4 Commits

Include renames

Author	SHA1	Message	Date
lockbitchat	0de8ab2d54	Replace free TURN with self-hosted coturn; fix Safari connectivity; release v5.4.10 ... - config/ice-servers.prod.js: swap ExpressTURN for self-hosted coturn at turn.securebit.chat (TURN udp/tcp on 3478, TURNS/TLS on 443). Long-lived REST-API credential (expiry capped at int32 max for coturn compatibility). - Add raw-IP STUN/TURN fallback (144.172.96.126): Safari's WebRTC layer fails to resolve STUN/TURN hostnames on some networks and gathers no srflx/relay candidates; reaching the server by IP fixes cross-browser (Safari<->Chrome) connections. Harmless to other browsers. - deploy/nginx.conf: never long-cache /config/ice-servers.js so clients don't lock onto a stale server list. - Bump version to 5.4.10 (header + init banner).	2026-07-22 18:10:17 -04:00
lockbitchat	017a590220	fix(deploy): 404 missing assets instead of HTML fallback; ship public STUN config ... - nginx: asset extensions use try_files $uri =404 so a missing file (e.g. config/ice-servers.js) no longer serves index.html with the wrong content type - add config/ice-servers.prod.js (public STUN, no secrets); Dockerfile copies it to the git-ignored config/ice-servers.js so the operator-override path exists	2026-06-15 16:30:39 -04:00
lockbitchat	366f080128	release: v4.8.9 security hardening patch ... - upgrade DOMPurify to patched release (fixes high-severity XSS GHSA-87xg-pxx2-7hvx) - upgrade esbuild build dependency; npm audit now reports 0 vulnerabilities - stop tracking config/ice-servers.js (TURN credentials); add example template - production logger no longer prints error context or info/debug output - bump version to 4.8.9 across header, manifest, README, init message - update SECURITY.md supported-release table to v4.8.x	2026-06-15 15:08:03 -04:00
lockbitchat	2468cb495e	release: v4.8.7 WebRTC join reliability patch	2026-05-19 09:49:22 -04:00