New release: mellium.im/xmpp v0.21.3!
Published on August 18, 2022 by Sam Whited
After 4 months of work, we are happy to announce that mellium.im/[email protected] has been released!
This release fixes bugs in the component and xmpp packages, adds functionality to the ibb, roster, and xmpp packages, deprecates the ibr2 package, and moves the compress package to the legacy codebase. It also features a new package, upload, that implements transferring files by uploading them to an HTTP server!
Let's dig into a few highlights in more detail:
The new upload package supports the client side of XEP-0363: HTTP File Upload. It gives users a flexible way to request a place to upload a file and get a download link that can be sent to others. One nice thing about our upload package is that it does not perform any of the uploading itself, it just requests the URLs and gives you a mechanism for generating an HTTP request. This keeps it flexible and means that if you're using an HTTP implementation other than the standard library version, or if you want to first customize your client before performing the upload you can still use our upload package.
Another big change is the return of channel binding when performing authentication over TLS 1.3! Existing channel binding mechanisms had previously been deprecated due to security weaknesses, so we wrote RFC 9266 to provide us with a way to bind the TLS channel safely. Now that it's been through the RFC process we're hopeful that the rest of the XMPP community will begin adopting it so that the channel binding variants of SCRAM authentication can be re-enabled!
As always, more information can be found in the changelog.
This release fixes bugs in the component and xmpp packages, adds functionality to the ibb, roster, and xmpp packages, deprecates the ibr2 package, and moves the compress package to the legacy codebase. It also features a new package, upload, that implements transferring files by uploading them to an HTTP server!
Let's dig into a few highlights in more detail:
The new upload package supports the client side of XEP-0363: HTTP File Upload. It gives users a flexible way to request a place to upload a file and get a download link that can be sent to others. One nice thing about our upload package is that it does not perform any of the uploading itself, it just requests the URLs and gives you a mechanism for generating an HTTP request. This keeps it flexible and means that if you're using an HTTP implementation other than the standard library version, or if you want to first customize your client before performing the upload you can still use our upload package.
Another big change is the return of channel binding when performing authentication over TLS 1.3! Existing channel binding mechanisms had previously been deprecated due to security weaknesses, so we wrote RFC 9266 to provide us with a way to bind the TLS channel safely. Now that it's been through the RFC process we're hopeful that the rest of the XMPP community will begin adopting it so that the channel binding variants of SCRAM authentication can be re-enabled!
As always, more information can be found in the changelog.