[cameri]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

nostream@3.8.0

Minor Changes

• #941 42ed39e Thanks @Ferryx349! - feat(admin): moderation tools for pubkey, kind, and IP limits (closes #634)

  Adds admin API and console view to read and update event pubkey/kind lists, rate-limit bypass lists, quick ban/unban actions, and activity stats for top publishers, client IPs, and rate-limit hits.

Patch Changes

• #968 98bd234 Thanks @chappie-daemon! - chore(deps): build and test on Node 24.22.1, which patches the Brotli decoder

  CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0,
  reachable by anything that decodes a br stream. Node bundles its own decoder,
  so the fix is the Node release: 24.22.1 on the 24 line. .nvmrc and both
  Dockerfile stages move from floating node:24-alpine to a pinned
  node:24.22.1-alpine.

• #945 062ee00 Thanks @chappie-daemon! - Namespace EWMA rate-limiter keys so they cannot collide with sliding-window keys

  The two strategies store different Redis types under the same key name: a sliding
  window keeps a sorted set, EWMA keeps a hash. A cache volume carried over from 2.x,
  or an operator switching limits.rateLimiter.strategy, therefore left EWMA reading a
  sorted set as a hash — a WRONGTYPE error on every connection and message until the
  old key expired. EWMA now writes under an ewma: prefix, which also keeps both
  strategies' windows intact if the strategy is switched back.

• #965 ee65257 Thanks @chappie-daemon! - fix(ci): publish legal image tags and keep latest off prereleases

  A changesets relay release is tagged nostream@3.7.0, and @ is not legal in a
  Docker tag, so the type=ref,event=tag rule handed buildx a tag it refused: the
  first live run of the Release workflow failed with invalid tag ...: invalid reference format and published no image for the release (#964).

  The tags are now computed by a shell step, so every tag is a value this
  repository chose and can check: the bare version, vX.Y.Z as well beside it for
  a legacy tag, and latest only when the release is not a prerelease. Each tag is
  validated against Docker's grammar before the build, so an illegal one fails by
  name at that step instead of at buildx.

  docs/CI-MIGRATION.md, docs/DEPLOYMENT.md and docs/DEPLOY-RUNBOOK.md no
  longer promise nostream@X.Y.Z as a pinnable image tag, and the runbook now
  names the receiver change that subscribing to release events depends on.

• #967 9c736c8 Thanks @chappie-daemon! - ci(release): allow the image build to be dispatched for an existing tag

  A published release is immutable, so when the image build fails while publishing
  it, the release cannot be re-published to retry: GitHub refuses the round trip
  with immutable cannot be changed when release is immutable. That left #964's
  release with no image and no way to build one.

  release.yml now accepts workflow_dispatch with a tag input, and refuses a
  tag that is not a relay release, since the event carries no tag of its own. With
  no release flags present the prerelease is read from the version, so a dispatch
  of nostream@3.8.0-rc.1 still leaves latest where it is.

nostream-website@1.3.3

Patch Changes

• #965 ee65257 Thanks @chappie-daemon! - fix(ci): publish legal image tags and keep latest off prereleases

  A changesets relay release is tagged nostream@3.7.0, and @ is not legal in a
  Docker tag, so the type=ref,event=tag rule handed buildx a tag it refused: the
  first live run of the Release workflow failed with invalid tag ...: invalid reference format and published no image for the release (#964).

  The tags are now computed by a shell step, so every tag is a value this
  repository chose and can check: the bare version, vX.Y.Z as well beside it for
  a legacy tag, and latest only when the release is not a prerelease. Each tag is
  validated against Docker's grammar before the build, so an illegal one fails by
  name at that step instead of at buildx.

  docs/CI-MIGRATION.md, docs/DEPLOYMENT.md and docs/DEPLOY-RUNBOOK.md no
  longer promise nostream@X.Y.Z as a pinnable image tag, and the runbook now
  names the receiver change that subscribing to release events depends on.

• #967 9c736c8 Thanks @chappie-daemon! - ci(release): allow the image build to be dispatched for an existing tag

  A published release is immutable, so when the image build fails while publishing
  it, the release cannot be re-published to retry: GitHub refuses the round trip
  with immutable cannot be changed when release is immutable. That left #964's
  release with no image and no way to build one.

  release.yml now accepts workflow_dispatch with a tag input, and refuses a
  tag that is not a relay release, since the event carries no tag of its own. With
  no release flags present the prerelease is read from the version, so a dispatch
  of nostream@3.8.0-rc.1 still leaves latest where it is.

[greptile-apps]

This PR does not match any of the 1 configured review trigger rule.

[github-actions]

🔍 Site preview for this PR (includes all changes on this branch): https://nostream-web-pr-966.cameri.workers.dev/preview/966/

The https://ema.tnsor.network/preview/966/ form serves the same build once this PR merges — the production router that proxies /preview/* ships with it.

Updates with every push to this PR; deleted when the PR closes.