v4.20.7 v0.53.0
medium risk
tt-a1i/archifySep 24, 2026 → Sep 27, 20263 days between releases
What's New
Introduces idle keepalive config and security patches for header parsing and TLS handshake
Breaking Changes
- Unknown values for `[bridge].idle_keepalive` configuration fail at load.
New Features
- New `[bridge].idle_keepalive` configuration option (off, silence, comfort_noise).
- siphon-rs v2026.09.22 update
- rustls v0.23.45 update
Improvements
- Security fix for `siphon-rs` header parsing panics.
- Security fix for `rustls` TLS 1.3 handshake messages.
Bug Fixes
- Fixes remote panics in `extract_tag` and `validate_event_package` header parsing.
- Fixes TLS 1.3 handshake vulnerabilities across encryption boundaries.
Upgrade Notes
Add the new `[bridge].idle_keepalive` configuration option to your config. Ensure you use valid values ('off', 'silence', 'comfort_noise') as unknown values will cause the service to fail to load.
The Two Releases
v4.20.7
v4.20.7
Sep 24, 2026· 27 days ago
Patch release addressing security vulnerabilities and fixing crashes related to concurrent constraint creation and ID seeking logic.
Full release notesv0.53.0
v0.53.0
Sep 27, 2026· 24 days ago
Adds an optional idle keepalive mechanism to prevent RTP starvation during silent periods and includes critical security patches for remote panics in header parsing and TLS handshake vulnerabilities.
Full release notes