Release 2.28.0

[SimonWoolf]

Bumps the version to 2.28.0 in package.json, package-lock.json and src/platform/react-hooks/src/AblyReactHooks.ts, and adds the 2.28.0 entry to CHANGELOG.md.

The change that drove the release is #2277: annotation data payloads were published in plaintext even on channels with a cipher configured, because Annotation.encode() passed an empty options object to the shared encode() helper. Annotations were the only message type whose publish path did not apply the channel's encryption.

Also included is a docstring correction that #2277 should have carried. The four publish docstrings on RealtimeAnnotations and RestAnnotations stated that annotation data is never encrypted, and gave the server's need to read it for summarisation as the reason. Both halves stopped being true once #2277 landed, and the reason had been stale considerably longer — see below.

Why a minor rather than a patch

Not for wire compatibility: the decode path already passed channelOptions through before #2277, so the change is one-directional and compatible both ways. A 2.27.0 subscriber decrypts an annotation published by 2.28.0, and a 2.28.0 subscriber handles a plaintext annotation from an older publisher unchanged.

The reason is that the old behaviour was documented in ably.d.ts, so anything built against that documented guarantee — a server-side integration parsing annotation data on a ciphered channel — now receives ciphertext. A patch is the release people apply without reading the changelog.

Worth recording that the documented rationale was already obsolete. The server needed to read data only for multiple.v1 as originally imagined, which used payloads like {"count":1}. That API was changed before annotations went public, specifically so aggregation did not read payloads, preserving the "Ably never reads your payload" property and making end-to-end encryption possible. That landed in ably-js in April 2025 with the count field, but enabling encryption was missed at the time. Summarisation reads type/name/count and never data, so encrypting it costs nothing server-side.

PRs included since 2.27.0

User-facing (in changelog)

• Encrypt annotation data payloads on encrypted channels #2277 (annotation payload encryption — drove the release)

The branch also carries an internal replacement of CipherOptions with an EncryptedChannelOptions type narrowed by an isEncrypted() guard, a fix for encode() testing cipher without channelCipher before dereferencing it, and removal of some anti-flake sleeps from the annotation tests. None are user-facing, and all merged as part of #2277 rather than separately.

Summary by CodeRabbit

• New Features
  • Annotation data payloads are now protected with end-to-end encryption when channel encryption is configured, across realtime and REST publishing.
  • This provides stronger privacy for annotation content during transmission.
• Documentation
  • Updated annotation publishing and deletion guidance to reflect encrypted payload support.
  • Added release notes for version 2.28.0, including a link to the complete changelog.
• Release
  • Updated the package and React hooks version to 2.28.0.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a4a48d0a-8093-408b-b30d-e53dac7af9b4

📥 Commits

Reviewing files that changed from the base of the PR and between d6ab179 and debdc51.

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The release documents end-to-end encryption for annotation data when channel cipher options are configured. It updates the changelog and changes package and React hooks version identifiers from 2.27.0 to 2.28.0.

Changes

Annotation encryption release

Layer / File(s)	Summary
Document annotation encryption behavior ably.d.ts, CHANGELOG.md	Realtime and REST annotation documentation now states that annotation data is encrypted when channel cipher options are configured. The 2.28.0 changelog entry records this change.
Update release version identifiers package.json, src/platform/react-hooks/src/AblyReactHooks.ts	The package version and exported React hooks version constant now report 2.28.0.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to debdc

This release updates version metadata and documents the annotation encryption behavior change; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: vesker

Poem

A rabbit checks the ciphered stream,
And marks release two-eight-oh bright.
Annotation data now uses encryption,
Version numbers match in flight.
Thump, thump—release notes right!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the 2.28.0 release, which is the primary purpose of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/2.28.0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ttypic]

LGTM