chore: release new version 🚀

[cameri]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

nostream@3.0.0

Major Changes

• #524b3effd1 Thanks @vikashsiwach! - Use exact pubkey matching for fee-schedule whitelists and event pubkey whitelist/blacklist checks.

• #574f1c1118 Thanks @Mahmoud-s-Khedr! - Add a brand-new unified nostream CLI/TUI that replaces the legacy scripts/* shell wrappers for lifecycle, setup, info, config, data, and development workflows.

  Fixes - fixed some consistnacy issues after the migration from npm to pnpm

Minor Changes

• #5227edd6c3 Thanks @a-khushal! - added NIP-45 COUNT support with end-to-end handling (validation, handler routing, DB counting, and tests).

• #62936f8bad Thanks @Anshumancanrock! - feat: NIP-42 AUTH handler and WebSocket session wiring

• #534a07b0f6 Thanks @archief2910! - Add hot-path PostgreSQL indexes for subscription, vanish, retention, and invoice queries; add db:benchmark and db:verify-index-impact tooling; document index rationale and benchmarking. Closes#68.

• #556d8f62b4 Thanks @saniddhyaDubey! - perf: added k6 performance tests for connection and message rate limiting

• #62354139ed Thanks @saniddhyaDubey! - new user-facing config field

• #47649322a9 Thanks @saniddhyaDubey! - Add EWMA rate limiter with configurable strategy support

• #602d3ba328 Thanks @CKodidela! - Add relay support for the Marmot Protocol (E2EE group messaging over Nostr).

  Supported MIPs: 00 (KeyPackages), 01 (Group Construction), 02 (Welcome Events), 03 (Group Messages).

  • kind 443 (legacy KeyPackage): stored as a regular event
  • kind 10051 (KeyPackage relay list): stored as a replaceable event
  • kind 30443 (KeyPackage): stored as a parameterized-replaceable event with d-tag deduplication
  • kind 444 (Welcome rumor): blocked from direct publishing; must travel inside a kind 1059 gift wrap
  • kind 445 (Group Event): dedicated strategy validates the required h tag (nostr_group_id) before storing; #h tag subscriptions work via the existing generic tag index
  • NIP-11 relay info now advertises supported_mips: [0, 1, 2, 3]

• #5155c12f36 Thanks @archief2910! - Add NIP-03 OpenTimestamps support for kind 1040 events: structural .ots validation, Bitcoin attestation requirement, digest match to the referenced e tag, and relay metadata updates (#105).

• #58925d5405 Thanks @CKodidela! - Add NIP-25 Reactions support for kind 7 and kind 17 events: reaction utility helpers (isReactionEvent, isExternalContentReactionEvent, isLikeReaction, isDislikeReaction, parseReaction), schema validation enforcing required e tag on kind 7 and required k/i tags on kind 17, unit tests, and integration tests.

• #585ce59383 Thanks @CKodidela! - Add NIP-65 Relay List Metadata support for kind 10002 events: relay list utility with isRelayListEvent and parseRelayList helpers, unit tests, and relay information document updated to advertise NIP-65 (#577).

• #514214bef5 Thanks @Anshumancanrock! - Add gzip and xz compression support to event import/export flows.

  • Export supports --compress/-z with --format gzip|gz|xz.
  • Import auto-detects compressed input by extension and magic bytes and decompresses in a stream pipeline.
  • Includes docs updates and unit/integration test coverage for compression paths.

• #628ce7b838 Thanks @Ferryx349! - refactor(http): remove deprecated network.remote_ip_header fallback and rely on network.remoteIpHeader

• #539bdd4f6b Thanks @Justxd22! - Add NWC (NIP-47) as a payments processor for admission invoices, including configurable invoice expiry and reply timeout handling, compatibility for legacy NWC URI schemes, and docs/env updates.

• #497e1a7bfb Thanks @phoenix-server! - Release highlights:

  Features

  • NIP-05 verification support (#463)
  • NIP-17 & NIP-44 v2 Modern Direct Messages (#458)
  • NIP-62 vanish event support (#418)
  • Vanish optimization (#446)
  • Export events to JSON Lines format (#451)
  • Import .jsonl events into events table (#414)
  • Opt-in event retention purge (#359, #412)
  • Wipe events table script (#450)
  • Nginx reverse proxy in docker-compose (#423)
  • Docker DNS pre-flight check for connectivity verification (#398)
  • Strict validation for payment callbacks (#426)
  • Real home page with templated pages (#409)

  Bug Fixes

  • NIP-01 compliance: deterministic event ordering by event_id
  • NIP-01 compliance: correct dedup keys for parametrized replaceable events (#480)
  • NIP-01 replaceable event tiebreaker (#416)
  • NIP-11 served only on root path instead of relay path (#399)
  • Dockerfile: run database migrations in CMD (#422)
  • Added expired_at filter to message pipeline (#403)
  • Removed unsafe-inline and implemented script nonces for CSP hardening (#394)
  • Axios upgraded to fix CVE-2025-62718 (#466)

  Refactors & Chores

  • Migrated validation from Joi to Zod (#484)
  • Migrated linting and formatting to Biome (#452)
  • Converted user admission to PostgreSQL stored function (#428)
  • Upgraded to Node.js 24 LTS (#419)
  • Updated dependencies (express, body-parser, js-yaml, axios)

• #6226a0a5fa Thanks @Anshumancanrock! - feat: add NIP-42 types, schemas and constants

Patch Changes

• #555ddc811d Thanks @Anshumancanrock! - Migrate project tooling from npm to pnpm across CI workflows, Docker setup, hooks, and contributor commands.

• #600dfa2838 Thanks @saniddhyaDubey! - fix: maxLimit checks added to subscription message handler

• #572b718036 Thanks @dependabot! - Bump dev dependency uuid from 8.3.2 to 14.0.0

• #616f9f6d64 Thanks @Anshumancanrock! - fix: check payments.enabled in callback route middleware

• #5977da1b9a Thanks @Anshumancanrock! - refactor: only register OpenNode, LNbits, and Zebedee callback routes when their processor is active

• #438f5ba023 Thanks @tharu-jwd! - fix: close dead connections even if they have active subscriptions

• #546faa7ed2 Thanks @Justxd22! - Fix root HTML negotiation and subpath-aware template links behind trusted proxies.

• #61336e5af8 Thanks @dependabot! - chore(deps): bump axios from 1.15.1 to 1.15.2

• #61750822b9 Thanks @dependabot! - chore(deps): bump fast-uri from 3.1.0 to 3.1.2

• #618c6368db Thanks @dependabot! - chore(deps): bump ws from 8.20.0 to 8.20.1

• #620dac92b4 Thanks @dependabot! - chore(deps): bump uuid from 8.3.2 to 14.0.0

• #6301295272 Thanks @dependabot! - chore(deps): bump axios from 1.15.2 to 1.16.0

• #575b7324a6 Thanks @kanishka0411! - Expire stale pending invoices when LNbits no longer has the invoice or reports it as unpaid past its expiry time.

• #5920119c74 Thanks @Anshumancanrock! - Security: override serialize-javascript to >=7.0.3 (CVE RCE, GHSA-5c6j-r48x-rmvq)

• #5533c78e61 Thanks @Anshumancanrock! - Fix replaceable batch upserts to apply NIP-01 tie-breaker semantics when timestamps are equal by comparing event IDs.

• #583321a9cc Thanks @kanishka0411! - Allow generic tag filters to match empty string tag values.

• #5862418209 Thanks @kanishka0411! - Implement geohash wildcard/prefix behavior for #g filters (closes#265): a
  criterion ending in * matches any event g tag whose value starts with the
  prefix before *; exact matching (no *) is unchanged. Only normal geohash
  prefixes are intended as input. This is a Nostream extension, not part of
  NIP-12.

• #584a6d32b1 Thanks @Anshumancanrock! - Use timingSafeEqual for Nodeless webhook HMAC verification and guard against missing NODELESS_WEBHOOK_SECRET

• #591f31be1c Thanks @Priyanshubhartistm! - fix: add husky install fallback for non-dev environments

• #5517fc0552 Thanks @CKodidela! - Add unit tests for InvoiceRepository and UserRepository with sinon-stubbed DB client

• #5389496685 Thanks @saniddhyaDubey! - Fix: Restore CONFIGURATION.md with proper settings and remove duplicate changesets created during recovery

• #55732a1ec5 Thanks @a-khushal! - update NIP-11 relay info fields and CORS, with test and docs updates

• #593f599b1d Thanks @YashIIT0909! - fix: resolve TOCTOU race condition and key collisions in SlidingWindowRateLimiter

• #511a38d402 Thanks @Priyanshubhartistm! - Migrate runtime logging to pino across adapters, services, workers, and controllers, and stabilize CI-related fixes for coverage and integration workflows after rebasing.

• #55225f9637 Thanks @vikashsiwach! - Add integration tests for NIP-02 contact lists (Kind 3)

• #5274d030c7 Thanks @kanishka0411! - Add NIP-11 integration tests and fix max_filters mapping in relay information document.

• #547664168a Thanks @Priyanshubhartistm! - Improve NIP-22 created_at limit handling coverage and boundary reliability.

  This adds integration coverage for accepted and rejected events across configured positive and negative created_at deltas, and keeps rejection semantics consistent (rejected) for out-of-range timestamps.

• #537a89a95e Thanks @vikashsiwach! - Add NIP-62 integration tests for Request to Vanish

• #643faf55f1 Thanks @Anshumancanrock! - feat: add NIP-70 protected event detection utility

• #596250c767 Thanks @CKodidela! - Normalize runCommandWithOutput to return a CommandResult discriminated union instead of rejecting on spawn errors, fixing a crash in info --json when Docker is not installed.

• #62569d6187 Thanks @Ferryx349! - Refactor EventRepository query construction to reduce method complexity.

• #497e1a7bfb Thanks @phoenix-server! - Replace semantic-release with changesets for explicit PR-level version management. Contributors now add a changeset file per PR; the Changesets Release workflow handles version bumps and GitHub releases.

• #627c87dd03 Thanks @Ferryx349! - test(integration): verify response content-type across core HTTP paths

• #562de14f3c Thanks @Priyanshubhartistm! - Add integration test coverage for NIP-04 encrypted direct messages (kind 4).

• #525b09e23a Thanks @kushagra0902! - Dedup keys were taking multiple tags, that was not according to NIP-01 behaviour.

• #568c0c1c35 Thanks @tharu-jwd! - fix: static mirroring silently drops events when mirror has no limits configured

• #60440abf66 Thanks @phoenix-server! - Add unit tests for maintenance service factory instantiation and dependency wiring.

• #4935bf1a58 Thanks @kanishka0411! - Fix IP spoofing via unconditional trust of x-forwarded-for header

• #60647a9f4e Thanks @phoenix-server! - Add unit tests for maintenance-worker-factory with 100% code coverage

• #545a9ae0cd Thanks @Justxd22! - Fix Redis cache connection config to skip AUTH when REDIS_PASSWORD is unset

• #54800240a9 Thanks @CKodidela! - Support uppercase tag filters (#A-Z) in filter schema validation

• #5668eee70f Thanks @a-khushal! - add support for NIP-14 subject tags in text notes, with units tests to validate parsing and repository behavior

[Copilot]

Pull request overview

This is a Changesets-generated release PR for publishing nostream@3.0.0, collecting previously merged changesets into a changelog and bumping the package version.

Changes:

• Bump package.json version to 3.0.0.
• Generate CHANGELOG.md for the 3.0.0 release notes.
• Remove consumed .changeset/*.md files now included in the changelog.

Reviewed changes

Copilot reviewed 31 out of 31 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Bumps package version to 3.0.0 (release version).
CHANGELOG.md	Adds generated release notes for 3.0.0.
.changeset/uppercase-tag-filters.md	Removed consumed changeset after changelog generation.
.changeset/unreleased-since-v2.1.0.md	Removed consumed changeset after changelog generation.
.changeset/tired-dots-cover.md	Removed consumed changeset after changelog generation.
.changeset/tasty-parents-pump.md	Removed consumed changeset after changelog generation.
.changeset/strong-candles-yell.md	Removed consumed changeset after changelog generation.
.changeset/sparkly-times-win.md	Removed consumed changeset after changelog generation.
.changeset/soft-rats-stare.md	Removed consumed changeset after changelog generation.
.changeset/replace-semantic-release-with-changesets.md	Removed consumed changeset after changelog generation.
.changeset/remove-sonarqube-fix-coveralls-badge.md	Removed consumed changeset after changelog generation.
.changeset/release-whitelist-exact-match.md	Removed consumed changeset after changelog generation.
.changeset/quick-maps-marry.md	Removed consumed changeset after changelog generation.
.changeset/old-toys-stare.md	Removed consumed changeset after changelog generation.
.changeset/nip-62-integration-tests.md	Removed consumed changeset after changelog generation.
.changeset/nip-22-created-at-limits-coverage.md	Removed consumed changeset after changelog generation.
.changeset/nip-11-integration-tests.md	Removed consumed changeset after changelog generation.
.changeset/nip-03-opentimestamps.md	Removed consumed changeset after changelog generation.
.changeset/nip-02-integration-tests.md	Removed consumed changeset after changelog generation.
.changeset/migrate-logging-to-pino.md	Removed consumed changeset after changelog generation.
.changeset/loose-jeans-lead.md	Removed consumed changeset after changelog generation.
.changeset/light-lilies-yawn.md	Removed consumed changeset after changelog generation.
.changeset/khaki-papayas-return.md	Removed consumed changeset after changelog generation.
.changeset/invoice-user-repo-unit-tests.md	Removed consumed changeset after changelog generation.
.changeset/hot-path-indexes-benchmark.md	Removed consumed changeset after changelog generation.
.changeset/gentle-dots-swim.md	Removed consumed changeset after changelog generation.
.changeset/fuzzy-corners-wink.md	Removed consumed changeset after changelog generation.
.changeset/full-donuts-allow.md	Removed consumed changeset after changelog generation.
.changeset/fix-upsertmany-tiebreak.md	Removed consumed changeset after changelog generation.
.changeset/empty-nip40-tests.md	Removed consumed changeset after changelog generation.
.changeset/cyan-tigers-relax.md	Removed consumed changeset after changelog generation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coveralls]

coverage: 66.984% (-0.01%) from 66.995% — changeset-release/main into main

[phoenix-server]

Approving release PR for nostream@3.0.0