What stoatchat/stoatchat shipped
Written by FoxPlug from the repository's own releases; not affiliated with Revolt. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/stoatchat/stoatchat; Revolt did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 26, 2026
What shipped
- MFA checks were added to dangerous endpoints including server delete, account delete, account disable, and bot delete. Pull request #1031
- Image size limits from the config are now enforced in autumn during image upload. Pull request #1067
- Publishing and writing failure cases now acknowledge properly. Pull request #1087
- IDs were updated to u64 and other GitHub model issues were fixed. Pull request #1086
- File deletion now checks both hash locations before deleting files. Pull request #1076
- OEmbed generation was added to gifbox. Pull request #1045
Why it matters
This week adds MFA checks on dangerous actions, so deleting servers, accounts, and bots now requires a second factor. Image size limits are enforced on upload, persistent file deletion checks both hash locations, and other reliability fixes improve publishing failures and ID handling.
Changelog entry
- Added MFA checks on dangerous endpoints: server delete, account delete, account disable, and bot delete. Pull request #1031
- Enforced image size limits from config in autumn on upload. Pull request #1067
- Fixed acknowledgement for publishing and writing failure cases. Pull request #1087
- Updated IDs to u64 and fixed other GitHub model issues. Pull request #1086
- File deletion now checks both hash and processed hash before deleting. Pull request #1076
- Added oEmbed generation to gifbox. Pull request #1045
This week: MFA checks on dangerous endpoints, image size limits enforced on upload, ack publishing/writing failure cases, file deletion checks both hash locations, and oEmbed for gifbox.
This week the project shipped several fixes and security improvements. MFA checks now protect dangerous actions including server delete, account delete, account disable, and bot delete. Image size limits from the config are enforced during upload in autumn. Publishing and writing failure cases now acknowledge correctly. File deletion checks both hash locations before removing files. IDs were updated to u64 and other GitHub model issues were fixed, and oEmbed generation was added to gifbox.
Week of October 12, 2026
What shipped
- Added permissions to block external emojis, bot roles with permissions on joining a server, invite expiry and max use limits, an assets route to the root payload, and migrated Nix to a flake. Release
- Fixed invite creation by validating the create invite body and making the body optional. Release
- Adopted a GitHub release pattern similar to Immich and imported tasks back into the project. Pull request #1037
- Updated the maintainer entry for crates. Pull request #1036
- Tightened triggers for the publish workflow. Pull request #1041
- Added creation of notes during release preparation. Pull request #1039
- Deleted the Gerrit workflows for now. Pull request #1038
- Published the first release candidate for version 0.16.0. Release
- Published an earlier release candidate for version 0.16.0. Release
Why it matters
This week brings new permission controls for external emojis and bot roles, plus invite expiry and usage limits, giving server admins more control. The 0.16.0 release also includes an assets route and Nix flake support, while invite creation is now more lenient with an optional body.
Changelog entry
- Feat: permissions to block external emojis Release
- Feat: bot roles with permissions upon joining a server Release
- Feat: invite expiry and max use limit Release
- Feat: add assets route to root payload Release
- Feat(nix): migrate to flake and remove default.nix Release
- Fix: validate create invite body and make body optional Release
- Ci: tighten triggers for publish Pull request #1041
- Ci: create notes on release prepare Pull request #1039
- Ci: adopt GH release pattern like Immich, import tasks back in Pull request #1037
- Chore: update maintainer entry on crates Pull request #1036
- Ci: delete Gerrit workflows for now Pull request #1038
- Release: v0.16.0-rc.1 Release
V0.16.0 is out: block external emojis, bot roles with permissions, invite expiry and max uses, assets route in root payload, and Nix flake migration. v0.16.1 fixes invite creation by validating the body and making it optional.
We released v0.16.0 with new permissions to block external emojis, bot roles that carry permissions when joining a server, invite expiry and max use limits, an assets route added to the root payload, and a migration to a Nix flake. A follow-up v0.16.1 fixes invite creation by validating the request body and making it optional. This week also included CI changes to tighten publish triggers, create release notes during preparation, adopt a GitHub release pattern similar to Immich, and delete the Gerrit workflows for now.
Week of September 21, 2026
What shipped
- Clients can now discover asset locations from the root payload. Pull request #1021
- The UseExternalEmojis permission is now enforced when adding reactions with custom emojis from other servers. Pull request #1012
- Bots can no longer be assigned as owners of group chats. Pull request #1015
- Internal release with updated shield antispam version. Release
- Fixed test infrastructure to properly declare RabbitMQ exchanges in the database test macro. Pull request #1010
Why it matters
This week brings client-facing improvements to emoji permissions and group management, along with infrastructure fixes that ensure tests run reliably. The asset route addition helps clients properly locate resources.
Changelog entry
- Added assets route to root payload for client discovery Pull request #1021
- Fixed: UseExternalEmojis permission now enforced on custom emoji reactions Pull request #1012
- Fixed: Bots can no longer be assigned as group chat owners Pull request #1015
- Fixed: RabbitMQ exchange declaration in database test macro Pull request #1010
- V0.15.7 released with updated shield antispam version Release
- V0.15.6 released with dual event writing to redis and amqp Release
Root payload now includes asset route discovery. External emoji reactions now respect permissions. Group ownership protection for bots.
This week's updates focus on improving permission enforcement and group chat safety. The UseExternalEmojis permission is now properly validated for custom emoji reactions, and bots are prevented from becoming group owners. On the infrastructure side, we fixed test reliability issues in the database macro, ensuring consistent test execution.
Week of September 14, 2026
What shipped
- Invites now support expiry timestamps and maximum usage limits, with automatic cleanup of expired invites. Pull request #986
- Bots can now be invited with specific permissions that automatically create a managed role on the server. Pull request #883
- Servers can block external emojis with a new UseExternalEmojis permission. Pull request #926
- Fixed webhook permission updates not persisting correctly. Pull request #1003
- Fixed duplicate role entries when editing member roles. Pull request #1004
- Fixed database errors when removing profile banners by omitting empty MongoDB update operators. Pull request #872
- Updated compose configuration to use Silo instead of MinIO for self-hosted deployments. Pull request #1005
- Removed unused build info and renamed revolt to stoat in root payload. Pull request #928
- Optimized CI to skip base image builds when nothing about it has changed. Pull request #1002
Why it matters
This week brings improvements to invite management, bot deployment, permission controls, and fixes several bugs in role and webhook handling. These changes make server administration more flexible and reliable while reducing unnecessary CI overhead.
Changelog entry
- Bot invites accept permissions query parameter to create managed roles Pull request #883
- Added UseExternalEmojis permission to block external emojis on servers Pull request #926
- Fixed webhook permission updates not persisting Pull request #1003
- Fixed duplicate role entries when editing member roles Pull request #1004
- Fixed database errors when removing profile banners Pull request #872
- Updated compose to use Silo instead of MinIO for self-hosted Pull request #1005
- Optimized CI to skip base image builds when unchanged Pull request #1002
New invite expiry and limits, bot role permissions, external emoji blocking, and fixes for webhooks and roles.
Stoatchat shipped several improvements this week: invites now support expiry and usage limits with automatic cleanup, bots can request specific permissions on joining, servers can restrict external emojis, and we fixed bugs in webhook permissions and role management. Optimizations to CI reduce unnecessary builds.