EchoHub/docs/changelog/v0.2.8.md

v0.2.8

Bug Fixes

• Fix memory leak — HttpResponseMessage objects never disposed in ApiClient, leaking TCP connections and content buffers on every API call (especially on failed connection attempts)
• Fix 401 retry leak — AuthenticatedGetAsync/AuthenticatedRequestAsync leaked the original response when retrying after token refresh
• Fix connection failure cleanup — ConnectionManager.ConnectAsync now properly disposes ApiClient and EchoHubConnection on any failure path (previously only cleaned up on saved-token auth failures)
• Fix IRC gateway sending UTF-8 BOM on first message, breaking CAP negotiation and SASL auth for all clients
• Handle AUTHENTICATE * (SASL abort) instead of crashing on invalid base64
• Fix userlist not refreshing when creating a new channel — now fetches online users after channel creation
• Fix unmute timer not working — add MuteExpirationService background job that proactively unmutes users when their timed mute expires (previously only checked on message send)
• Fix missing space between mod/admin role icon and username in the userlist
• Fix invisible users still visible in the userlist — GetOnlineUsersAsync now filters invisible users; server skips UserJoined broadcast for invisible users
• Fix invisible→online transition — user reappears in cached userlist when switching from invisible back to a visible status
• Fix thread safety — _channelUsers presence cache now protected by Lock to prevent races between SignalR events and background fetches
• Fix @mention regex matching email addresses and #channel regex matching hex colors / issue numbers — both now use lookbehind and letter-requirement guards
• Fix ParseThemeColor accepting non-hex characters — now validates [0-9a-fA-F] digits
• Fix ghost channel when trying to join a channel that doesn't exist

New Features

• Add Docker support for EchoHub.Server — docker compose up -d for easy self-hosting with persistent volume for database, uploads, and logs
• IRC account creation — connecting with a new username auto-registers the account (PASS and SASL PLAIN)
• Auto-updater rollback — pre-update backup created automatically before each update; restore via File > Rollback menu or --rollback CLI flag
• Update failure recovery — if an update fails mid-extraction, offers to restore from the backup immediately
• Defensive Unix permission check — verify execute permission on startup after auto-update (defense-in-depth)
• Clickable usernames — press Enter on a username in the userlist or message sender to view their profile
• Clickable @mentions — press Enter on a message containing @username to open that user's profile
• Clickable #channels — press Enter on a message containing #channel to join/switch to that channel; #channel references are now highlighted in chat
• Embed theme colors — embed vertical border line now uses the source site's theme-color meta tag when available
• Stateful userlist — user presence is cached per channel and updated incrementally via SignalR events instead of re-fetching the full list on every join/leave/status change

Security

• Restrict file auto-open — only safe file types (video, PDF, text) are opened with the system default app; all other files are downloaded to temp without executing (prevents script execution via .bat, .exe, etc.)

Refactoring

• Extract IUserService/UserService — consolidate user registration, authentication, and profile management into a dedicated service, eliminating duplicated logic between AuthController and ChatService
• IRC gateway now checks ban status during authentication (previously skipped)
• EchoHubSpace directory updates — server now only sends user count when it actually changes instead of every 30 seconds
• ChatHub.JoinChannel now returns JoinChannelResult instead of List<MessageDto> to allow for better error handling

Distribution

• Add Chocolatey package — choco install echohub for Windows users, auto-published from CI on each release
• Add Linux/macOS install script — curl -sSfL .../install.sh | sh with automatic OS/arch detection

Documentation

• Add Flows section — Mermaid sequence diagrams documenting all major request/event flows (auth, connection, messaging, channels, moderation, file upload, link embeds, server directory) with inline code references

CI

• Add Docker workflow — builds and pushes multi-arch (amd64/arm64) server image to GHCR on release
• Add linux-arm64 builds to release pipeline — server and client binaries for ARM Linux (Raspberry Pi, cloud ARM instances)
• Automate Chocolatey package publishing in release workflow (checksum calculation, pack, push)