September 2026
1 version to production, 13 development entries — the days a recurring deleted-tunnel resurrection bug was closed for good, a batch of security fixes shipped (hashed recovery-phrase verification, authenticated TURN/ICE credentials, admin brute-force and CSRF protection, a stored-XSS fix, and a spoofable IP-header bypass that defeated per-IP rate limits), a long-standing admin-panel double-login bug was closed at its root cause, an update banner that needed two clicks was fixed, and stale unread badges after a reconnect were fixed for good
Sep 2
v6.04.126
DEV
A contact tunnel that can't be reached now properly gives up after about 30 minutes, instead of retrying forever
Sep 3
—
DEV
Closed 3 remaining data-integrity gaps in the tunnel-delete system, so a device offline at the moment of a delete correctly catches up instead of risking a resurfaced tunnel or message
Sep 3
v6.04.127
DEV
The already-used-invite-link warning shipped in August is now available in all 41 languages
Sep 3
v6.04.130
DEV
Security: recovery-phrase verification is now stored as a secure hash instead of in a form equivalent to plaintext
Sep 3
v6.04.130
DEV
Security: fetching TURN/ICE relay credentials now requires being logged in
Sep 3
v6.04.130
DEV
Security: added brute-force lockout and cross-site request forgery protection to the admin panel
Sep 3
v6.04.130
DEV
Security: the admin panel no longer loads a third-party CDN script
Sep 3
v6.04.131
DEV
Security: fixed a stored cross-site-scripting bug in the admin panel's diagnostic view
Sep 3
v6.04.131
DEV
Security: fixed a spoofable network-address header that could bypass every per-IP rate limit and abuse protection
Sep 3
—
DEV
Closed the underlying mechanism behind a recurring admin-panel double-login bug, so a future deploy can't reintroduce it
Sep 3
v6.04.133
DEV
Fixed the update banner needing two clicks and two reloads to actually apply an update
Sep 3
v6.04.134
DEV
Fixed the same two-click update problem in the separate "update required" recovery screen
Sep 3
v6.04.135
DEV
Fixed already-read messages reappearing as unread after a reconnect, or on a device that was offline when they were read
Sep 3
v6.04.135
PROD
A large batch reaches production: the contact-tunnel give-up timeout, the tunnel-delete data-integrity fixes, the invite-link warning in all languages, six security fixes (hashed recovery-phrase verification, authenticated TURN/ICE credentials, admin brute-force and CSRF protection, admin CDN removal, a stored-XSS fix, and a spoofable IP-header bypass that defeated per-IP rate limits), the admin double-login bug closed at its root cause, the two-click update-banner fix, and the stale unread-badge fix