- Relay authentication (NIP-42). Some relays won't serve your gift-wrapped DMs until the client proves who you are; Vega previously had no NIP-42 support, so on those relays Messages sat empty with no explanation. Vega now answers authentication challenges — governed by a new Relay authentication setting (Relays view and Settings), because signing an AUTH event tells the relay who you are: My relays only (default) or Any relay that asks. When Vega declines a challenge, it now says so instead of leaving an empty screen.
- Remote signer (bunker) sessions no longer go read-only after a restart (#47). The v0.14.3 connect fix applied only to fresh logins; a restored session re-sends the same connect secret and hit the same failure, and a failed reconnect also rewrote the account's login type, making it permanent. Reconnect now works, keeps the login type on failure, times out instead of hanging, and reports failures.
- The unbounded diagnostics log is gone. Since v0.13.0 Vega appended to
~/vega-diag.logwith no cap. Disk logging is now opt-in (Settings → Diagnostics), capped at 5 MB with rotation, and the old file is cleaned up once (only when it carries Vega's own marker).
- Dependency updates (rusqlite 0.40, marked 18, sha2 0.11); SECURITY.md, CONTRIBUTING.md and CODE_OF_CONDUCT.md added.
- Look around first. The welcome screen no longer requires a key — browse Trending read-only and sign in when you want to post (#34).
- The relay badge counts your relays, with a separate
+Nfor anything beyond them (built-in relay, NIP-65 reach). No+Nwith Relay reach off means Vega is staying inside your list (#36). - Relay reach now governs every path that adds relays, including the NDK behaviour that connected to your published relay list on login. Follow-feed refreshes also open fewer connections (one relay per followed author instead of two).
- Relay list changes apply immediately (#35). Removed relays used to return on the next refresh until restart; added relays weren't subscribed to until restart.
- Relay reach switch (Relays view + Settings). Vega's NIP-65 outbox model — connecting to the relays the people you follow publish to — stays on by default, but can now be turned off to confine Vega to your configured relays.
- Desktop notifications for incoming DMs (NIP-04 and NIP-17), on by default, toggleable in Settings → Notifications. The notification names the sender and nothing else — no message content ever reaches the OS notification system. Nothing is announced retroactively and no decrypted content is stored.
- Growing composers. The message and quote composers grow as you type instead of being fixed two- and three-line boxes; tidier Messages sidebar with a "New message" link.
- Supersedes v0.15.0 (published an hour earlier), which included a preview of the message text in the notification — the wrong default for an encrypted-messaging client. v0.15.0 remains published only so its update entry keeps working.
- Remote signer (NIP-46) login works with spec-compliant bunkers (#17). NIP-46 allows a signer to answer
connectwith the URI's secret instead ofack; Vega accepted onlyack, so those logins failed as "undefined". Also reported upstream (nostr-dev-kit/ndk#399). Reported and verified by @DalShooth against a real Bunker46. - Proxy DNS leaks on Vega's own requests (#11). Update checks, uploads and lookups now resolve hostnames through the SOCKS5 proxy; relay WebSockets (in the webview) may still resolve locally — noted in Settings.
- Supply-chain hardening: release builds install from the exact reviewed lockfile with scripts disabled, all GitHub Actions pinned to commit SHAs, dependency monitoring extended to Rust and the build pipeline; the embedded relay's signature verification is now pinned by tests.
- Linux key storage now uses the system secret service (gnome-keyring / KWallet) instead of the kernel keyring. Your secret key now survives reboots reliably, and — importantly — persists inside sandboxed installs (Flatpak), which the kernel keyring could not. macOS and Windows are unchanged.
- Linux users re-enter their key once after this update. The previous kernel-keyring entry isn't readable by the new backend, so on first launch you'll sign in again; after that it persists as normal.
- Requires a running secret-service provider (gnome-keyring or KWallet — standard on GNOME/KDE and most desktops).
- Support view no longer crashes. Opening Support (the About/donate view) crashed the app with a blank "Vega crashed" screen (React error #130).
react-qr-codeships CommonJS, and since the Vite 8 / Rolldown migration (v0.13.2) its default import resolved to the module namespace object instead of the component, making the QR code an invalid element. The import now unwraps to the real component. Reproduced and verified fixed against the production build.
- Configurable network proxy (HTTP / SOCKS5), including Tor. New section in Settings routes Vega's traffic — relay WebSockets, Rust-side fetches, and update checks — through a proxy. Contributed by Anderseta (#10).
- Contributors section in the README.
- The proxy routes traffic but DNS may still resolve locally, so relay hostnames can leak. Full DNS privacy (e.g.
socks5hfor Tor) is not guaranteed yet — noted in the proxy settings and tracked in #11.
- App identifier is now
com.veganostr.Vega(wascom.hoornet.vega). Reverse-DNS app IDs must sit on a domain the project controls; Flathub rejects anything else, and this keeps Vega's identity consistent across Flathub, winget and the native installers.
- Existing data is carried across automatically on first launch. The identifier keys every per-app directory, so v0.14.0 moves the old directories to the new ones before opening anything: the SQLite cache (
vega.db), the embedded relay's database (relay.db), and webview localStorage (themes, drafts, podcast subscriptions, article read-state). All three per-platform roots are covered — WebView2 keeps localStorage under%LOCALAPPDATA%on Windows, and WKWebView keeps it under~/Library/WebKiton macOS, neither of which is the app data dir. - The migration only ever moves into a fresh install; an existing directory with data in it is never overwritten.
- Keys are unaffected. The OS keychain service name is independent of the app identifier, so you stay logged in.
- Windows only: the identifier change makes Windows treat v0.14.0 as a new application, so it installs alongside v0.13.2 rather than replacing it. Data is carried over; remove the old "Vega" entry from Add/Remove Programs. One-time only.
- Update banner changelog. When an update is available, a "What's new" toggle expands the newest version's release notes inline (rendered as markdown), with a link to the full changelog on GitHub. The notes were already fetched by the updater but never shown.
- Resizable left sidebar. Drag the right edge to set the sidebar width (clamped 160–360px); double-click to reset. The chosen width persists to localStorage. Collapse-to-icons is unchanged.
- Search now respects the mute list (#7). Notes, articles, and people from muted pubkeys — and posts matching muted keywords — are filtered out of search results, matching the feed. Previously only the people suggestions list was filtered.
- Compose box collapses when idle (#6). The note composer shows as a single line until focused, then expands to full height with its toolbar; it stays expanded while you interact with its controls or have unsent content. Reclaims vertical space at the top of the feed (reported as oversized on macOS).
- Build migrated to Vite 8 / Rolldown.
manualChunksconverted to the function form Rolldown requires. This also drops theesbuilddev-server dependency, clearing two Dependabot alerts (one high, one low).
- Web of Trust filter now applies everywhere. Previously it only hid notes from outside your social graph on the global feed. It now also filters:
- All feed tabs — global, following, and trending.
- Reaction pills — emoji counts no longer include reactions from pubkeys outside your trust graph.
- Zap totals — sat counts and zap counts no longer include zaps from outside your trust graph. Zaps are filtered by the actual zapper's pubkey (from the inner zap request), not the outer LNURL service pubkey.
- The "new account" badge on notes. It marked pubkeys whose kind-0 profile event was newer than 60 days, on the assumption that that approximated account age. It doesn't — kind-0
created_atis "profile last updated," so anyone who tweaked their bio recently got flagged regardless of how long they've been on Nostr. Dropped until there's a real signal to use.
- Linux WebKit web process no longer grows unbounded to 8–12 GB and self-kills. Memory now oscillates at ~0.85–1.6 GB during heavy scrolling on Linux and Windows. Root cause: the Blossom SHA-256 URL auto-detection regex introduced in v0.12.6 caused 3–5× more
<img>elements per feed page, which combined with WebKitGTK's weak bitmap eviction pushed the WebProcess past its self-kill threshold. Blossom URL auto-detection is temporarily disabled pending proper validation in a future release. - WebKit rendering:
WEBKIT_FORCE_SOFTWARE_RENDERING=1on Linux to keep the Wayland compositor path intact on Hyprland. fetchNotificationswas firing 3× in the first 8 seconds of login; now fires once and the first background poll is delayed to 90s.
- v0.12.7 OOM firefighting reverted: follow feed back to 100 events, global feed caches up to 200 — matching pre-crisis v0.12.6 behavior.
- Image uploads now work again — nostr.build and files.sovbit.host endpoints updated to their current NIP-96 URLs; removed void.cat (dead) and nostrcheck.me (returned broken URLs without file extensions)
- NIP-98 HTTP Auth header now includes the required SHA-256 payload hash, fixing rejections from strict NIP-96 servers
- SVG files are now rejected with a clear error message before upload in profile picture, banner, compose box, and inline reply — SVGs were silently uploading but rendering as broken images on all Nostr clients
- Profile bios now render clickable links,
@mentions, and#hashtags— profiles link to other profiles automatically - DM messages now render clickable URLs, inline images, nostr entity links, and hashtags
- Article editor: selecting multiple images now inserts all of them correctly (previously only the last one was kept)
- Article editor: image thumbnail strip is now clickable — opens a full-size lightbox
- Blossom / NIP-96 image URLs with non-standard extensions (
.jp, no extension) now render as inline images nostr:entity matching made case-insensitive for broader compatibility- Multi-image article upload now inserts images with proper spacing between them
- V4V auto-streaming now stays off when manually disabled mid-episode; previously any play/pause/seek event would re-engage it for the same episode
- Sentence case applied consistently to all button labels, tab labels, status text, and placeholders across every view
- All hard-coded colors (
amber-*,gray-*,bg-white,text-whiteon non-colored backgrounds) replaced with theme tokens — correct appearance across all 7 themes - All debug logging routed through
debug.ts— production builds are fully silent (zeroconsole.*leaks) - Unicode punctuation:
...→…, ASCIIxclose buttons →×throughout - Hover
titletooltips added to all truncated text (names, NIP-05, relay URLs, npub/nsec) - Focus rings added to interactive elements for keyboard navigation
aria-labeladded to all icon-only buttons
- NIP-1068 Polls — create, vote, animated result bars
- Switched default relay to Vega's custom Go relay (
wss://relay2.veganostr.com) - Note action icons with tooltips
- Fix duplicate search results (people search deduplication)
- Fix thread indentation overflow on narrow windows
- Fix DMs not loading — switched from fetchEvents to subscribe-based fetch for NIP-17 gift wraps
wss://relay2.veganostr.comincluded by default
- Fix empty Media feed (24h time window)
- Fix empty Trending feed (retry on empty)
- Read-only mode banner
- Built-in podcast player with Fountain.fm + Podcast Index
- V4V streaming sats per minute to creators
- Auto-streaming with per-episode caps and weekly budgets
- V4V sidebar dashboard with history
- Embedded Nostr relay (strfry), naddr links, new themes, follower badges
- Project renamed from Wrystr to Vega (named after Jurij Vega)
- All localStorage/keychain keys preserved for backward compatibility